@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/propagation/install/JSON/parse.test.js

@@ -0,0 +1,968 @@
+'use strict';
+
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const {
+  DataflowTag: { UNTRUSTED, LIMITED_CHARS, HEADER, WEAK_URL_ENCODED },
+  traverseValues,
+} = require('@contrast/common');
+
+describe('assess dataflow propagation JSON parse', function () {
+  let core,
+    tracker,
+    trackString,
+    simulateRequestScope,
+    objWithTrackedStr,
+    arrayWithTrackedStr,
+    standardEvent;
+
+  beforeEach(function () {
+    ({ core, trackString, simulateRequestScope } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+
+    core.assess.dataflow.propagation.jsonInstrumentation.stringify.install();
+    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
+    core.assess.dataflow.propagation.jsonInstrumentation.parse.install();
+
+    simulateRequestScope(() => {
+      objWithTrackedStr = {
+        prop1: trackString('test'),
+        prop2: trackString('test2'),
+        test2: "':\"",
+        arr: [
+          {
+            name: {
+              prop3: trackString('test3', {
+                tags: {
+                  [UNTRUSTED]: [0, 0, 2, 4],
+                },
+              }),
+            },
+          },
+          2,
+          trackString('test4'),
+        ],
+        nested: {
+          prop4: trackString('prop'),
+        },
+        prop5: trackString('test5', {
+          tags: {
+            [UNTRUSTED]: [0, 0, 2, 3],
+            [LIMITED_CHARS]: [0, 1],
+            [HEADER]: [1, 2],
+            [WEAK_URL_ENCODED]: [0, 1, 3, 4],
+          },
+        }),
+      };
+    });
+
+    simulateRequestScope(() => {
+      arrayWithTrackedStr = [
+        [1, trackString('test')],
+        [
+          2,
+          trackString('test2', {
+            tags: {
+              [UNTRUSTED]: [0, 0, 2, 3],
+              [LIMITED_CHARS]: [0, 1],
+              [HEADER]: [1, 2],
+              [WEAK_URL_ENCODED]: [0, 1, 3, 4],
+            },
+          }),
+        ],
+        [
+          3,
+          trackString('test3', {
+            tags: {
+              [UNTRUSTED]: [0, 0, 2, 3],
+            },
+          }),
+        ],
+        [
+          4,
+          {
+            name: trackString('test4', {
+              tags: {
+                [UNTRUSTED]: [0, 0, 2, 3],
+                [LIMITED_CHARS]: [0, 1],
+              },
+            }),
+          },
+        ],
+        [trackString('test5'), 5],
+      ];
+    });
+
+    standardEvent = {
+      object: {
+        tracked: false,
+        value: 'JSON',
+      },
+      name: 'JSON.parse',
+      source: 'P0',
+      target: 'R',
+      tags: {},
+    };
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.jsonInstrumentation.parse.uninstall();
+  });
+
+  it('will not propagate if the instrumentation is locked', function () {
+    simulateRequestScope(function () {
+      core.scopes.instrumentation.run({ lock: true }, function () {
+        const trackedString = trackString('foo');
+        const string = JSON.stringify({ prop: trackedString });
+        const result = JSON.parse(string);
+
+        expect(result.prop).to.be.equal('foo');
+        expect(tracker.getData(result.prop)).to.be.null;
+      });
+    });
+  });
+
+  it('will not propagate if there is no assess context', function () {
+    simulateRequestScope(function () {
+      const trackedString = trackString('foo');
+      const string = JSON.stringify({ prop: trackedString });
+      const result = JSON.parse(string);
+
+      expect(result.prop).to.be.equal('foo');
+      expect(tracker.getData(result.prop)).to.be.null;
+    }, {});
+  });
+
+  it('should ignore empty string', function () {
+    simulateRequestScope(function () {
+      const trackedString = trackString('');
+      const string = JSON.stringify({ prop: trackedString });
+      const result = JSON.parse(string);
+
+      expect(result.prop).to.be.equal('');
+      expect(tracker.getData(result.prop)).to.be.null;
+    });
+  });
+
+  it('will not propagate if the argument is not tracked', function () {
+    simulateRequestScope(function () {
+      const string = JSON.stringify({ prop: 'foo' });
+      const result = JSON.parse(string);
+
+      expect(result.prop).to.be.equal('foo');
+      expect(tracker.getData(result.prop)).to.be.null;
+    });
+  });
+
+  it('parse objWithTrackedStr', function () {
+    simulateRequestScope(() => {
+      const string = JSON.stringify(objWithTrackedStr);
+      const result = JSON.parse(string);
+      const prop1 = tracker.getData(result.prop1);
+
+      const expected1 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: result.prop1,
+        result: {
+          tracked: true,
+          value: result.prop1,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+      for (const key in expected1) {
