@contrast/assess 1.30.0 → 1.32.0

package/lib/dataflow/propagation/install/contrast-methods/string.test.js

@@ -0,0 +1,148 @@
+'use strict';
+
+const { expect } = require('chai');
+const { DataflowTag } = require('@contrast/common');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation String', function () {
+  let core, trackString, simulateRequestScope, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    core.contrastMethods.install();
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.string.install();
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  describe('base cases', function () {
+
+    it('null', function () {
+      expect(global.ContrastMethods.String(null)).to.equal('null');
+      expect(global.ContrastMethods.String(undefined)).to.equal('undefined');
+    });
+
+    it('number', function () {
+      expect(global.ContrastMethods.String(42)).to.equal('42');
+    });
+
+    it('boolean', function () {
+      expect(global.ContrastMethods.String(false)).to.equal('false');
+    });
+
+    it('Object.create(null) with no toString throws an error', function () {
+      const obj = Object.create(null);
+      expect(() => {
+        global.ContrastMethods.String(obj);
+      }).to.throw(TypeError);
+    });
+
+  });
+
+  describe('propagation', function () {
+    it('non-string does not propagate', function () {
+      simulateRequestScope(function () {
+        const extern = trackString({});
+
+        const result = global.ContrastMethods.String(extern);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+
+    it('untracked string does not propagate', function () {
+      simulateRequestScope(function () {
+        const result = global.ContrastMethods.String('foo');
+        expect(result).to.equal('foo');
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+
+    it('tracked string propagates', function () {
+      simulateRequestScope(function () {
+        const extern = trackString('foo');
+
+        const result = global.ContrastMethods.String(extern);
+        expect(result).to.equal('foo');
+        expect(tracker.getData(result).tags).to.deep.equal({
+          [DataflowTag.UNTRUSTED]: [0, 2],
+          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
+        });
+      });
+    });
+
+    it('toString propagates', function () {
+      simulateRequestScope(function () {
+        const extern = trackString('foo');
+
+        const result = global.ContrastMethods.String(extern).toString();
+        expect(result).to.equal('foo');
+        expect(tracker.getData(result).tags).to.deep.equal({
+          [DataflowTag.UNTRUSTED]: [0, 2],
+          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
+        });
+      });
+    });
+
+    it('tracked string propagates copy', function () {
+      simulateRequestScope(function () {
+        const extern = trackString('foo');
+
+        const result = new global.ContrastMethods.String(extern.substring(0, extern.length)).toString();
+        expect(result).to.equal('foo');
+        expect(tracker.getData(result).tags).to.deep.equal({
+          [DataflowTag.UNTRUSTED]: [0, 2],
+          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
+        });
+      });
+    });
+
+    it('object with a custom toString propagates', function () {
+      simulateRequestScope(function () {
+        const extern = trackString('foo');
+        const string = new String({
+          toString() {
+            return extern;
+          }
+        });
+
+        const result = global.ContrastMethods.String(string);
+        expect(result).to.equal('foo');
+        expect(tracker.getData(result).tags).to.deep.equal({
+          [DataflowTag.UNTRUSTED]: [0, 2],
+          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
+        });
+      });
+    });
+
+    it('class with a custom toString propagates', function () {
+      simulateRequestScope(function () {
+        const extern = trackString('foo');
+        class Test {
+          constructor() {
+            this.tracked = extern;
+          }
+
+          toString() {
+            return this.tracked;
+          }
+        }
+        const test = new Test();
+        const result = global.ContrastMethods.String(test);
+        expect(result).to.equal('foo');
+        expect(tracker.getData(result).tags).to.deep.equal({
+          [DataflowTag.UNTRUSTED]: [0, 2],
+          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/contrast-methods/tag.test.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const { expect } = require('chai');
+const {
+  DataflowTag: {
+    UNTRUSTED,
+  }
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation contrast-methods tag', function () {
+  let core, simulateRequestScope, trackString, tracker;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+
+    // We're effectively testing that `ContrastMethods.tag` delegates
+    // propagation to `String.prototype.concat` correctly.
