@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/propagation/install/pug-runtime-escape.test.js

@@ -0,0 +1,69 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const {
+  DataflowTag: { UNTRUSTED, WEAK_URL_ENCODED }
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation pugRuntime.escape', function () {
+  let core, trackString, simulateRequestScope, tracker, mockPugRuntime;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    mockPugRuntime = {
+      escape: (str) => `mock-escape_${str}_mock-escape`
+    };
+
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.pugRuntimeEscape.install();
+    core.depHooks.resolve.yield(mockPugRuntime);
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  it('propagates correctly', function () {
+    simulateRequestScope(function () {
+      const notTrackedValue = 'foo';
+      const trackedValue = trackString('foo');
+
+      const notTrackedResult = mockPugRuntime.escape(notTrackedValue);
+      const notTrackedStrInfo = tracker.getData(notTrackedResult);
+
+      const trackedResult = mockPugRuntime.escape(trackedValue);
+      const trackedStrInfo = tracker.getData(trackedResult);
+
+      expect(notTrackedStrInfo).to.be.null;
+      expect(trackedStrInfo?.tags).to.deep.equal({
+        [UNTRUSTED]: [0, trackedStrInfo.value.length - 1],
+        [WEAK_URL_ENCODED]: [0, trackedStrInfo.value.length - 1]
+      });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const value = trackString('foo');
+      const result = mockPugRuntime.escape(value);
+      expect(tracker.getData(result)).to.be.null;
+    }, {});
+  });
+
+  it('will not propagate if there instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const value = trackString('foo');
+        const result = mockPugRuntime.escape(value);
+        expect(tracker.getData(result)).to.be.null;
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/querystring/escape.test.js

@@ -0,0 +1,63 @@
+'use strict';
+
+const { expect } = require('chai');
+const { DataflowTag: { URL_ENCODED, UNTRUSTED } } = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation querystring escape', function () {
+  let core, simulateRequestScope, tracker, trackString, querystring;
+
+  const baseEvent = {
+    moduleName: 'querystring',
+    methodName: 'escape',
+    object: { tracked: false, value: 'querystring' },
+    source: 'P',
+    target: 'R',
+  };
+
+  before(function () {
+    ({ core, trackString, simulateRequestScope } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+
+    querystring = require('querystring');
+    core.depHooks.resolve.withArgs({ name: 'querystring' }).yields(querystring);
+
+    core.assess.dataflow.propagation.querystringInstrumentation.escape.install();
+  });
+
+  after(function () {
+    core.assess.dataflow.propagation.querystringInstrumentation.escape.uninstall();
+  });
+
+  it('propagates to entire result when value is escaped and modified', function () {
+    simulateRequestScope(() => {
+      const str = trackString('😺');
+      const result = querystring.escape(str);
+      const strInfo = tracker.getData(result);
+
+      expect(strInfo).to.deep.include({
+        ...baseEvent,
+        tags: {
+          [UNTRUSTED]: [0, 11],
+          [URL_ENCODED]: [0, 11]
+        },
+      });
+    });
+  });
+
+  it('propagates exactly to result when value is escaped and not modified and adds URL_ENCODED tag', function () {
+    simulateRequestScope(() => {
+      const str = trackString('foo', { tags: { UNTRUSTED: [0, 1] } });
+      const result = querystring.escape(str);
+      const strInfo = tracker.getData(result);
+
+      expect(strInfo).to.deep.include({
+        ...baseEvent,
+        tags: {
+          [UNTRUSTED]: [0, 1],
+          [URL_ENCODED]: [0, 2]
+        },
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/querystring/index.test.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation querystring', function () {
+  let core, instr;
+
+  beforeEach(function () {
+    ({ core } = initAssessFixture());
+    instr = core.assess.dataflow.propagation.querystringInstrumentation;
+  });
+
+  const propagatorList = [
+    'parse'
+  ];
+
+  it('composes different installers', function () {
+    propagatorList.forEach((name) => {
+      expect(instr[name]).to.have.property('install').and.be.a('function');
+    });
+  });