+        expect(prop1[key]).deep.equal(expected1[key], `prop1.${key} is not as expected`);
+      }
+
+      const prop2 = tracker.getData(result.prop2);
+      const expected2 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: result.prop2,
+        result: {
+          tracked: true,
+          value: result.prop2,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+      for (const key in expected2) {
+        expect(prop2[key]).deep.equal(expected2[key], `prop2.${key} is not as expected`);
+      }
+
+      const prop3 = tracker.getData(result.arr[0].name.prop3);
+      const expected3 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop3.value,
+        result: {
+          tracked: true,
+          value: prop3.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 4],
+        },
+      });
+      for (const key in expected3) {
+        expect(prop3[key]).deep.equal(expected3[key], `prop3.${key} is not as expected`);
+      }
+
+      const test4 = tracker.getData(result.arr[2]);
+      const expected4 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test4.value,
+        result: {
+          tracked: true,
+          value: test4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+      for (const key in expected4) {
+        expect(test4[key]).deep.equal(expected4[key], `test4.${key} is not as expected`);
+      }
+
+      const prop4 = tracker.getData(result.nested.prop4);
+      const expected5 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop4.value,
+        result: {
+          tracked: true,
+          value: prop4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+      for (const key in expected5) {
+        expect(prop4[key]).deep.equal(expected5[key], `prop4.${key} is not as expected`);
+      }
+
+      const prop5 = tracker.getData(result.prop5);
+      const expected6 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop5.value,
+        result: {
+          tracked: true,
+          value: prop5.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+          [LIMITED_CHARS]: [0, 1],
+          [HEADER]: [1, 2],
+          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
+        },
+      });
+      for (const key in expected6) {
+        expect(prop5[key]).deep.equal(expected6[key], `prop5.${key} is not as expected`);
+      }
+
+    });
+  });
+
+  it('parse objWithTrackedStr with reviver', function () {
+    simulateRequestScope(() => {
+      const string = JSON.stringify(objWithTrackedStr);
+      const reviver = (key, value) => value;
+      const result = JSON.parse(string, reviver);
+
+      const prop1 = tracker.getData(result.prop1);
+      const expectedProp1 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: result.prop1,
+        result: {
+          tracked: true,
+          value: result.prop1,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+      for (const key in expectedProp1) {
+        expect(prop1[key]).deep.equal(expectedProp1[key], `prop1.${key} is not as expected`);
+      }
+
+      const prop2 = tracker.getData(result.prop2);
+      const expectedProp2 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: result.prop2,
+        result: {
+          tracked: true,
+          value: result.prop2,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+      for (const key in expectedProp2) {
+        expect(prop2[key]).deep.equal(expectedProp2[key], `prop2.${key} is not as expected`);
+      }
+
+      const prop3 = tracker.getData(result.arr[0].name.prop3);
+      const expectedProp3 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: prop3.value,
+        result: {
+          tracked: true,
+          value: prop3.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 4],
+        },
+      });
+      for (const key in expectedProp3) {
+        expect(prop3[key]).deep.equal(expectedProp3[key], `prop3.${key} is not as expected`);
+      }
+
+      const test4 = tracker.getData(result.arr[2]);
+      const expectedTest4 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: test4.value,
+        result: {
+          tracked: true,
+          value: test4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+      for (const key in expectedTest4) {
+        expect(test4[key]).deep.equal(expectedTest4[key], `test4.${key} is not as expected`);
+      }
+
+      const prop4 = tracker.getData(result.nested.prop4);
+      const expectedProp4 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: prop4.value,
+        result: {
+          tracked: true,
+          value: prop4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+      for (const key in expectedProp4) {
+        expect(prop4[key]).deep.equal(expectedProp4[key], `prop4.${key} is not as expected`);
+      }
+
+      const prop5 = tracker.getData(result.prop5);
+      const expectedProp5 = Object.assign({}, standardEvent, {