+    core.contrastMethods.install();
+    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.tag.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.contrastMethodsInstrumentation.tag.uninstall();
+    core.assess.dataflow.propagation.stringInstrumentation.concat.uninstall();
+  });
+
+  const bar = () => trackString('bar');
+  const baz = () => 'baz';
+
+  [
+    {
+      name: '`foo${bar}`',
+      context: '`foo${expr0}`',
+      strings: ['foo', ''],
+      args: [bar],
+      expected: {
+        [UNTRUSTED]: [3, 5],
+      },
+      history: 1,
+    },
+    {
+      name: '`foo${bar}boo`',
+      context: '`foo${expr0}boo`',
+      strings: ['foo', 'boo'],
+      args: [bar],
+      expected: {
+        [UNTRUSTED]: [3, 5],
+      },
+      history: 1,
+    },
+    {
+      name: '`foo${baz}boo${bar}`',
+      context: '`foo${expr0}boo${expr1}`',
+      strings: ['foo', 'boo', ''],
+      args: [baz, bar],
+      expected: {
+        [UNTRUSTED]: [9, 11],
+      },
+      history: 1,
+    },
+    {
+      name: '`foo${bar}boo${bar}.`',
+      context: '`foo${expr0}boo${expr1}.`',
+      strings: ['foo', 'boo', '.'],
+      args: [bar, bar],
+      expected: {
+        [UNTRUSTED]: [3, 5, 9, 11],
+      },
+      history: 2,
+    },
+    {
+      name: '`foo${concat}`',
+      context: '`foo${expr0}`',
+      strings: ['foo', ''],
+      args: [() => trackString('con').concat(trackString('cat'))],
+      expected: {
+        [UNTRUSTED]: [3, 8],
+      },
+      history: 1,
+    },
+    {
+      name: '`foo${bar}boo${bar}baz{$bar}.`',
+      context: '`foo${expr0}boo${expr1}baz${expr2}.`',
+      strings: ['foo', 'boo', 'baz', '.'],
+      args: [bar, bar, bar],
+      expected: {
+        [UNTRUSTED]: [3, 5, 9, 11, 15, 17],
+      },
+      history: 3,
+    },
+  ].forEach(({ name, context, strings, args, expected, history }) => {
+    it(`propagates ${name} correctly`, function () {
+      simulateRequestScope(() => {
+        const result = global.ContrastMethods.tag(
+          strings,
+          ...args.map(Reflect.apply),
+        );
+
+        const data = tracker.getData(result);
+        expect(data).to.have.property('tags').that.deep.equals(expected);
+        expect(data).to.have.property('name', 'ContrastMethods.tag');
+        expect(data).to.have.property('history').with.length(history);
+        expect(data).to.have.property('context').that.equals(context);
+        expect(data).to.have.property('moduleName').that.equals('global');
+        expect(data).to.have.property('methodName').that.equals('ContrastMethods.tag');
+      });
+    });
+  });
+
+  /*
+   * name: '`${bar}`',
+   * strings: ['', ''],
+   * args: [bar],
+   */
+  it('handles the `${bar}` edge case appropriately', function () {
+    simulateRequestScope(() => {
+      const result = global.ContrastMethods.tag(['', ''], trackString('bar'));
+      const data = tracker.getData(result);
+      expect(data)
+        .to.have.property('tags')
+        .that.deep.equals({ [UNTRUSTED]: [0, 2] });
+      expect(data).to.have.property('name', 'assess-dataflow-fixture');
+      expect(data).not.to.have.property('history');
+    });
+  });
+
+  it('does not propagate if args are untracked', function () {
+    simulateRequestScope(() => {
+      const result = global.ContrastMethods.tag(['', ''], 'bar');
+      const data = tracker.getData(result);
+      expect(data).to.be.null;
+    });
+  });
+
+  it('does not propagate if not in proper scope', function () {
+    simulateRequestScope(() => {
+      const result = global.ContrastMethods.tag(['', ''], trackString('bar'));
+      const data = tracker.getData(result);
+      expect(data).to.be.null;
+    }, null);
+  });
+});

package/lib/dataflow/propagation/install/decode-uri-component.test.js

@@ -0,0 +1,78 @@
+
+'use strict';
+
+const {
+  DataflowTag: { UNTRUSTED, URL_ENCODED }
+} = require('@contrast/common');
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation decodeURIComponent', function () {