+
+  it('dispatches installation to sub-components', function () {
+    const installs = [];
+    propagatorList.forEach((name) => {
+      const instr = core.assess.dataflow.propagation.querystringInstrumentation;
+      installs.push(sinon.stub(instr[name], 'install'));
+    });
+
+    instr.install();
+
+    expect(installs).to.have.lengthOf(1);
+    installs.forEach((installer) => {
+      expect(installer).to.have.been.called;
+    });
+  });
+});
+

package/lib/dataflow/propagation/install/querystring/parse.test.js

@@ -0,0 +1,272 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const {
+  DataflowTag: { URL_ENCODED }
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation querystring parse', function () {
+  let core, trackString, simulateRequestScope, tracker, querystring;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+    querystring = require('querystring');
+    core.assess.dataflow.propagation.querystringInstrumentation.parse.install();
+    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
+    core.depHooks.resolve.withArgs({ name: 'querystring' }).yield(querystring);
+  });
+
+  afterEach(function () {
+    sinon.resetHistory();
+  });
+
+  ['parse', 'decode'].forEach((method) => {
+    it('should do nothing on empty input', function () {
+      simulateRequestScope(() => {
+        const ret = querystring[method]('');
+        expect(ret).to.deep.equal({});
+      });
+    });
+
+    it('should do nothing if input isn\'t tracked', function () {
+      simulateRequestScope(() => {
+        const ret = querystring[method]('x=abcd&y=bcde&z=&w=cdef');
+        expect(ret).to.deep.equal({
+          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
+        });
+        Object.values(ret).forEach((val) => {
+          expect(tracker.getData(val)).to.be.null;
+        });
+      });
+    });
+
+    it('should not track tracked input that is parsed out', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd&y=bcde', {
+          tags: {
+            x: [0, 1],
+            ampersand: [6, 6],
+            y: [7, 8]
+          }
+        });
+        const ret = querystring[method](extern);
+        expect(ret).to.deep.equal({
+          x: 'abcd', y: 'bcde'
+        });
+        expect(tracker.getData(ret.x)).to.be.null;
+        expect(tracker.getData(ret.y)).to.be.null;
+        Object.keys(ret).forEach((key) => {
+          expect(tracker.getData(key)).to.be.null;
+        });
+      });
+    });
+
+    it('should propagate tags to object values', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd&y=abcd&z=&w=cdef', {
+          tags: {
+            foo: [2, 5],
+            bar: [9, 12]
+          }
+        });
+        const ret = querystring[method](extern);
+        expect(ret).to.deep.equal({
+          x: 'abcd', y: 'abcd', z: '', w: 'cdef'
+        });
+        expect(tracker.getData(ret.x).tags).to.deep.equal({
+          foo: [0, 3]
+        });
+        expect(tracker.getData(ret.y).tags).to.deep.equal({
+          bar: [0, 3]
+        });
+        expect(tracker.getData(ret.z)).to.be.null;
+        expect(tracker.getData(ret.w)).to.be.null;
+      });
+    });
+
+    it('should adjust tags to account for percent decoding', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=%E2%9C%93%F0%9F%98%90%F0%9F%99%89&y=%2F%3F%23&z=&w=cdef', {
+          tags: {
+            foo: [2, 34],
+            bar: [38, 46]
+          }
+        });
+        const ret = querystring[method](extern);
+        expect(ret).to.deep.equal({
+          x: '✓😐🙉', y: '/?#', z: '', w: 'cdef'
+        });
+        expect(tracker.getData(ret.x).tags).to.deep.equal({
+          foo: [0, 4]
+        });
+        expect(tracker.getData(ret.y).tags).to.deep.equal({
+          bar: [0, 2]
+        });
+        expect(tracker.getData(ret.z)).to.be.null;
+        expect(tracker.getData(ret.w)).to.be.null;
+      });
+    });
+
+    it('should strip url-encoded tags', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
+          tags: {
+            [URL_ENCODED]: [2, 5],
+            foo: [2, 5]
+          }
+        });
+        const ret = querystring[method](extern);
+        expect(ret).to.deep.equal({
+          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
+        });
+        expect(tracker.getData(ret.x).tags).to.deep.equal({
+          foo: [0, 3]
