@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/sources/install/express/parsedUrl.test.js

@@ -0,0 +1,65 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow sources express parsedUrl', function () {
+  let core, instrumentation, patcher, simulateRequestScope, middleware, req, res, tracker;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    instrumentation = core.assess.dataflow.sources.expressInstrumentation.parsedUrl;
+    tracker = core.assess.dataflow.tracker;
+    patcher = core.patcher;
+
+    req = {};
+    res = {};
+    middleware = {
+      init() {
+        return function (req, res, next) {
+          req._parsedUrl = {
+            href: '/some/path?asdf=jkl',
+            path: '/some/path?asdf=jkl',
+            pathname: '/some/path',
+            query: 'asdf=jkl',
+            search: '?asdf=jkl;',
+          };
+          next();
+        };
+      }
+    };
+
+    core.depHooks
+      .resolve
+      .withArgs({ name: 'express', file: 'lib/middleware/init.js' })
+      .yields(middleware);
+  });
+
+  it('hooks init next in order to track req._parsedUrl values', function () {
+    instrumentation.install();
+    expect(patcher.isContrastHooked(middleware.init)).to.be.true;
+
+    const middlewareFn = middleware.init('text');
+
+    simulateRequestScope(() => {
+      const cb = sinon.spy(function () {
+        [
+          'href',
+          'path',
+          'pathname',
+          'query',
+          'search',
+        ].forEach((prop) => {
+          const strInfo = tracker.getData(req._parsedUrl[prop]);
+          expect(strInfo).to.be.ok;
+        });
+      });
+
+      middlewareFn(req, res, cb);
+
+      expect(cb).to.have.been.called;
+    });
+  });
+});

package/lib/dataflow/sources/install/fastify/fastify.test.js

@@ -0,0 +1,210 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { InputType } = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const fastifyInstr = require('./fastify');
+
+describe('assess dataflow sources fastify', function () {
+  let core, simulateRequestScope, fastifyServerMock, serverMock, sources, reqMock, replyMock, doneMock;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+    sources = core.assess.dataflow.sources;
+
+    sinon.spy(sources, 'handle');
+
+    reqMock = {
+      query: { foo: 'bar' },
+      params: { frogs: 'bugs' },
+      body: { fred: 'barney' },
+    };
+    replyMock = {};
+    doneMock = sinon.stub();
+    serverMock = {
+      addHook: sinon.stub().yields(reqMock, replyMock, doneMock),
+    };
+    fastifyServerMock = () => serverMock;
+    core.depHooks
+      .resolve
+      .withArgs({ name: 'fastify', version: '>=3.2.0' })
+      .callsFake((desc, cb) => {
+        fastifyServerMock = cb(fastifyServerMock);
+      });
+
+    fastifyInstr(core).install();
+    core.logger.trace.resetHistory();
+  });
+
+  afterEach(function () {
+    sources.handle.restore?.();
+  });
+
+  describe('preValidationHook', function () {
+    const commonData = {
+      name: 'fastify.preValidation',
+      stacktraceOpts: {
+        constructorOpt: sinon.match((value) => typeof value === 'function' && /handler/i.test(value.name)),
+      },
+    };
+
+    it('adds hook and tracks the body, headers and query/url params', function () {
+      simulateRequestScope(function () {
+        fastifyServerMock();
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+
+        expect(serverMock.addHook).to.have.been.calledOnce;
+        expect(doneMock).to.have.been.calledOnce;
+
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.query',
+          inputType: InputType.QUERYSTRING,
+          data: reqMock.query,
+          sourceContext,
+        });
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.params',
+          inputType: InputType.URL_PARAMETER,
+          data: reqMock.params,
+          sourceContext
+        });
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.body',
+          inputType: InputType.PARAMETER_VALUE,
+          data: reqMock.body,
+          sourceContext