+  let core, trackString, simulateRequestScope, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.decodeURIComponent.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.decodeURIComponent.uninstall();
+    sinon.resetHistory();
+  });
+
+  [
+    {
+      str: '%3Ftest%3Dstr',
+      tags: {
+        [UNTRUSTED]: [0, 12],
+        [URL_ENCODED]: [0, 12]
+      },
+      expected: { [UNTRUSTED]: [0, 8] }
+    },
+    {
+      str: '?test=str',
+      tags: {
+        [UNTRUSTED]: [0, 8]
+      },
+      expected: { [UNTRUSTED]: [0, 8] }
+    },
+    {
+      str: 'not-tracked',
+    }
+  ].forEach(({ str, tags, expected }) => {
+    it('propagates correctly', function () {
+      simulateRequestScope(function () {
+        const value = tags ? trackString(str, { tags }) : str;
+
+        const result = decodeURIComponent(value);
+        const strInfo = tracker.getData(result);
+        expect(strInfo?.tags).to.deep.equal(expected);
+      });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('%3Ftest%3Dstr');
+      const result = decodeURIComponent(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('%3Ftest%3Dstr');
+        const result = decodeURIComponent(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/ejs/escape-xml.test.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const {
+  DataflowTag: { UNTRUSTED, WEAK_URL_ENCODED }
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation ejs.utils.escapeXML', function () {
+  let core, trackString, simulateRequestScope, tracker, mockEjsUtils;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    mockEjsUtils = {
+      escapeXML: (str) => `mock-escapeXML_${str}_mock-escapeXML`
+    };
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.ejsInstrumentation.escapeXML.install();
+    core.depHooks.resolve.yield(mockEjsUtils);
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('propagates correctly', function () {
+    simulateRequestScope(function () {
+      const notTrackedValue = 'foo';
+      const trackedValue = trackString('foo');
+
+      const notTrackedResult = mockEjsUtils.escapeXML(notTrackedValue);
+      const notTrackedStrInfo = tracker.getData(notTrackedResult);
+
+      const trackedResult = mockEjsUtils.escapeXML(trackedValue);
+      const trackedStrInfo = tracker.getData(trackedResult);
+
+      expect(notTrackedStrInfo).to.be.null;
+      expect(trackedStrInfo?.tags).to.deep.equal({
+        [UNTRUSTED]: [0, trackedStrInfo?.value.length - 1],
+        [WEAK_URL_ENCODED]: [0, trackedStrInfo?.value.length - 1]
+      });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('foo');
+      const result = mockEjsUtils.escapeXML(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('foo');
+        const result = mockEjsUtils.escapeXML(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/ejs/template.test.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation ejs.Template', function () {
+  let core, trackString, simulateRequestScope, MockEjsTemplate;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    MockEjsTemplate = function (source) {
+      this.source = source;
+    };
+
+    MockEjsTemplate.prototype.generateSource = function() {
+    };
+
+    core.depHooks.resolve.withArgs({ name: 'ejs', version: '>=2.6.2' }).yields({ Template: MockEjsTemplate });
+    core.assess.dataflow.propagation.ejsInstrumentation.template.install();
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('template.generateSource() will generate rewritten \'.source\' code value', function () {
+    simulateRequestScope(function () {
+      const t = new MockEjsTemplate(trackString('a + b'));
+      t.generateSource();
+
+      [
+        'function __append(s) {',
+        'if (ContrastMethods.notEqEq(s, undefined) && ContrastMethods.notEqEq(s, null)) __output = ContrastMethods.addAssign(__output, s);',
+        '}',
+        'ContrastMethods.add(a, b);',
+        'return __output',
+      ].forEach((l) => expect(t.source).to.include(l));
+    });
+  });
+
+  it('will not rewrite content if not in source scope', function () {
