@contrast/assess 1.30.0 → 1.32.0

package/lib/dataflow/sinks/install/mongodb.test.js

@@ -0,0 +1,621 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const {
+  DataflowTag: { UNTRUSTED, LIMITED_CHARS },
+  Rule,
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow sinks mongodb-v4', function () {
+  let core, simulateRequestScope, trackString, reportFindings, instr, getQueryVulnInfo, getAggregateVulnInfo, getMapReduceVulnInfo, getGroupVulnInfo;
+
+  class Db {
+    command() { }
+    eval() { }
+    aggregate() { }
+  }
+
+  class Collection {
+    find() { }
+    findOne() { }
+    findAndModify() { }
+    findOneAndDelete() { }
+    findOneAndReplace() { }
+    findOneAndUpdate() { }
+    remove() { }
+    removeOne() { }
+    replaceOne() { }
+    removeMany() { }
+    rename() { }
+    update() { }
+    updateOne() { }
+    updateMany() { }
+    deleteOne() { }
+    deleteMany() { }
+    aggregate() { }
+    mapReduce() { }
+    group() { }
+  }
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+    reportFindings = sinon.stub(core.assess.dataflow.sinks, 'reportFindings');
+    core.depHooks.resolve
+      .withArgs({ name: 'mongodb' })
+      .yields({ Collection, Db });
+
+    // while the Assess fixture will have already composed the module, we re-require (which
+    // just reassigns the component) so we're able to inject the spied-upon functions above
+    instr = require('./mongodb')(core);
+    getQueryVulnInfo = sinon.spy(instr, 'getQueryVulnerabilityInfo');
+    getAggregateVulnInfo = sinon.spy(instr, 'getAggregateVulnerabilityInfo');
+    getMapReduceVulnInfo = sinon.spy(instr, 'getMapReduceVulnerabilityInfo');
+    getGroupVulnInfo = sinon.spy(instr, 'getGroupVulnerabilityInfo');
+    instr.install();
+  });
+
+  [
+    { subject: Collection, method: 'find' },
+    { subject: Collection, method: 'findOne' },
+    { subject: Collection, method: 'findAndModify' },
+    { subject: Collection, method: 'findOneAndDelete' },
+    { subject: Collection, method: 'findOneAndReplace' },
+    { subject: Collection, method: 'findOneAndUpdate' },
+    { subject: Collection, method: 'remove' },
+    { subject: Collection, method: 'replaceOne' },
+    { subject: Collection, method: 'update' },
+    { subject: Collection, method: 'updateOne' },
+    { subject: Collection, method: 'updateMany' },
+    { subject: Collection, method: 'deleteOne' },
+    { subject: Collection, method: 'deleteMany' },
+    { subject: Db, method: 'command' },
+  ].forEach(({ subject, method }) => {
+    describe(`${subject.name}.prototype.${method}()`, function () {
+      it('skips instrumentation if assess store is missing', function () {
+        const tracked = trackString('foo');
+        (new subject())[method]({ tracked });
+        expect(getQueryVulnInfo).not.to.have.been.called;
+      });
+
+      it('skips instrumentation if the argument is not a string', function () {
+        simulateRequestScope(function () {
+          (new subject())[method]({});
+          expect(reportFindings).not.to.have.been.called;
+        });
+      });
+
+      it('does not report when query argument has no tracked values', function () {
+        simulateRequestScope(function () {
+          (new subject())[method]({ foo: 'bar' });
+          expect(reportFindings).not.to.have.been.called;
+        });
+      });
+
+      it('reports safe event when the input is sanitized', function () {
+        simulateRequestScope(function () {
+          const tracked = trackString('foo', {
+            tags: {
+              [LIMITED_CHARS]: [0, 2],
+              [UNTRUSTED]: [0, 2],
+            },
+          });
+          const strInfo = core.assess.dataflow.tracker.getData(tracked);
+          (new subject())[method]({ tracked });
+          expect(getQueryVulnInfo.getCall(0).returnValue).to.deep.equal({
+            vulnInfo: null,
+            reportSafe: [{ path: ['tracked'], strInfo }]
+          });
+          expect(reportFindings).not.to.have.been.called;
+        });
+      });
+
+      it('reports a nosql-injection', function () {
+        simulateRequestScope(function () {
+          const tracked = trackString('foo');
+          (new subject())[method]({ tracked });
+
+          expect(reportFindings).to.have.been.calledWithMatch({
+            ruleId: Rule.NOSQL_INJECTION_MONGO,
+            sinkEvent: {
+              args: [{ value: "{...'tracked':'foo'...}", tracked: true }],
+              name: sinon.match(method),
+              context: `${subject.name === 'Collection' ? 'db.collection' : 'db'}.${method}({...'tracked':'foo'...})`,
+              moduleName: 'mongodb',