+        });
+        expect(tracker.getData(ret.x).removedTags).to.deep.equal([URL_ENCODED]);
+        expect(tracker.getData(ret.y)).to.be.null;
+        expect(tracker.getData(ret.z)).to.be.null;
+        expect(tracker.getData(ret.w)).to.be.null;
+      });
+    });
+
+    it('should track if custom decode function is passed (querystring.unescape)', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
+          tags: {
+            foo: [2, 5],
+            bar: [9, 12]
+          }
+        });
+        const ret = querystring[method](extern, null, null, { decodeURIComponent: querystring.unescape });
+        expect(ret).to.deep.equal({
+          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
+        });
+        expect(tracker.getData(ret.x).tags).to.deep.equal({
+          foo: [0, 3]
+        });
+        expect(tracker.getData(ret.y).tags).to.deep.equal({
+          bar: [0, 3]
+        });
+        expect(tracker.getData(ret.z)).to.be.null;
+        expect(tracker.getData(ret.w)).to.be.null;
+      });
+    });
+
+    it('should track if custom decode function is passed (custom)', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
+          tags: {
+            foo: [2, 5],
+            bar: [9, 12]
+          }
+        });
+        const ret = querystring[method](extern, null, null, {
+          decodeURIComponent(part) {
+            return part.concat('_');
+          }
+        });
+        expect(ret).to.deep.equal({
+          x_: 'abcd_', y_: 'bcde_', z_: '', w_: 'cdef_'
+        });
+        expect(tracker.getData(ret.x_).tags).to.deep.equal({
+          foo: [0, 3]
+        });
+        expect(tracker.getData(ret.y_).tags).to.deep.equal({
+          bar: [0, 3]
+        });
+        expect(tracker.getData(ret.z_)).to.be.null;
+        expect(tracker.getData(ret.w_)).to.be.null;
+      });
+    });
+
+    it('should track if custom decode function is passed (tracked string in decode)', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
+          tags: {
+            foo: [2, 5],
+            bar: [9, 12]
+          }
+        });
+        const concatStr = trackString('__', {
+          tags: {
+            concat: [1, 1]
+          }
+        });
+        const ret = querystring[method](extern, null, null, {
+          decodeURIComponent(part) {
+            return part.concat(concatStr);
+          }
+        });
+        expect(ret).to.deep.equal({
+          x__: 'abcd__', y__: 'bcde__', z__: '', w__: 'cdef__'
+        });
+        expect(tracker.getData(ret.x__).tags).to.deep.equal({
+          foo: [0, 3],
+          concat: [5, 5]
+        });
+        expect(tracker.getData(ret.y__).tags).to.deep.equal({
+          bar: [0, 3],
+          concat: [5, 5]
+        });
+        expect(tracker.getData(ret.z__)).to.be.null;
+        expect(tracker.getData(ret.w__).tags).to.deep.equal({
+          concat: [5, 5]
+        });
+      });
+    });
+
+    it('should properly handle custom separators', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=abcd...y=bcde...z=...w=cdef', {
+          tags: {
+            foo: [2, 5],
+            bar: [11, 14]
+          }
+        });
+        const ret = querystring[method](extern, '...');
+        expect(ret).to.deep.equal({
+          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
+        });
+        expect(tracker.getData(ret.x).tags).to.deep.equal({
+          foo: [0, 3]
+        });
+        expect(tracker.getData(ret.y).tags).to.deep.equal({
+          bar: [0, 3]
+        });
+        expect(tracker.getData(ret.z)).to.be.null;
+        expect(tracker.getData(ret.w)).to.be.null;
+      });
+    });
+
+    it('should handle arrays', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('x=123&x=4567&z=foo', {
+          tags: {
+            untrusted: [0, 24],
+          }
+        });
+        const ret = querystring[method](extern);
+        expect(ret).to.deep.equal({
+          x: ['123', '4567'], z: 'foo'
+        });
+        expect(tracker.getData(ret.x[0]).tags).to.deep.equal({
+          untrusted: [0, 2]
+        });
+        expect(tracker.getData(ret.x[1]).tags).to.deep.equal({
+          untrusted: [0, 3]
+        });
+        expect(tracker.getData(ret.z).tags).to.deep.equal({
+          untrusted: [0, 2]
+        });
+      });
+    });
+  });
+});