@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/sources/install/http.test.js

@@ -0,0 +1,155 @@
+'use strict';
+
+const EventEmitter = require('events');
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow sources http', function () {
+  let core, simulateRequestScope, request, response, server;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    request = {
+      url: 'http://host:8080/index.html?param=foo',
+      httpVersion: 1,
+      method: 'GET',
+      socket: {
+        remoteAddress: '127.0.0.1'
+      },
+      rawHeaders: ['Content-Type', 'application/json'],
+      headers: {
+        'content-type': 'application/json'
+      }
+    };
+    response = new EventEmitter();
+    response.writeHead = function () { };
+    response.setHeader = function () { };
+    class Server extends EventEmitter { }
+    core.depHooks.resolve.withArgs({ name: 'http' }).yields({ Server });
+    core.logger.child = () => core.logger;
+
+    require('./http')(core).install();
+    server = new Server();
+  });
+
+  it('instantiates assess store with appropriate metadata and handles base sources', function (next) {
+    simulateRequestScope(() => {
+      server.on('request', test);
+      server.emit('request', request, response);
+    });
+
+    function test(req, res) {
+      const store = core.scopes.sources.getStore()?.assess;
+      // validate store
+      expect(store).to.have.property('propagationEventsCount', 0);
+      // 3: url, headers, rawHeaders
+      expect(store).to.have.property('sourceEventsCount', 3);
+      expect(store.policy.enabledRules).to.be.a('Set').and.length.greaterThan(5);
+      expect(store.reqData).to.deep.equal({
+        ip: '127.0.0.1',
+        httpVersion: 1,
+        method: 'GET',
+        headers: { 'content-type': 'application/json' },
+        uriPath: 'http://host:8080/index.html',
+        queries: 'param=foo',
+        contentType: 'application/json'
+      });
+      expect(store.responseData).to.deep.equal({});
+      // tracked inputs
+      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.ok;
+      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.ok;
+      // patched methods
+      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.true;
+      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.true;
+      response.writeHead(200, { 'content-type': 'application/json' });
+      expect(store.responseData).to.deep.equal({ contentType: 'application/json' });
+      response.setHeader('content-type', 'text/html');
+      expect(store.responseData).to.deep.equal({ contentType: 'text/html' });
+      response.writeHead(); // instrumentation is noop
+      expect(store.responseData).to.deep.equal({ contentType: 'text/html' });
+      next();
+    }
+  });
+
+  it('noop if server event is not type \'request\'', function (next) {
+    simulateRequestScope(() => {
+      server.on('foo', test);
+      server.emit('foo', request, response);
+    });
+
+    function test(req, res) {
+      const store = core.scopes.sources.getStore()?.assess;
+      // // validate store
+      expect(store).to.have.property('propagationEventsCount', 0);
+      expect(store).to.have.property('sourceEventsCount', 0);
+      expect(store.policy.enabledRules).to.be.a('Set').and.length.greaterThan(5);
+      // // tracked inputs
+      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.null;
+      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.null;
+      // // patched methods
+      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.false;
+      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.false;
+      next();
+    }
+  });
+
+  it('logs debug message if there is no async request store', function (next) {
+    server.on('request', test);
+    server.emit('request', request, response);
+
+    function test(req, res) {
+      const store = core.scopes.sources.getStore()?.assess;
+      // logging
+      expect(core.logger.error).to.have.been.calledWith(
+        { err: sinon.match.has('message', 'async request store not found'), funcKey: sinon.match.string },
+        'Error during Assess request handling'
+      );
+      // validate store
+      expect(store).to.be.undefined;
+      // tracked inputs
+      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.null;
+      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.null;
+      // patched methods
+      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.false;
+      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.false;
+      next();
+    }
+  });
+
+  it('handles a case with an error in the `.handle` method', function (next) {
+    const err = new Error('test');
+    core.assess.dataflow.sources.handle = sinon.stub().throws(err);
+
+    simulateRequestScope(() => {
+      server.on('request', test);
+      server.emit('request', request, response);
+    });
+
+    function test(req, res) {
+      const store = core.scopes.sources.getStore()?.assess;
+      // validate store
+      expect(store).to.have.property('propagationEventsCount', 0);
+      expect(store).to.have.property('sourceEventsCount', 0);
+      expect(store.policy.enabledRules).to.be.a('Set').and.length.greaterThan(5);
+      expect(store.reqData).to.deep.equal({
+        ip: '127.0.0.1',
+        httpVersion: 1,
+        method: 'GET',
+        headers: { 'content-type': 'application/json' },
+        uriPath: 'http://host:8080/index.html',
+        queries: 'param=foo',
+        contentType: 'application/json'
+      });
+      expect(store.responseData).to.deep.equal({});
+      // tracked inputs
+      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.null;
+      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.null;
+      // patched methods
+      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.true;
+      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.true;
+      next();
+    }
+  });
+});