+              methodName: `${subject.name}.prototype.${method}`,
+              object: {
+                value: sinon.match(subject.name),
+                tracked: false,
+              },
+              result: { value: 'Promise', tracked: false },
+              source: 'P0',
+              tags: { [UNTRUSTED]: [15, 17] },
+            },
+          });
+        });
+      });
+    });
+  });
+
+  describe('Db.prototype.aggregate and Collection.prototype.aggregate', function () {
+    it('report nosql-injection from user input in the $function operator', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        (new Collection()).aggregate([
+          {
+            $function: {
+              body: tracked
+            }
+          }
+        ]);
+        (new Db()).aggregate([
+          {
+            $function: {
+              body: tracked
+            }
+          }
+        ]);
+
+        expect(reportFindings).to.have.been.calledTwice;
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [{ value: "[...'body':'foo'...]", tracked: true }],
+            name: 'mongodb.Collection.prototype.aggregate',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P0',
+            tags: { [UNTRUSTED]: [12, 14] },
+          },
+        });
+
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [{ value: "[...'body':'foo'...]", tracked: true }],
+            name: sinon.match('aggregate'),
+            object: {
+              value: sinon.match('Db'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P0',
+            tags: { [UNTRUSTED]: [12, 14] },
+          },
+        });
+      });
+    });
+
+    [
+      { prop: 'init', tagRange: [12, 14] },
+      { prop: 'merge', tagRange: [13, 15] },
+      { prop: 'accumulate', tagRange: [18, 20] },
+      { prop: 'finalize', tagRange: [16, 18] }
+    ].forEach(({ prop, tagRange }) => {
+      it(`report nosql-injection from user input in the $accumulator operator and ${prop} property`, function () {
+        simulateRequestScope(function () {
+          const tracked = trackString('foo');
+          (new Collection()).aggregate([
+            {
+              $accumulator: {
+                [prop]: tracked
+              }
+            }
+          ]);
+          expect(reportFindings).to.have.been.calledWithMatch({
+            ruleId: Rule.NOSQL_INJECTION_MONGO,
+            sinkEvent: {
+              args: [
+                { value: `[...'${prop}':'foo'...]`, tracked: true }
+              ],
+              name: 'mongodb.Collection.prototype.aggregate',
+              object: {
+                value: sinon.match('Collection'),
+                tracked: false,
+              },
+              result: { value: 'Promise', tracked: false },
+              source: 'P0',
+              tags: { [UNTRUSTED]: tagRange },
+            },
+          });
+        });
+      });
+    });
+
+    it('reports safe event when the input is sanitized', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo', {
+          tags: {
+            [LIMITED_CHARS]: [0, 2],
+            [UNTRUSTED]: [0, 2],
+          },
+        });
+        const strInfo = core.assess.dataflow.tracker.getData(tracked);
+        (new Collection()).aggregate({
+          $function: {
+            body: tracked
+          }
+        });
+        expect(getAggregateVulnInfo.getCall(0).returnValue).to.deep.equal({
+          vulnInfo: null,
+          reportSafe: [{ path: ['$function', 'body'], strInfo }]
+        });
+        expect(reportFindings).not.to.have.been.called;
+      });
+    });
+  });
+
+  describe('Collection.prototype.mapReduce', function () {
+    it('report nosql-injection from user input in the first 2 arguments of `mapReduce` method', function () {
+      const options = { options: 'untracked' };
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        (new Collection()).mapReduce(
+          tracked,
+          'untracked',
+          options
+        );
+        (new Collection()).mapReduce(
+          'untracked',
+          tracked,
+          options
+        );
+
+        expect(reportFindings).to.have.been.calledTwice;
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'foo', tracked: true },
+              { value: 'String', tracked: false },
+              { value: 'Object', tracked: false },
+
+            ],
+            name: 'mongodb.Collection.prototype.mapReduce',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P0',
+            tags: { [UNTRUSTED]: [0, 2] },
+          },
+        });
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'String', tracked: false },
