@contrast/assess 1.30.0 → 1.32.0

package/lib/dataflow/propagation/install/JSON/stringify.test.js

@@ -0,0 +1,265 @@
+'use strict';
+
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const {
+  UtilInspect,
+  DataflowTag: { UNTRUSTED },
+} = require('@contrast/common');
+const origStringify = JSON.stringify;
+
+describe('assess dataflow propagation JSON stringify', function () {
+  let core,
+    simulateRequestScope,
+    trackString,
+    tracker,
+    objWithoutTrackedStr,
+    objWithTrackedStr,
+    standardEvent;
+
+  beforeEach(function () {
+    ({ core, trackString, simulateRequestScope } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+
+    core.assess.dataflow.propagation.jsonInstrumentation.stringify.install();
+    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
+
+    objWithoutTrackedStr = {
+      prop1: 'test',
+      prop2: 'test2',
+      arr: [1, 2, 'test3'],
+      nested: {
+        obj: 'prop',
+      },
+    };
+
+    simulateRequestScope(() => {
+      objWithTrackedStr = {
+        prop1: trackString('test'),
+        prop2: trackString('test2'),
+        arr: [1, 2, trackString('test3')],
+        nested: {
+          obj: trackString('prop'),
+        },
+      };
+    });
+
+    standardEvent = {
+      object: {
+        tracked: false,
+        value: 'JSON',
+      },
+      args: [{ tracked: false, value: 'Object' }],
+      context: `JSON.stringify(${origStringify(objWithTrackedStr)})`,
+      name: 'JSON.stringify',
+      moduleName: 'JSON',
+      methodName: 'stringify',
+      source: 'P0',
+      target: 'R',
+      result: {
+        tracked: true,
+        value: origStringify(objWithTrackedStr),
+      },
+      value: origStringify(objWithTrackedStr),
+      tags: {
+        [UNTRUSTED]: [10, 13, 25, 29, 44, 48, 69, 72],
+      },
+    };
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.jsonInstrumentation.stringify.uninstall();
+  });
+
+  it('results in an untracked string when the object is with all strings untracked ', function () {
+    simulateRequestScope(() => {
+      const ret = JSON.stringify(objWithoutTrackedStr);
+      expect(ret).to.equal(origStringify(objWithoutTrackedStr));
+      expect(tracker.getData(ret)).to.be.null;
+    });
+  });
+
+  it('results in an untracked string when there is no Assess scope', function () {
+    simulateRequestScope(() => {
+      const ret = JSON.stringify(objWithTrackedStr);
+      expect(ret).to.equal(origStringify(objWithTrackedStr));
+      expect(tracker.getData(ret)).to.be.null;
+    }, {});
+  });
+
+  it('results in an untracked string when instrumentation is locked', function () {
+    simulateRequestScope(() => {
+      core.scopes.instrumentation.run({ lock: true }, () => {
+        const ret = JSON.stringify(objWithTrackedStr);
+        expect(ret).to.equal(origStringify(objWithTrackedStr));
+        expect(tracker.getData(ret)).to.be.null;
+      });
+    });
+  });
+
+  it('propagates correctly all kinds of string properties in a generic JSON.stringify call', function () {
+    simulateRequestScope(() => {
+      const ret = JSON.stringify(objWithTrackedStr);
+      expect(ret).to.equal(standardEvent.value);
+      expect(tracker.getData(ret)).to.be.like(standardEvent);
+    });
+  });
+
+  it('propagates correctly all kinds of string properties in a JSON.stringify call with predefined spaces', function () {
+    simulateRequestScope(() => {
+      const stringifyArgs = [objWithTrackedStr, (_k, v) => v, 's'];
+      const ret = JSON.stringify(...stringifyArgs);
+      expect(ret).to.equal(origStringify(...stringifyArgs));
+      expect(tracker.getData(ret)).to.be.like({
+        ...standardEvent,
+        context: `JSON.stringify(${origStringify(...stringifyArgs)})`,
+        args: [
+          {
+            tracked: false,
+            value: 'Object'
+          },
+          {
+            tracked: false,
+            value: 'Function',
+          },
+          {
+            tracked: false,
+            value: 'String',
+          }
+        ],
+        value: origStringify(...stringifyArgs),
+        result: {
+          tracked: true,
+          value: origStringify(...stringifyArgs),
+        },
+        tags: {
+          [UNTRUSTED]: [13, 16, 31, 35, 62, 66, 96, 99],
+        },
+      });
+    });
+  });
+
+  it('propagates correctly a JSON.stringify call with untrusted specified spaces', function () {
+    simulateRequestScope(() => {
+      const stringifyArgs = [
+        objWithoutTrackedStr,
+        (_k, v) => v,
+        trackString('user'),
+      ];
+      const ret = JSON.stringify(...stringifyArgs);
+
+      expect(ret).to.equal(origStringify(...stringifyArgs));
+      expect(tracker.getData(ret)).to.be.like({
+        ...standardEvent,
+        context: `JSON.stringify(${origStringify(...stringifyArgs)})`,
+        args: [
+          {
+            tracked: false,
+            value: 'Object',
+          },
+          {
+            tracked: false,
+            value: 'Function',
+          },
+          {
+            tracked: true,
+            value: UtilInspect(stringifyArgs[2]),
+          },
+        ],
+        value: origStringify(...stringifyArgs),
+        source: 'P2',
+        result: {
+          tracked: true,
+          value: origStringify(...stringifyArgs),
+        },
+        tags: {
+          [UNTRUSTED]: [
+            2, 5, 23, 26, 45, 48, 58, 65, 69, 76, 80, 87, 96, 99, 103, 106, 119,
+            126, 141, 144,
+          ],
+        },
+      });
+    });
+  });
+
+  it('propagates correctly all kind of string properties in a JSON.stringify call with untrusted specified spaces', function () {
+    simulateRequestScope(() => {
+      const stringifyArgs = [
+        objWithTrackedStr,
+        (_k, v) => v,
+        trackString('user'),
+      ];
+      const ret = JSON.stringify(...stringifyArgs);
+      expect(ret).to.equal(origStringify(...stringifyArgs));
+      expect(tracker.getData(ret)).to.be.like({
+        ...standardEvent,
+        context: `JSON.stringify(${origStringify(...stringifyArgs)})`,
+        args: [
+          {
+            tracked: false,
+            value: 'Object',
+          },
+          {
+            tracked: false,
+            value: 'Function',
+          },
+          {
+            tracked: true,
+            value: UtilInspect(stringifyArgs[2]),
+          },
+        ],
+        value: origStringify(...stringifyArgs),
+        source: 'P',
+        result: {
+          tracked: true,
+          value: origStringify(...stringifyArgs),
+        },
+        tags: {
+          [UNTRUSTED]: [
+            2, 5, 16, 19, 23, 26, 37, 41, 45, 48, 58, 65, 69, 76, 80, 87, 89,
+            93, 96, 99, 103, 106, 119, 126, 135, 138, 141, 144,
+          ],
+        },
+      });
+    });
+  });
+
+  describe('some edge cases', function () {
+    it('handles cases when the second argument is an array', function () {
+      simulateRequestScope(() => {
+        const stringifyArgs = [objWithTrackedStr, ['arr', 'nested', 'obj']];
+        const ret = JSON.stringify(...stringifyArgs);
+        expect(ret).to.equal(origStringify(...stringifyArgs));
+        expect(tracker.getData(ret).tags).to.deep.equal({
+          [UNTRUSTED]: [13, 17, 38, 41],
+        });
+      });
+    });
+
+    it('handles cases when the third argument is not entirely tagged', function () {
+      simulateRequestScope(() => {
+        const concatSpaces = 'd'.concat(
+          trackString('us'),
+          'd',
+          trackString('us')
+        );
+        const stringifyArgs = [
+          objWithoutTrackedStr,
+          (_k, v) => v,
+          concatSpaces,
+        ];
+        const ret = JSON.stringify(...stringifyArgs);
+        expect(ret).to.equal(origStringify(...stringifyArgs));
+        expect(tracker.getData(ret).tags).to.deep.equal({
+          [UNTRUSTED]: [
+            3, 4, 6, 7, 26, 27, 29, 30, 50, 51, 53, 54, 65, 66, 68, 69, 71, 72,
+            74, 75, 80, 81, 83, 84, 86, 87, 89, 90, 95, 96, 98, 99, 101, 102,
+            104, 105, 115, 116, 118, 119, 124, 125, 127, 128, 142, 143, 145,
+            146, 148, 149, 151, 152, 168, 169, 171, 172,
+          ],
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/array-prototype-join.test.js

