@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/propagation/install/mongoose/schema-mixed.test.js

@@ -0,0 +1,512 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { DataflowTag: { CUSTOM_VALIDATED, UNTRUSTED } } = require('@contrast/common');
+const { userDefinedType } = require('./common');
+
+describe('assess dataflow propagation mongoose.MixedSchema', function () {
+  let core,
+    trackString,
+    simulateRequestScope,
+    tracker,
+    mockSchemaMixed;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    const MockMixedSchema = function () {
+      this.validators = [
+        {
+          type: userDefinedType,
+        },
+      ];
+    };
+
+    MockMixedSchema.prototype.doValidate = function (value, validationFunction) {
+      if (!validationFunction) return;
+
+      if (value === 'error') {
+        validationFunction({ error: value });
+      } else {
+        validationFunction();
+      }
+    };
+    MockMixedSchema.prototype.doValidateSync = function (value) {
+      if (value === 'error') {
+        return { error: value };
+      }
+    };
+
+    mockSchemaMixed = new MockMixedSchema();
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.mongooseInstrumentation.schemaMixed.install();
+    core.depHooks.resolve.yield(MockMixedSchema);
+    core.config.assess.trust_custom_validators = true;
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('SchemaMixed.doValidateSync skip instrumentation if trust_custom_validators is false', function () {
+    simulateRequestScope(function () {
+      core.config.assess.trust_custom_validators = false;
+      const str = trackString('error');
+
+      mockSchemaMixed.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+
+      });
+    });
+  });
+
+  it('SchemaMixed.doValidateSync skip instrumentation if there is an error', function () {
+    simulateRequestScope(function () {
+      const str = trackString('error');
+
+      mockSchemaMixed.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+
+      });
+    });
+  });
+
+  it('SchemaMixed.doValidateSync skip instrumentation if there is no assess scope', function () {
+    simulateRequestScope(function () {
+      const str = trackString('error');
+
+      mockSchemaMixed.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.be.null;
+    }, {});
+  });
+
+  it('SchemaMixed.doValidateSync skip instrumentation if there is no custom validator', function () {
+    simulateRequestScope(function () {
+      mockSchemaMixed.validators = [];
+
+      const str1 = trackString('foo');
+
+      mockSchemaMixed.doValidateSync({
+        name: str1,
+      });
+
+      const strInfo = tracker.getData(str1);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 2],
+        },
+        result: {
+          tracked: true,
+          value: 'foo',
+        },
+        value: 'foo',
+
+      });
+    });
+  });
+
+  it('SchemaMixed.doValidateSync skip instrumentation if a string is not tagged', function () {
+    core.assess.eventFactory.createPropagationEvent = sinon.stub();
+
+    simulateRequestScope(function () {
+      mockSchemaMixed.doValidateSync('foo');
+
+      expect(
+        core.assess.eventFactory.createPropagationEvent
+      ).to.have.been.callCount(0);
+    });
+  });
+
+  it(`SchemaMixed.doValidateSync adds ${CUSTOM_VALIDATED} tag - objects and arrays`, function () {
+    simulateRequestScope(function () {
+      const str1 = trackString('foo');
+      const str2 = trackString('foo');
+      const str3 = trackString('foo');
+
+      mockSchemaMixed.doValidateSync({
+        name: str1,
+        nested: {
+          name: str2,
+          nested: ['foo', str3, str3, str3],
+        },
+      });
+
+      [str1, str2, str3].forEach((str) => {
+        const strInfo = tracker.getData(str);
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          addedTags: [CUSTOM_VALIDATED],
+          args: [{ tracked: true, value: 'foo' }],
+          context: undefined,
+          name: 'mongoose.mixed.prototype.doValidateSync',
+          object: { tracked: false, value: 'mongoose.SchemaMixed' },
+          removedTags: [],
+          result: { tracked: false, value: undefined },
+          source: 'P0',
+          stack: [],