+              { value: 'foo', tracked: true },
+              { value: 'Object', tracked: false },
+
+            ],
+            name: 'mongodb.Collection.prototype.mapReduce',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P1',
+            tags: { [UNTRUSTED]: [0, 2] },
+          },
+        });
+      });
+    });
+
+    it('report nosql-injection from user input in the third argument of `mapReduce` method', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        const options1 = { query: tracked };
+        const options2 = { finalize: tracked };
+        (new Collection()).mapReduce(
+          'untracked',
+          'untracked',
+          options1
+        );
+        (new Collection()).mapReduce(
+          'untracked',
+          'untracked',
+          options2
+        );
+
+        expect(reportFindings).to.have.been.calledTwice;
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'String', tracked: false },
+              { value: 'String', tracked: false },
+              { value: '{...\'query\':\'foo\'...}', tracked: true },
+            ],
+            name: 'mongodb.Collection.prototype.mapReduce',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P2',
+            tags: { [UNTRUSTED]: [13, 15] },
+          },
+        });
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'String', tracked: false },
+              { value: 'String', tracked: false },
+              { value: '{...\'query\':\'foo\'...}', tracked: true },
+
+            ],
+            name: 'mongodb.Collection.prototype.mapReduce',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P2',
+            tags: { [UNTRUSTED]: [13, 15] },
+          },
+        });
+      });
+    });
+
+    it('reports safe event when the input is sanitized', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo', {
+          tags: {
+            [LIMITED_CHARS]: [0, 2],
+            [UNTRUSTED]: [0, 2],
+          },
+        });
+        const strInfo = core.assess.dataflow.tracker.getData(tracked);
+        (new Collection()).mapReduce(
+          tracked, // call 0
+          'untracked', // call 1
+          { some: 'options' } // call 2
+        );
+        (new Collection()).mapReduce(
+          tracked, // call 3
+          'untracked', // call 4
+          { query: tracked } // call 5
+        );
+
+        expect(getMapReduceVulnInfo.getCall(0).returnValue).to.deep.equal({
+          vulnInfo: null,
+          reportSafe: [{ strInfo }]
+        });
+        expect(getMapReduceVulnInfo.getCall(5).returnValue).to.deep.equal({
+          vulnInfo: null,
+          reportSafe: [{ path: ['query'], strInfo }]
+        });
+        expect(reportFindings).not.to.have.been.called;
+      });
+    });
+  });
+
+  describe('Collection.prototype.group', function () {
+    it('report nosql-injection from user input in the first and the fourth argument of `group` method', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        const condition = { some: 'condition' };
+        const initState = { init: 'state' };
+        (new Collection()).group(
+          tracked,
+          condition,
+          initState,
+          'reduceFn'
+        );
+        (new Collection()).group(
+          'someKeys',
+          condition,
+          initState,
+          tracked
+        );
+
+        expect(reportFindings).to.have.been.calledTwice;
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'foo', tracked: true },
+              { value: 'Object', tracked: false },
+              { value: 'Object', tracked: false },
+              { value: 'String', tracked: false },
+
+            ],
+            name: 'mongodb.Collection.prototype.group',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P0',
+            tags: { [UNTRUSTED]: [0, 2] },
+          },
+        });
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'String', tracked: false },
+              { value: 'Object', tracked: false },
+              { value: 'Object', tracked: false },
+              { value: 'foo', tracked: true },
+            ],
+            name: 'mongodb.Collection.prototype.group',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P3',
+            tags: { [UNTRUSTED]: [0, 2] },
+          },
+        });
+      });
+    });
+
+    it('report nosql-injection from user input in the second argument of `group` method', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        const condition = { condition: tracked };
+        const initState = { init: 'state' };
+        (new Collection()).group(
+          'someKeys',
+          condition,
+          initState,
+          'reduceFn'
+        );
+