@@ -0,0 +1,106 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation array join', function () {
+  let core, trackString, simulateRequestScope, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.arrayJoin.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.arrayJoin.uninstall();
+    sinon.resetHistory();
+  });
+
+  [
+    {
+      expected: { untrusted: [12, 18, 38, 51] }
+    },
+    {
+      separator: 'not-tracked',
+      expected: { untrusted: [22, 28, 68, 81] }
+    },
+    {
+      separator: 'tracked-sep',
+      tags: {
+        untrusted: [0, 10]
+      },
+      expected: { untrusted: [11, 39, 57, 81] }
+    }
+  ].forEach(({ separator, tags, expected }) => {
+    it('propagates correctly', function () {
+      simulateRequestScope(function () {
+        const arr = [
+          'not-tracked',
+          trackString('tracked', { tags: { untrusted: [0, 6] } }),
+          'another-untracked',
+          trackString('another-tracked', { tags: { untrusted: [0, 13] } })
+        ];
+        let source = 'O';
+
+        if (tags) {
+          separator = trackString(separator, { tags });
+          source = 'A';
+        }
+
+        const result = arr.join(separator);
+        const strInfo = tracker.getData(result);
+        expect(strInfo?.tags).to.deep.equal(expected);
+        expect(strInfo?.source).to.equal(source);
+      });
+    });
+  });
+
+  it('propagates correclty nested arrays', function () {
+    simulateRequestScope(function () {
+      const str = trackString('tracked', { tags: { untrusted: [0, 6] } });
+      const arr = [
+        'not-tracked',
+        [
+          'not-tracked',
+          str
+        ],
+        [
+          'not-tracked',
+          [
+            'not-tracked',
+            str
+          ]
+        ]
+      ];
+
+      const result = arr.join();
+      const resultInfo = tracker.getData(result);
+      expect(resultInfo?.tags).to.deep.equal({ untrusted: [24, 30, 56, 62] });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('foo');
+      const result = ['not-tracked', value].join();
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('foo');
+        const result = ['not-tracked', value].join();
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/buffer.test.js