+          tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+          target: 'P0',
+        });
+        expect(strInfo.history[0]).to.deep.include({
+          context: 'UNKNOWN.val',
+          name: 'assess-dataflow-fixture',
+          fieldName: 'val',
+          pathName: 'val',
+          stack: [],
+          inputType: 'UNKNOWN',
+          tags: { [UNTRUSTED]: [0, 2] },
+          result: { tracked: true, value: 'foo' },
+          value: 'foo',
+        });
+      });
+    });
+  });
+
+  it(`SchemaMixed.doValidateSync adds ${CUSTOM_VALIDATED} tag - string`, function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMixed.doValidateSync(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        value: 'foo',
+        addedTags: [CUSTOM_VALIDATED],
+        args: [{ tracked: true, value: 'foo' }],
+        context: undefined,
+        name: 'mongoose.mixed.prototype.doValidateSync',
+        object: { tracked: false, value: 'mongoose.SchemaMixed' },
+        removedTags: [],
+        result: { tracked: false, value: undefined },
+        source: 'P0',
+        stack: [],
+        tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+        target: 'P0',
+      });
+      expect(strInfo.history[0]).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: { [UNTRUSTED]: [0, 2] },
+        result: { tracked: true, value: 'foo' },
+        value: 'foo',
+      });
+    });
+  });
+
+  it(`SchemaMixed.doValidateSync adds ${CUSTOM_VALIDATED} tag - array`, function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMixed.doValidateSync([str]);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        value: 'foo',
+        addedTags: [CUSTOM_VALIDATED],
+        args: [{ tracked: true, value: 'foo' }],
+        context: undefined,
+        name: 'mongoose.mixed.prototype.doValidateSync',
+        object: { tracked: false, value: 'mongoose.SchemaMixed' },
+        removedTags: [],
+        result: { tracked: false, value: undefined },
+        source: 'P0',
+        stack: [],
+        tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+        target: 'P0',
+      });
+      expect(strInfo.history[0]).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: { [UNTRUSTED]: [0, 2] },
+        result: { tracked: true, value: 'foo' },
+        value: 'foo',
+      });
+    });
+  });
+
+  it('SchemaMixed.doValidate skip instrumentation if trust_custom_validators is false', function () {
+    simulateRequestScope(function () {
+      core.config.assess.trust_custom_validators = false;
+      const str = trackString('error');
+
+      mockSchemaMixed.doValidate(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+      });
+    });
+  });
+
+  it('SchemaMixed.doValidate is there is no input', function () {
+    core.assess.eventFactory.createPropagationEvent = sinon.stub();
+
+    simulateRequestScope(function () {
+      mockSchemaMixed.doValidate();
+      expect(
+        core.assess.eventFactory.createPropagationEvent
+      ).to.have.been.callCount(0);
+    });
+  });
+
+  it('SchemaMixed.doValidate is there is no function as second argument', function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMixed.doValidate(str);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 2],
+        },
+        result: {
+          tracked: true,
+          value: 'foo',
+        },
+        value: 'foo',
+      });
+    });
+  });
+
+  it('SchemaMixed.doValidate skip instrumentation if a string is not tagged', function () {
+    core.assess.eventFactory.createPropagationEvent = sinon.stub();
+
+    simulateRequestScope(function () {
+      mockSchemaMixed.doValidate('foo', () => undefined);
+
+      expect(
+        core.assess.eventFactory.createPropagationEvent
+      ).to.have.been.callCount(0);
+    });
+  });
+
+  it('SchemaMixed.doValidate skip instrumentation if there is no assess scope', function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMixed.doValidate(str, () => { });
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.be.null;
+    }, {});
+  });
+
+  it('SchemaMixed.doValidate skip instrumentation if there is a validation error', function () {
+    simulateRequestScope(function () {
+      const str = trackString('error');