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [
+              { value: 'String', tracked: false },
+              { value: '{...\'condition\':\'foo\'...}', tracked: true },
+              { value: 'Object', tracked: false },
+              { value: 'String', tracked: false },
+            ],
+            name: 'mongodb.Collection.prototype.group',
+            object: {
+              value: sinon.match('Collection'),
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P1',
+            tags: { [UNTRUSTED]: [17, 19] },
+          },
+        });
+      });
+    });
+
+    it('reports safe event when the input is sanitized', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo', {
+          tags: {
+            [LIMITED_CHARS]: [0, 2],
+            [UNTRUSTED]: [0, 2],
+          },
+        });
+        const strInfo = core.assess.dataflow.tracker.getData(tracked);
+        (new Collection()).group(
+          tracked, // call 0
+          { some: 'condition' }, // call 1
+          { init: 'state' },
+          'reduceFn' // call 2
+        );
+        (new Collection()).group(
+          'untracked', // call 3
+          { field: tracked }, // call 4
+          { init: 'state' },
+          'reduceFn'
+        );
+
+        expect(getGroupVulnInfo.getCall(0).returnValue).to.deep.equal({
+          vulnInfo: null,
+          reportSafe: [{ strInfo }]
+        });
+        expect(getGroupVulnInfo.getCall(4).returnValue).to.deep.equal({
+          vulnInfo: null,
+          reportSafe: [{ path: ['field'], strInfo }]
+        });
+        expect(reportFindings).not.to.have.been.called;
+      });
+    });
+  });
+
+  describe('Db.prototype.eval() and other edge cases', function () {
+    it('skips patching if the method is missing', function () {
+      class Collection {
+        findOne() { }
+      }
+      class Db {
+        command() { }
+      }
+      core.depHooks.resolve
+        .withArgs({ name: 'mongodb' })
+        .yields({ Collection, Db }, 'v5.x.x');
+
+      const instr = require('./mongodb')(core);
+      instr.install();
+      expect(core.logger.trace).to.have.been.calledWith(
+        { version: 'v5.x.x' },
+        'method %s not found - skipping instrumentation',
+        'mongodb.Db.prototype.eval',
+      );
+      expect(core.logger.trace).to.have.been.calledWith(
+        { version: 'v5.x.x' },
+        'method %s not found - skipping instrumentation',
+        'mongodb.Collection.prototype.findOneAndDelete',
+      );
+    });
+
+    it('logs an error if such occurs during the evaluation', function () {
+      const err = new Error('test');
+
+      reportFindings.throws(err);
+
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        (new Collection()).find({ tracked });
+        (new Db()).command({ tracked });
+
+        expect(core.logger.error).to.have.been.calledWith(
+          { err, funcKey: 'assess-dataflow-sink:mongodb.Collection.prototype.find' },
+          'assess sink analysis failed',
+        );
+        expect(core.logger.error).to.have.been.calledWith(
+          { err, funcKey: 'assess-dataflow-sink:mongodb.Db.prototype.command' },
+          'assess sink analysis failed',
+        );
+      });
+    });
+
+    it('reports a nosql-injection from the eval methhod', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo');
+        (new Db()).eval(tracked);
+
+        expect(reportFindings).to.have.been.calledWithMatch({
+          ruleId: Rule.NOSQL_INJECTION_MONGO,
+          sinkEvent: {
+            args: [{ value: 'foo', tracked: true }],
+            name: 'mongodb.Db.prototype.eval',
+            moduleName: 'mongodb',
+            methodName: 'Db.prototype.eval',
+            context: 'db.eval(\'foo\')',
+            object: {
+              value: 'mongodb.Db',
+              tracked: false,
+            },
+            result: { value: 'Promise', tracked: false },
+            source: 'P0',
+            tags: { [UNTRUSTED]: [0, 2] },
+          },
+        });
+      });
+    });
+
+    it('reports safe event when the input is sanitized', function () {
+      simulateRequestScope(function () {
+        const tracked = trackString('foo', {
+          tags: {
+            [LIMITED_CHARS]: [0, 2],
+            [UNTRUSTED]: [0, 2],
+          },
+        });
+        const strInfo = core.assess.dataflow.tracker.getData(tracked);
+        (new Db()).eval(tracked);
+        expect(getQueryVulnInfo.getCall(0).returnValue).to.deep.equal({
+          vulnInfo: null,
+          reportSafe: [{ strInfo }]
+        });
+        expect(reportFindings).not.to.have.been.called;
+      });
+    });
+  });
+});