+        });
+      });
+
+      simulateRequestScope(function () {
+        reqMock.headers = {
+          'content-type': 'application/json'
+        };
+        fastifyServerMock();
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+
+        expect(serverMock.addHook).to.have.been.calledTwice;
+        expect(doneMock).to.have.been.calledTwice;
+
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.query',
+          inputType: InputType.QUERYSTRING,
+          data: reqMock.query,
+          sourceContext
+        });
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.params',
+          inputType: InputType.URL_PARAMETER,
+          data: reqMock.params,
+          sourceContext
+        });
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.body',
+          inputType: InputType.JSON_VALUE,
+          data: reqMock.body,
+          sourceContext
+        });
+      });
+
+      simulateRequestScope(function () {
+        delete reqMock.headers;
+        reqMock.body = 'non-object-body';
+        fastifyServerMock();
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+
+        expect(serverMock.addHook).to.have.been.calledThrice;
+        expect(doneMock).to.have.been.calledThrice;
+
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.query',
+          inputType: InputType.QUERYSTRING,
+          data: reqMock.query,
+          sourceContext,
+        });
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.params',
+          inputType: InputType.URL_PARAMETER,
+          data: reqMock.params,
+          sourceContext
+        });
+        expect(sources.handle).to.have.been.calledWith({
+          ...commonData,
+          context: 'req.body',
+          inputType: InputType.BODY,
+          data: reqMock.body,
+          sourceContext
+        });
+      });
+    });
+
+    it('does not call `.handle` when not in context', function () {
+      simulateRequestScope(() => {
+        fastifyServerMock();
+      }, {});
+
+      expect(sources.handle).not.to.have.been.called;
+    });
+
+    it('does not call `.handle` when the values are already tracked', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        sourceContext.parsedQuery = true;
+        sourceContext.parsedParams = true;
+        sourceContext.parsedBody = true;
+
+        fastifyServerMock();
+      });
+
+      expect(sources.handle).not.to.have.been.called;
+      expect(core.logger.trace).to.have.been.calledThrice;
+      expect(core.logger.trace).to.have.been.calledWith(
+        { inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:fastify.constructor' },
+        'values already tracked',
+      );
+      expect(core.logger.trace).to.have.been.calledWith(
+        { inputType: InputType.URL_PARAMETER, funcKey: 'assess-dataflow-source:fastify.constructor' },
+        'values already tracked',
+      );
+      expect(core.logger.trace).to.have.been.calledWith(
+        { inputType: InputType.PARAMETER_VALUE, funcKey: 'assess-dataflow-source:fastify.constructor' },
+        'values already tracked',
+      );
+    });
+
+    it('handles a case with an error in the `.handle` method', function () {
+      fastifyInstr(core).install();
+      const err = new Error('test');
+
+      core.assess.dataflow.sources.handle = () => {
+        throw err;
+      };
+
+      simulateRequestScope(function () {
+        fastifyServerMock();
+      });
+
+      expect(core.logger.error).to.have.been.calledThrice;
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:fastify.constructor' },
+        'unable to handle Fastify source',
+      );
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, inputType: InputType.URL_PARAMETER, funcKey: 'assess-dataflow-source:fastify.constructor' },
+        'unable to handle Fastify source',
+      );
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, inputType: InputType.PARAMETER_VALUE, funcKey: 'assess-dataflow-source:fastify.constructor' },
+        'unable to handle Fastify source',
+      );
+    });
+  });
+});