@@ -0,0 +1,109 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation Buffer', function () {
+  let core, simulateRequestScope, tracker, trackString, createSourceEvent;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    createSourceEvent = core.assess.eventFactory.createSourceEvent;
+    core.assess.dataflow.propagation.bufferInstrumentation.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.arrayJoin.uninstall();
+    sinon.resetHistory();
+  });
+
+  describe('Buffer.prototype.toString', function () {
+    [
+      'utf8',
+      'latin1',
+      'ascii',
+      // todo
+    ].forEach((encoding) => {
+      const value = 'foo';
+
+      it(`value when buffer is tracked (${encoding})`, function () {
+        simulateRequestScope(() => {
+          const b = Buffer.from(value, encoding);
+          const event = createSourceEvent({
+            name: 'body-parser-mock',
+            result: { tracked: true, value: b },
+            inputType: 'BODY',
+            tags: {
+              UNTRUSTED: [0, 2],
+            },
+            stack: [],
+          });
+
+          tracker.track(b, event);
+          expect(tracker.getData(b.toString(encoding))).to.deep.include({
+            addedTags: [],
+            args: [{ tracked: false, value: encoding }],
+            moduleName: 'Buffer',
+            methodName: 'prototype.toString',
+            context: 'buffer.toString()',
+            name: 'global.Buffer.prototype.toString',
+            object: { tracked: true, value: 'Buffer' },
+            removedTags: [],
+            result: { tracked: true, value },
+            source: 'O',
+            stack: [],
+            tags: {
+              UNTRUSTED: [0, 2]
+            },
+            target: 'R',
+            value,
+          });
+        });
+      });
+    });
+  });
+
+  describe('Buffer.from', function () {
+    // todo: implementation for other types. see https://nodejs.org/api/buffer.html
+
+    const trkInfoCommon = {
+      object: { tracked: true, value: 'Buffer' },
+      source: 'P0',
+      target: 'R',
+      tags: { UNTRUSTED: [0, 7] },
+    };
+
+    [
+      {
+        getArgs: () => trackString('a string'),
+        argType: 'string',
+        expected: {
+          ...trkInfoCommon,
+          context: 'Buffer.from(a string)',
+          args: [{ tracked: true, value: 'a string' }],
+        }
+      },
+      {
+        getArgs: () => Buffer.from(trackString('a buffer')),
+        argType: 'buffer',
+        expected: {
+          ...trkInfoCommon,
+          context: 'Buffer.from(a buffer)',
+          args: [{ tracked: true, value: 'a buffer' }],
+        }
+      },
+
+    ].forEach(({ argType, getArgs, expected }) => {
+      it(`tracks result when argument is tracked (arg type ${argType})`, function () {
+        simulateRequestScope(() => {
+          const b = Buffer.from(getArgs());
+          const trkInfo = tracker.getData(b);
+          expect(trkInfo).to.deep.include(expected);
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/contrast-methods/add.test.js