+
+      mockSchemaMixed.doValidate(str, () => 'error');
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+        result: {
+          tracked: true,
+          value: 'error',
+        },
+        value: 'error',
+      });
+    });
+  });
+
+  it(`SchemaMixed.doValidate adds ${CUSTOM_VALIDATED} tag - objects and arrays`, function () {
+    simulateRequestScope(function () {
+      const str1 = trackString('foo');
+      const str2 = trackString('foo');
+      const str3 = trackString('foo');
+
+      mockSchemaMixed.doValidate(
+        {
+          name: str1,
+          nested: {
+            name: str2,
+            nested: ['foo', str3, str3, str3],
+          },
+        },
+        () => undefined
+      );
+
+      [str1, str2, str3].forEach((str) => {
+        const strInfo = tracker.getData(str);
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          addedTags: [CUSTOM_VALIDATED],
+          args: [{ tracked: true, value: 'foo' }],
+          context: undefined,
+          name: 'mongoose.mixed.prototype.doValidate',
+          object: { tracked: false, value: 'mongoose.SchemaMixed' },
+          removedTags: [],
+          result: { tracked: false, value: undefined },
+          source: 'P0',
+          stack: [],
+          tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+          target: 'P0',
+        });
+        expect(strInfo.history[0]).to.deep.include({
+          context: 'UNKNOWN.val',
+          name: 'assess-dataflow-fixture',
+          fieldName: 'val',
+          pathName: 'val',
+          stack: [],
+          inputType: 'UNKNOWN',
+          tags: { [UNTRUSTED]: [0, 2] },
+          result: { tracked: true, value: 'foo' },
+          value: 'foo',
+        });
+      });
+    });
+  });
+
+  it(`SchemaMixed.doValidate adds ${CUSTOM_VALIDATED} tag - string`, function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMixed.doValidate(str, () => undefined);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        value: 'foo',
+        addedTags: [CUSTOM_VALIDATED],
+        args: [{ tracked: true, value: 'foo' }],
+        context: undefined,
+        name: 'mongoose.mixed.prototype.doValidate',
+        object: { tracked: false, value: 'mongoose.SchemaMixed' },
+        removedTags: [],
+        result: { tracked: false, value: undefined },
+        source: 'P0',
+        stack: [],
+        tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+        target: 'P0',
+      });
+      expect(strInfo.history[0]).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: { [UNTRUSTED]: [0, 2] },
+        result: { tracked: true, value: 'foo' },
+        value: 'foo',
+      });
+    });
+  });
+
+  it(`SchemaMixed.doValidate adds ${CUSTOM_VALIDATED} tag - array`, function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      mockSchemaMixed.doValidate([str], () => undefined);
+
+      const strInfo = tracker.getData(str);
+      expect(strInfo).to.deep.include({
+        value: 'foo',
+        addedTags: [CUSTOM_VALIDATED],
+        args: [{ tracked: true, value: 'foo' }],
+        context: undefined,
+        name: 'mongoose.mixed.prototype.doValidate',
+        object: { tracked: false, value: 'mongoose.SchemaMixed' },
+        removedTags: [],
+        result: { tracked: false, value: undefined },
+        source: 'P0',
+        stack: [],
+        tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
+        target: 'P0',
+      });
+      expect(strInfo.history[0]).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: { [UNTRUSTED]: [0, 2] },
+        result: { tracked: true, value: 'foo' },
+        value: 'foo',
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/mongoose/schema-string.test.js

@@ -0,0 +1,160 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation mongoose.StringSchema', function () {
+  let core,
+    trackString,
+    simulateRequestScope,
+    tracker,
+    mockSchemaString,
+    enumStub,
+    validateErr;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    enumStub = sinon.stub();
+
+    const MockSchemaString = function () {
+      this.validators = [{
+        type: 'enum',
+        validator: enumStub,
+      }];
+    };
+    MockSchemaString.prototype.enum = function () {