package/lib/dataflow/sources/install/fastify/index.test.js

@@ -0,0 +1,33 @@
+'use strict';
+
+const { expect } = require('chai');
+const proxyquire = require('proxyquire');
+const mocks = require('@contrast/test/mocks');
+
+const moduleMock = (moduleName, mock) => (deps) => {
+  deps.assess.dataflow.sources.fastifyInstrumentation[moduleName] = mock[moduleName];
+};
+
+describe('assess dataflow sources fastify', function () {
+  let core, fastifySourcesMock, fastifySourcesModule, modulesWithInstall;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.assess = mocks.assess();
+    fastifySourcesMock = core.assess.dataflow.sources.fastifyInstrumentation;
+    fastifySourcesModule = proxyquire('.', {
+      './fastify': moduleMock('fastify', fastifySourcesMock)
+    });
+    modulesWithInstall = [
+      'fastify'
+    ];
+  });
+
+  it('installs the components', function () {
+    fastifySourcesModule(core).install();
+
+    modulesWithInstall.forEach((module) => {
+      expect(fastifySourcesMock[module].install).to.have.been.calledOnce;
+    });
+  });
+});

package/lib/dataflow/sources/install/formidable1.test.js

@@ -0,0 +1,119 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const formidableInstr = require('./formidable1');
+
+describe('assess dataflow sources formidable v1.x', function () {
+  let core, simulateRequestScope, parseMock, patchedParse, req, cbStub, sources;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sources = core.assess.dataflow.sources;
+    sinon.spy(sources, 'handle');
+
+    req = { fields: { parameter: 'parsed' }, files: { fileField: { name: 'some-file' } } };
+    parseMock = (req, cb) => {
+      if (typeof cb === 'function') {
+        cb(null, req.fields, req.files);
+      }
+    };
+    cbStub = sinon.stub();
+    sinon.spy(core.patcher, 'patch');
+
+    formidableInstr(core).install();
+    patchedParse = core.depHooks.resolve.yield({ IncomingForm: { prototype: { parse: parseMock } } })[0].IncomingForm.prototype.parse;
+    core.patcher.patch.resetHistory();
+  });
+
+  it('calls patcher on the `.parse` method', function () {
+    core.depHooks.resolve.yield({ IncomingForm: { prototype: { parse: parseMock } } });
+
+    expect(core.patcher.patch).to.have.been.calledOnce;
+    expect(core.patcher.patch).to.have.been.calledWithMatch(sinon.match.func, {
+      name: 'Formidable.IncomingForm.prototype.parse',
+      patchType: 'assess-dataflow-source',
+      pre: sinon.match.func
+    });
+  });
+
+  it('calls `.handle` when parsing is successful and in right context', function () {
+    let sourceContext;
+
+    simulateRequestScope(() => {
+      patchedParse(req, cbStub);
+
+      sourceContext = core.scopes.sources.getStore()?.assess;
+    });
+
+    expect(cbStub).to.have.been.calledOnce;
+    expect(sources.handle).to.have.been.calledOnce;
+    expect(sources.handle).to.have.been.calledWithMatch({
+      context: 'req.body',
+      name: 'Formidable.IncomingForm.prototype.parse',
+      stacktraceOpts: {
+        constructorOpt: sinon.match.func,
+        prependFrames: [sinon.match.func]
+      },
+      inputType: InputType.MULTIPART_VALUE,
+      data: { parameter: 'parsed' },
+      sourceContext
+    });
+  });
+
+  it('logs an error when `handle` throws one', function () {
+    const err = new Error('test');
+
+    core.assess.dataflow.sources.handle = () => {
+      throw err;
+    };
+
+    simulateRequestScope(() => {
+      patchedParse(req, cbStub);
+    });
+
+    expect(cbStub).to.have.been.calledOnce;
+    expect(core.logger.error).to.have.been.calledWith(
+      { err, inputType: InputType.MULTIPART_VALUE, funcKey: 'assess-dataflow-source:Formidable.IncomingForm.prototype.parse' },
+      'unable to handle source',
+    );
+  });
+
+  it('does not call `.handle` when not in context', function () {
+    simulateRequestScope(() => {
+      patchedParse(req, cbStub);
+    }, {});
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(cbStub).to.have.been.calledOnce;
+  });
+
+  it('does not call `.handle` when the values are already tracked', function () {
+    simulateRequestScope(() => {
+      const sourceContext = core.scopes.sources.getStore()?.assess;
+      sourceContext.parsedBody = true;
+
+      patchedParse(req, cbStub);
+    });
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(core.logger.trace).to.have.been.calledWith(
+      { inputType: InputType.MULTIPART_VALUE, funcKey: 'assess-dataflow-source:Formidable.IncomingForm.prototype.parse' },
+      'values already tracked',
+    );
+    expect(cbStub).to.have.been.calledOnce;
+  });
+
+  it('does not call `.handle` when `formidable` does not return a result', function () {
+    simulateRequestScope(() => {
+      patchedParse({}, cbStub);
+    });
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(core.logger.debug).not.to.have.been.called;
+    expect(cbStub).to.have.been.calledOnce;
+  });
+});