@@ -0,0 +1,94 @@
+'use strict';
+
+const {
+  DataflowTag: {
+    UNTRUSTED,
+  }
+} = require('@contrast/common');
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation contrast-methods add', function () {
+  let core, simulateRequestScope, trackString, tracker;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+
+    core.contrastMethods.install();
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.add.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.add.uninstall();
+  });
+
+  const foo = () => trackString('foo');
+  const bar = () => 'bar';
+
+  [
+    {
+      name: 'tracked A, untracked B',
+      args: [foo, bar],
+      expected: {
+        [UNTRUSTED]: [0, 2],
+      },
+    },
+    {
+      name: 'tracked A, tracked B',
+      args: [foo, foo],
+      expected: {
+        [UNTRUSTED]: [0, 5],
+      },
+    },
+    {
+      name: 'untracked A, tracked B',
+      args: [bar, foo],
+      expected: {
+        [UNTRUSTED]: [3, 5],
+      },
+    },
+    {
+      name: 'empty A, tracked B',
+      args: [() => '', foo],
+      expected: {
+        [UNTRUSTED]: [0, 2],
+      },
+    },
+  ].forEach(({ name, args, expected }) => {
+    it(`propagates ${name} correctly`, function () {
+      simulateRequestScope(function () {
+        const result = global.ContrastMethods.add(...args.map(Reflect.apply));
+
+        expect(tracker.getData(result))
+          .to.have.property('tags')
+          .that.deep.equals(expected);
+      });
+    });
+  });
+
+  it('will not propagate if there is no result or not in proper source scope', function () {
+    const { extern } = tracker.track('foo', { tags: { UNTRUSTED: [0, 2] } });
+
+    sinon.spy(tracker, 'track');
+    sinon.spy(tracker, 'getData');
+
+    core.scopes.sources.run({}, function () {
+      global.ContrastMethods.add('', '');
+    });
+
+    core.scopes.sources.run(null, function () {
+      global.ContrastMethods.add(extern, 'bar');
+    });
+
+    core.scopes.instrumentation.run({ lock: true }, function () {
+      core.scopes.sources.run({}, function () {
+        global.ContrastMethods.add(extern, 'bar');
+      });
+    });
+
+    expect(tracker.track).not.to.have.been.called;
+    expect(tracker.getData).not.to.have.been.called;
+  });
+});

package/lib/dataflow/propagation/install/contrast-methods/index.test.js

@@ -0,0 +1,49 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation contrast-methods', function () {
+  let core, instr;
+
+  const propagators = ['add', 'tag', 'number'];
+
+  beforeEach(function () {
+    ({ core } = initAssessFixture());
+    instr = core.assess.dataflow.propagation.contrastMethodsInstrumentation;
+  });
+
+  it('composes different installers', function () {
+    propagators.forEach((name) => {
+      expect(instr[name]).to.have.property('install').and.be.a('function');
+      expect(instr[name]).to.have.property('uninstall').and.be.a('function');
+    });
+  });
+
+  it('dispatches installation to sub-components', function () {
+    const installs = [];
+    const uninstalls = [];
+    // stub these to prevent side effects
+    propagators.forEach((name) => {
+      const instr =
+        core.assess.dataflow.propagation.contrastMethodsInstrumentation;
+      installs.push(sinon.stub(instr[name], 'install'));
+      uninstalls.push(sinon.stub(instr[name], 'uninstall'));
+    });
+
+    instr.install();
+
+    expect(installs).to.have.lengthOf(propagators.length);
+    installs.forEach((installer) => {
+      expect(installer).to.have.been.called;
+    });
+
+    instr.uninstall();
+
+    expect(uninstalls).to.have.lengthOf(propagators.length);
+    uninstalls.forEach((installer) => {
+      expect(installer).to.have.been.called;
+    });
+  });
+});

package/lib/dataflow/propagation/install/contrast-methods/number.test.js

@@ -0,0 +1,50 @@
+'use strict';
+
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation contrast-methods number', function () {
+  let core, simulateRequestScope, trackString, tracker;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+    core.contrastMethods.install();
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.number.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.number.uninstall();
+  });
+
+  it('will not sanitize if Number coercion fails', function () {
+    simulateRequestScope(() => {
+      const str = trackString('foo');
+      global.ContrastMethods.Number(str);
+      expect(tracker.getData(str)).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: { UNTRUSTED: [0, 2] },
+        result: { tracked: true, value: 'foo' },
+      });
+    });
+  });
+
+  it('will untrack if Number coercion succeeds', function () {
+    simulateRequestScope(() => {
+      const str = trackString('30000');
+      global.ContrastMethods.Number(str);
+      expect(tracker.getData(str)).to.be.null;
+      expect(core.logger.trace).to.have.been.calledWithMatch({
+        funcKey: 'assess-dataflow-propagator:ContrastMethods.Number',
+        sanitizer: 'ContrastMethods.Number',
+        value: '30000',
+      }, 'untracked a string value');
+
+    });
+  });
+});