@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/propagation/install/mongoose/schema-map.test.js

@@ -0,0 +1,348 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const {
+  DataflowTag: { CUSTOM_VALIDATED, UNTRUSTED },
+} = require('@contrast/common');
+const { userDefinedType } = require('./common');
+
+describe('assess dataflow propagation mongoose.MapSchema', function () {
+  let core, trackString, simulateRequestScope, tracker, mockSchemaMap;
+
+  const makeMap = (data) => ({
+    toJSON: () => data,
+  });
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+
+    const MockMapSchema = function () {
+      this.validators = [
+        {
+          type: userDefinedType,
+        },
+      ];
+    };
+
+    MockMapSchema.prototype.doValidate = function (value, validationFunction) {
+      if (!validationFunction) return;
+
+      if (value === 'error') {
+        validationFunction({ error: value });
+      } else {
+        validationFunction();
+      }
+    };
+
+    MockMapSchema.prototype.doValidateSync = function (value) {
+      if (value === 'error') {
+        return { error: value };
+      }
+    };
+
+    mockSchemaMap = new MockMapSchema();
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.mongooseInstrumentation.schemaMap.install();
+    core.depHooks.resolve.yield(MockMapSchema);
+    core.config.assess.trust_custom_validators = true;
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('SchemaMap.doValidateSync skip instrumentation if trust_custom_validators is false', function () {
+    simulateRequestScope(function () {
+      core.config.assess.trust_custom_validators = false;
+      const str = trackString('error');
+
+      mockSchemaMap.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+      });
+    });
+  });
+
+  it('SchemaMap.doValidateSync skip instrumentation if there is an error', function () {
+    simulateRequestScope(function () {
+      const str = trackString('error');
+
+      mockSchemaMap.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+      });
+    });
+  });
+
+  it('SchemaMap.doValidateSync skip instrumentation if there is no assess scope', function () {
+    simulateRequestScope(function () {
+      const str = trackString('error');
+
+      mockSchemaMap.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.be.null;
+    }, {});
+  });
+
+  it('SchemaMap.doValidateSync skip instrumentation if there is no custom validator', function () {
+    simulateRequestScope(function () {
+      mockSchemaMap.validators = [];
+
+      const str1 = trackString('foo');
+
+      mockSchemaMap.doValidateSync(
+        makeMap({
+          name: str1,
+        })
+      );
+
+      const strInfo = tracker.getData(str1);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 2],
+        },
+        result: {
+          tracked: true,
+          value: 'foo',
+        },
+        value: 'foo',
+      });
+    });
+  });
+
+  it(`SchemaMap.doValidateSync adds ${CUSTOM_VALIDATED} tag - objects and arrays`, function () {
+    simulateRequestScope(function () {
+      const str1 = trackString('foo');
+      const str2 = trackString('foo');
+      const str3 = trackString('foo');
+
+      mockSchemaMap.doValidateSync(
+        makeMap({
+          name: str1,
+          nested: {
+            name: str2,
+            nested: ['foo', str3, str3, str3],
+          },
+        })
+      );
+
+      [str1, str2, str3].forEach((str) => {
+        const strInfo = tracker.getData(str);
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          addedTags: [CUSTOM_VALIDATED],
+          args: [{ tracked: true, value: 'foo' }],
+          context: undefined,
+          name: 'mongoose.map.prototype.doValidateSync',
+          object: { tracked: false, value: 'mongoose.SchemaMap' },
+          removedTags: [],
+          result: { tracked: false, value: undefined },
+          source: 'P0',
+          stack: [],
+          tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+          target: 'P0',
+        });
+        expect(strInfo.history[0]).to.deep.include({
+          context: 'UNKNOWN.val',
+          name: 'assess-dataflow-fixture',
+          fieldName: 'val',
+          pathName: 'val',
+          stack: [],
+          inputType: 'UNKNOWN',
+          tags: { [UNTRUSTED]: [0, 2] },
+          result: { tracked: true, value: 'foo' },
+          value: 'foo',
+        });
+      });
+    });
+  });
+
+  it('SchemaMap.doValidate skip instrumentation if trust_custom_validators is false', function () {
+    simulateRequestScope(function () {
+      core.config.assess.trust_custom_validators = false;
+      const str = trackString('error');
+
+      mockSchemaMap.doValidate(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+      });
+    });
+  });
+
+  it('SchemaMap.doValidate is there is no input', function () {
+    core.assess.eventFactory.createPropagationEvent = sinon.stub();
+
+    simulateRequestScope(function () {
+      mockSchemaMap.doValidate();
+      expect(
+        core.assess.eventFactory.createPropagationEvent
+      ).to.have.been.callCount(0);
+    });
+  });
+
+  it('SchemaMap.doValidate is there is no function as second argument', function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMap.doValidate(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 2],
+        },
+        result: {
+          tracked: true,
+          value: 'foo',
+        },
+        value: 'foo',
+      });
+    });
+  });
+
+  it('SchemaMap.doValidate skip instrumentation if there is no assess scope', function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMap.doValidate(str, () => { });
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.be.null;
+    }, {});
+  });
+
+  it('SchemaMap.doValidate skip instrumentation if there is a validation error', function () {
+    simulateRequestScope(function () {
+      const str = trackString('error');
+
+      mockSchemaMap.doValidate(str, () => 'error');
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+      });
+    });
+  });
+
+  it(`SchemaMap.doValidate adds ${CUSTOM_VALIDATED} tag - objects and arrays`, function () {
+    simulateRequestScope(function () {
+      const str1 = trackString('foo');
+      const str2 = trackString('foo');
+      const str3 = trackString('foo');
+
+      mockSchemaMap.doValidate(
+        makeMap({
+          name: str1,
+          nested: {
+            name: str2,
+            nested: ['foo', str3, str3, str3],
+          },
+        }),
+        () => undefined
+      );
+
+      [str1, str2, str3].forEach((str) => {
+        const strInfo = tracker.getData(str);
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          addedTags: [CUSTOM_VALIDATED],
+          args: [{ tracked: true, value: 'foo' }],
+          context: undefined,
+          name: 'mongoose.map.prototype.doValidate',
+          object: { tracked: false, value: 'mongoose.SchemaMap' },
+          removedTags: [],
+          result: { tracked: false, value: undefined },
+          source: 'P0',
+          stack: [],
+          tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+          target: 'P0',
+        });
+        expect(strInfo.history[0]).to.deep.include({
+          context: 'UNKNOWN.val',
+          name: 'assess-dataflow-fixture',
+          fieldName: 'val',
+          pathName: 'val',
+          stack: [],
+          inputType: 'UNKNOWN',
+          tags: { [UNTRUSTED]: [0, 2] },
+          result: { tracked: true, value: 'foo' },
+          value: 'foo',
+        });
+      });
+    });
+  });
+});