package/lib/dataflow/sources/install/hapi/hapi.test.js

@@ -0,0 +1,172 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { InputType } = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow sources hapi', function () {
+
+  const hapi = {
+    server(server) {
+      return server;
+    },
+    Server(server) {
+      return server;
+    }
+  };
+
+  const reqMock = {
+    query: { q: 'value' },
+    path: '/uri/{id}',
+    state: { cookie: 'foo' },
+    payload: { foo: 'bar' },
+    params: { p: '1' },
+  };
+
+  const hMock = {
+    continue: sinon.stub()
+  };
+
+  let core, sources, simulateRequestScope;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    core.depHooks.resolve
+      .withArgs({ name: '@hapi/hapi', version: '>=18 <22' })
+      .yields(hapi);
+
+    sources = core.assess.dataflow.sources;
+    sinon.stub(sources, 'handle');
+
+    require('./hapi')(core).install();
+  });
+
+  ['server', 'Server'].forEach((server) => {
+    describe(`${server}`, function () {
+
+      ['onRequest', 'onPostAuth'].forEach((ext) => {
+        it(`logs error when handle fails ${ext}`, function() {
+          simulateRequestScope(() => {
+
+            const err = new Error('Error');
+            const serverInstance = {
+              ext: sinon.stub(),
+            };
+
+            serverInstance.ext.withArgs(ext, sinon.match.func).callsFake((string, method) => {
+              method(reqMock, hMock);
+            });
+
+            sources.handle.throws(err);
+            hapi[server](serverInstance);
+
+            expect(core.logger.error).to.have.been.calledWith({ err, inputType: sinon.match.string, funcKey: `assess-dataflow-source:hapi.${server}` }, 'unable to handle Hapi source');
+          });
+        });
+      });
+
+      it('does not call handle with tracked data onRequest', function() {
+        simulateRequestScope(() => {
+          const sourceContext = core.scopes.sources.getStore()?.assess;
+          sourceContext.parsedQuery = true;
+          sourceContext.parsedPath = true;
+
+          const serverInstance = {
+            ext: sinon.stub(),
+          };
+
+          serverInstance.ext.withArgs('onRequest', sinon.match.func).callsFake((string, method) => {
+            method(reqMock, hMock);
+          });
+
+          hapi[server](serverInstance);
+
+          expect(sources.handle).to.not.have.been.called;
+        });
+      });
+
+      it('calls handle with request data onRequest', function () {
+        simulateRequestScope(() => {
+          const serverInstance = {
+            ext: sinon.stub(),
+          };
+
+          serverInstance.ext.withArgs('onRequest', sinon.match.func).callsFake((string, method) => {
+            method(reqMock, hMock);
+          });
+
+          hapi[server](serverInstance);
+
+          expect(sources.handle).to.have.been.calledWithMatch({
+            context: 'req.query',
+            data: reqMock.query,
+            inputType: InputType.QUERYSTRING,
+            name: 'hapi.onRequest',
+          });
+          expect(sources.handle).to.have.been.calledWithMatch({
+            context: 'req.path',
+            data: reqMock.path,
+            inputType: InputType.URI,
+            name: 'hapi.onRequest',
+          });
+        });
+      });
+
+      it('does not call handle with tracked data onPostAuth', function() {
+        simulateRequestScope(() => {
+          const sourceContext = core.scopes.sources.getStore()?.assess;
+          sourceContext.parsedCookies = true;
+          sourceContext.parsedBody = true;
+          sourceContext.parsedParams = true;
+
+          const serverInstance = {
+            ext: sinon.stub(),
+          };
+
+          serverInstance.ext.withArgs('onPostAuth', sinon.match.func).callsFake((string, method) => {
+            method(reqMock, hMock);
+          });
+
+          hapi[server](serverInstance);
+
+          expect(sources.handle).to.not.have.been.called;
+        });
+      });
+
+      it('calls handle with request data onPostAuth', function () {
+        simulateRequestScope(() => {
+          const serverInstance = {
+            ext: sinon.stub(),
+          };
+
+          serverInstance.ext.withArgs('onPostAuth', sinon.match.func).callsFake((string, method) => {
+            method(reqMock, hMock);
+          });
+
+          hapi[server](serverInstance);
+
+          expect(sources.handle).to.have.been.calledWithMatch({
+            context: 'req.state',
+            data: reqMock.state,
+            inputType: InputType.COOKIE_VALUE,
+            name: 'hapi.onPostAuth',
+          });
+          expect(sources.handle).to.have.been.calledWithMatch({
+            context: 'req.payload',
+            data: reqMock.payload,
+            inputType: InputType.BODY,
+            name: 'hapi.onPostAuth',
+          });
+          expect(sources.handle).to.have.been.calledWithMatch({
+            context: 'req.params',
+            data: reqMock.params,
+            inputType: InputType.URL_PARAMETER,
+            name: 'hapi.onPostAuth',
+          });
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/sources/install/hapi/index.test.js

@@ -0,0 +1,33 @@
+'use strict';
+
+const { expect } = require('chai');
+const proxyquire = require('proxyquire');
+const mocks = require('@contrast/test/mocks');
+
+const moduleMock = (moduleName, mock) => (deps) => {
+  deps.assess.dataflow.sources.hapiInstrumentation[moduleName] = mock[moduleName];
+};
+
+describe('assess dataflow sources Hapi', function () {
+  let core, hapiSourcesMock, hapiSourcesModule, modulesWithInstall;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.assess = mocks.assess();
+    hapiSourcesMock = core.assess.dataflow.sources.hapiInstrumentation;
+    hapiSourcesModule = proxyquire('.', {
+      './hapi': moduleMock('hapi', hapiSourcesMock)
+    });
+    modulesWithInstall = [
+      'hapi'
+    ];
+  });
+
+  it('installs the components', function () {
+    hapiSourcesModule(core).install();
+
+    modulesWithInstall.forEach((module) => {
+      expect(hapiSourcesMock[module].install).to.have.been.calledOnce;
+    });
+  });
+});