+      return this;
+    };
+    MockSchemaString.prototype.doValidate = function (v, cb) {
+      cb(validateErr);
+    };
+    MockSchemaString.prototype.doValidateSync = function () { };
+    mockSchemaString = new MockSchemaString();
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.mongooseInstrumentation.schemaString.install();
+    core.depHooks.resolve.yield(MockSchemaString);
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('untracks if enum validator returns truthy value', function () {
+    enumStub.returns(-1);
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+
+      // simulate adding of enum checking to the schema object
+      mockSchemaString.enum();
+      // simulate enum validator executing on a value
+      mockSchemaString.validators[0].validator(str);
+
+      expect(tracker.getData(str)).to.be.null;
+    });
+  });
+
+  it('SchemaString.doValidate adds STRING_TYPE_CHECKED tag', function () {
+    return new Promise((resolve) => {
+      simulateRequestScope(function () {
+        const str = trackString('foo');
+        const strInfo = tracker.getData(str);
+
+        mockSchemaString.doValidate(str, function () {
+          expect(strInfo).to.deep.include({
+            value: 'foo',
+            addedTags: ['STRING_TYPE_CHECKED'],
+            args: [{ tracked: true, value: 'foo' }],
+            context: undefined,
+            name: 'mongoose.SchemaString.prototype.doValidate',
+            object: { tracked: false, value: 'mongoose.SchemaString' },
+            removedTags: [],
+            result: { tracked: false, value: undefined },
+            source: 'P0',
+            stack: [],
+            tags: { UNTRUSTED: [0, 2], STRING_TYPE_CHECKED: [0, 2] },
+            target: 'P0',
+          });
+          expect(strInfo.history[0]).to.deep.include({
+            context: 'UNKNOWN.val',
+            name: 'assess-dataflow-fixture',
+            fieldName: 'val',
+            pathName: 'val',
+            stack: [],
+            inputType: 'UNKNOWN',
+            tags: { UNTRUSTED: [0, 2] },
+            result: { tracked: true, value: 'foo' },
+            value: 'foo',
+          });
+          resolve();
+        });
+      });
+    });
+  });
+
+  it('SchemaString.doValidate does not add tags when validation error occurs', function () {
+    validateErr = {};
+    return new Promise((resolve) => {
+      simulateRequestScope(function () {
+        const str = trackString('foo');
+        const strInfo = tracker.getData(str);
+
+        mockSchemaString.doValidate(str, function (err) {
+          expect(strInfo).to.deep.include({
+            context: 'UNKNOWN.val',
+            name: 'assess-dataflow-fixture',
+            fieldName: 'val',
+            pathName: 'val',
+            stack: [],
+            inputType: 'UNKNOWN',
+            tags: { UNTRUSTED: [0, 2] },
+            result: { tracked: true, value: 'foo' },
+            value: 'foo',
+          });
+          resolve();
+        });
+      });
+    });
+  });
+
+  it('SchemaString.doValidateSync does not add tags when validation error occurs', function () {
+    simulateRequestScope(function () {
+      const str = trackString('foo');
+      const strInfo = tracker.getData(str);
+
+      mockSchemaString.doValidateSync(str);
+
+      expect(strInfo).to.deep.include({
+        value: 'foo',
+        addedTags: ['STRING_TYPE_CHECKED'],
+        args: [{ tracked: true, value: 'foo' }],
+        context: undefined,
+        name: 'mongoose.SchemaString.prototype.doValidateSync',
+        object: { tracked: false, value: 'mongoose.SchemaString' },
+        removedTags: [],
+        result: { tracked: false, value: undefined },
+        source: 'P0',
+        stack: [],
+        tags: { UNTRUSTED: [0, 2], STRING_TYPE_CHECKED: [0, 2] },
+        target: 'P0',
+      });
+      expect(strInfo.history[0]).to.deep.include({
+        context: 'UNKNOWN.val',
+        name: 'assess-dataflow-fixture',
+        fieldName: 'val',
+        pathName: 'val',
+        stack: [],
+        inputType: 'UNKNOWN',
+        tags: { UNTRUSTED: [0, 2] },
+        result: { tracked: true, value: 'foo' },
+        value: 'foo',
+      });
+    });
+  });
+});