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: prop5.value,
+        result: {
+          tracked: true,
+          value: prop5.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+          [LIMITED_CHARS]: [0, 1],
+          [HEADER]: [1, 2],
+          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
+        },
+      });
+      for (const key in expectedProp5) {
+        expect(prop5[key]).deep.equal(expectedProp5[key], `prop5.${key} is not as expected`);
+      }
+    });
+  });
+
+  it('parse arrayWithTrackedStr', function () {
+    simulateRequestScope(() => {
+      const string = JSON.stringify(arrayWithTrackedStr);
+      const result = JSON.parse(string);
+
+      const test = tracker.getData(result[0][1]);
+      expect(test).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test.value,
+        result: {
+          tracked: true,
+          value: test.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+
+      const test2 = tracker.getData(result[1][1]);
+      expect(test2).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test2.value,
+        result: {
+          tracked: true,
+          value: test2.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+          [LIMITED_CHARS]: [0, 1],
+          [HEADER]: [1, 2],
+          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
+        },
+      });
+
+      const test3 = tracker.getData(result[2][1]);
+      expect(test3).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test3.value,
+        result: {
+          tracked: true,
+          value: test3.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+        },
+      });
+
+      const test4 = tracker.getData(result[3][1].name);
+      expect(test4).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test4.value,
+        result: {
+          tracked: true,
+          value: test4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+          [LIMITED_CHARS]: [0, 1],
+        },
+      });
+
+      const test5 = tracker.getData(result[4][0]);
+      expect(test5).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test5.value,
+        result: {
+          tracked: true,
+          value: test5.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+    });
+  });
+
+  it('parse arrayWithTrackedStr with reviver', function () {
+    simulateRequestScope(() => {
+      const string = JSON.stringify(arrayWithTrackedStr);
+      const reviver = (key, value) => (key === '' ? new Map(value) : value);
+      const result = JSON.parse(string, reviver);
+
+      const test = tracker.getData(result.get(1));
+      expect(test).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: test.value,
+        result: {
+          tracked: true,
+          value: test.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+
+      const test2 = tracker.getData(result.get(2));
+      expect(test2).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: test2.value,
+        result: {
+          tracked: true,
+          value: test2.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+          [LIMITED_CHARS]: [0, 1],
+          [HEADER]: [1, 2],
+          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
+        },
+      });
+
+      const test3 = tracker.getData(result.get(3));
+      expect(test3).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: test3.value,
+        result: {
+          tracked: true,
+          value: test3.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+        },
+      });
+
+      const test4 = tracker.getData(result.get(4).name);
+      expect(test4).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: test4.value,
+        result: {
+          tracked: true,
+          value: test4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 0, 2, 3],
+          [LIMITED_CHARS]: [0, 1],
+        },
+      });
+
+      const test5 = tracker.getData(
+        Array.from(result.keys()).find((key) => key === 'test5')
+      );
+      expect(test5).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+          {
+            tracked: false,
+            value: reviver.toString(),
+          },
+        ],
+        value: test5.value,
+        result: {
+          tracked: true,
+          value: test5.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+    });
+  });
+
+  it('parse with spaces', function () {
+    simulateRequestScope(() => {
+      const input = {
+        prop1: 'test',
+        prop2: trackString('test2'),
+        arr: [
+          {
+            name: {
+              prop3: trackString('test3'),
+            },
+          },
+          2,
+          trackString('test4'),
+        ],
+        nested: {
+          prop4: trackString('prop'),
+        },
+        prop5: trackString('test5'),
+      };
+
+      const string = JSON.stringify(input);