+    const t = new MockEjsTemplate(trackString('a + b'));
+    t.generateSource();
+    expect(t.source).to.not.include('ContrastMethods');
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const t = new MockEjsTemplate(trackString('a + b'));
+        t.generateSource();
+        expect(t.source).to.not.include('ContrastMethods');
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/encode-uri.test.js

@@ -0,0 +1,83 @@
+
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const {
+  DataflowTag: { UNTRUSTED, URL_ENCODED, WEAK_URL_ENCODED }
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation encodeURI, encodeURIComponent', function () {
+  let core, trackString, simulateRequestScope, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.encodeURI.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.encodeURI.uninstall();
+    sinon.resetHistory();
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('?test=str');
+      const result = encodeURIComponent(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('?test=str');
+        const result = encodeURIComponent(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+
+  it('does not propagate untracked string', function () {
+    simulateRequestScope(function () {
+      const value = '?test=str';
+      const result = encodeURIComponent(value);
+      expect(tracker.getData(result)).to.be.null;
+    });
+  });
+
+  it('encodeURIComponent propagates correctly', function () {
+    simulateRequestScope(function () {
+      const value = trackString('?test=str');
+
+      const result = encodeURIComponent(value);
+      expect(result).to.be.equal('%3Ftest%3Dstr');
+      const strInfo = tracker.getData(result);
+      expect(strInfo?.tags).to.deep.equal({
+        [UNTRUSTED]: [3, 6, 10, 12],
+        [URL_ENCODED]: [0, 12]
+      });
+    });
+  });
+
+  it('encodeURI propagates correctly', function () {
+    simulateRequestScope(function () {
+      const value = trackString('http://foo.org/?tëst=str');
+
+      const result = encodeURI(value);
+      expect(result).to.be.equal('http://foo.org/?t%C3%ABst=str');
+      const strInfo = tracker.getData(result);
+      expect(strInfo?.tags).to.deep.equal({
+        [UNTRUSTED]: [0, 16, 23, 28],
+        [WEAK_URL_ENCODED]: [0, 28]
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/escape-html.test.js

@@ -0,0 +1,71 @@
+'use strict';
+
+const {
+  DataflowTag: { UNTRUSTED, HTML_ENCODED }
+} = require('@contrast/common');
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation escape-html', function () {
+  let core, trackString, simulateRequestScope, tracker, mockEscapeHtml, patchedEscapeHtml;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    mockEscapeHtml = (str) => `mock-escape_${str}_mock-escape`;
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.escapeHtml.install();
+    patchedEscapeHtml = core.depHooks.resolve.yield(mockEscapeHtml)[0];
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('<script>alert("hello");</script>');
+      const result = patchedEscapeHtml(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('<script>alert("hello");</script>');
+        const result = patchedEscapeHtml(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+
+  it('will not propagate if string is not tracked', function () {
+    simulateRequestScope(function () {
+      const value = '<script>alert("hello");</script>';
+      const result = patchedEscapeHtml(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+
+  it('patchedEscapeHtml propagates correctly', function () {
+    simulateRequestScope(function () {
+      const value = trackString('<script>alert("hello");</script>');
+      const result = patchedEscapeHtml(value);
+      const strInfo = tracker.getData(result);
+
+      expect(result).to.be.equal('mock-escape_<script>alert("hello");</script>_mock-escape');
+      expect(strInfo?.tags).to.deep.equal({
+        [UNTRUSTED]: [12, 43],
+        [HTML_ENCODED]: [0, 55]
+      });
+    });
+  });
+});