+      const result = JSON.parse(string, null, ' ');
+
+      const prop1 = tracker.getData(result.prop1);
+      expect(prop1).to.be.null;
+
+      const prop2 = tracker.getData(result.prop2);
+      expect(prop2).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: result.prop2,
+        result: {
+          tracked: true,
+          value: result.prop2,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+
+      const prop3 = tracker.getData(result.arr[0].name.prop3);
+      expect(prop3).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop3.value,
+        result: {
+          tracked: true,
+          value: prop3.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+
+      const test4 = tracker.getData(result.arr[2]);
+      expect(test4).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test4.value,
+        result: {
+          tracked: true,
+          value: test4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+
+      const prop4 = tracker.getData(result.nested.prop4);
+      expect(prop4).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop4.value,
+        result: {
+          tracked: true,
+          value: prop4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+
+      const prop5 = tracker.getData(result.prop5);
+      expect(prop5).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop5.value,
+        result: {
+          tracked: true,
+          value: prop5.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+    });
+  });
+
+  it('parse with spaces and key values as values', function () {
+    simulateRequestScope(() => {
+      const input = {
+        test: true,
+        test2: trackString('test2'),
+        arr: [
+          {
+            name: {
+              test3: trackString('test3'),
+            },
+          },
+          2,
+          trackString('test4'),
+        ],
+        nested: {
+          prop: trackString('prop'),
+        },
+        test5: trackString('test5'),
+      };
+
+      const string = JSON.stringify(input, null);
+      const result = JSON.parse(string);
+
+      const prop1 = tracker.getData(result.test);
+      expect(prop1).to.be.null;
+
+      const prop2 = tracker.getData(result.test2);
+      expect(prop2).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop2.value,
+        result: {
+          tracked: true,
+          value: prop2.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+
+      const prop3 = tracker.getData(result.arr[0].name.test3);
+      expect(prop3).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop3.value,
+        result: {
+          tracked: true,
+          value: prop3.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+
+      const test4 = tracker.getData(result.arr[2]);
+      expect(test4).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: test4.value,
+        result: {
+          tracked: true,
+          value: test4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+
+      const prop4 = tracker.getData(result.nested.prop);
+      expect(prop4).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop4.value,
+        result: {
+          tracked: true,
+          value: prop4.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 3],
+        },
+      });
+
+      const prop5 = tracker.getData(result.test5);
+      expect(prop5).to.be.like({
+        ...standardEvent,
+        args: [
+          {
+            value: string,
+            tracked: true,
+          },
+        ],
+        value: prop5.value,
+        result: {
+          tracked: true,
+          value: prop5.value,
+        },
+        tags: {
+          [UNTRUSTED]: [0, 4],
+        },
+      });
+    });
+  });
+
+  it('propagates correctly when JSON string has leading and trailing \\n characters', function () {
+    const jsonStr = '\n{"hello":"world","foo":["bar"]}\n';
+    // happens outside of request scope so no propagation occurs
+    const expected = JSON.parse(jsonStr);
+
+    simulateRequestScope(() => {
+      const tracked = trackString(jsonStr);
+      const result = JSON.parse(tracked);
+
+      expect(result).to.deep.equal(expected);
+      traverseValues(result, (path, type, value) => {
+        expect(tracker.getData(value)?.tags?.[UNTRUSTED]).to.deep.equal([0, value.length - 1]);
+      });
+    });
+  });
+
+  it('propagates correctly when JSON string is partially tracked', function () {
+    const jsonStr = '\n{"hello":"world","foo":["bar"]}\n';
+    //                           xxx
+    const expected = JSON.parse(jsonStr);
+
+    simulateRequestScope(() => {
+      const tracked = trackString(jsonStr, { tags: { UNTRUSTED: [11, 13] } });
+      const result = JSON.parse(tracked);
+
+      expect(result).to.deep.equal(expected);
+      expect(tracker.getData(result.hello).tags).to.deep.equal({
+        UNTRUSTED: [0, 2],
+      });
+    });
+  });
+});