package/lib/dataflow/sources/install/koa/index.test.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const { expect } = require('chai');
+const proxyquire = require('proxyquire');
+const mocks = require('@contrast/test/mocks');
+
+const moduleMock = (moduleName, mock) => (deps) => {
+  deps.assess.dataflow.sources.koaInstrumentation[moduleName] = mock[moduleName];
+};
+
+describe('assess dataflow sources koa', function () {
+  let core, koaSourcesMock, koaSourcesModule, modulesWithInstall;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.assess = mocks.assess();
+    koaSourcesMock = core.assess.dataflow.sources.koaInstrumentation;
+    koaSourcesModule = proxyquire('.', {
+      './koa2': moduleMock('koa2', koaSourcesMock),
+      './koa-bodyparsers': moduleMock('koaBodyparsers', koaSourcesMock),
+      './koa-multer': moduleMock('koaMulter', koaSourcesMock),
+      './koa-routers': moduleMock('koaRouters', koaSourcesMock),
+    });
+    modulesWithInstall = [
+      'koa2',
+      'koaBodyparsers',
+      'koaMulter',
+      'koaRouters',
+    ];
+  });
+
+  it('installs the components', function () {
+    koaSourcesModule(core).install();
+
+    modulesWithInstall.forEach((module) => {
+      expect(koaSourcesMock[module].install).to.have.been.calledOnce;
+    });
+  });
+});
+

package/lib/dataflow/sources/install/koa/koa-bodyparsers.test.js

@@ -0,0 +1,161 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const koaBodyInstr = require('./koa-bodyparsers');
+
+describe('assess dataflow sources koa-body v5.x.x and koa-bodyparser v4.x.x', function () {
+  let core, simulateRequestScope, koaBodyparserMock, patchedKoaBodyparser, body, sources, nextStub;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sources = core.assess.dataflow.sources;
+    sinon.spy(sources, 'handle');
+
+    body = { parameter: 'parsed' };
+
+    koaBodyparserMock = (body) => (ctx, next) => {
+      ctx.request.body = body;
+      next();
+    };
+    nextStub = sinon.stub();
+    sinon.spy(core.patcher, 'patch');
+
+    koaBodyInstr(core).install();
+    patchedKoaBodyparser = core.depHooks.resolve.yield(koaBodyparserMock)[0];
+    core.patcher.patch.resetHistory();
+  });
+
+  it('calls patcher on the `koa-body` and `koa-bodyparser` module exports', function () {
+    core.depHooks.resolve.yield(koaBodyparserMock);
+
+    expect(core.patcher.patch).to.have.been.calledTwice;
+    expect(core.patcher.patch).to.have.been.calledWithMatch(koaBodyparserMock, {
+      name: 'koa-body',
+      patchType: 'assess-dataflow-source',
+      post: sinon.match.func
+    });
+    expect(core.patcher.patch).to.have.been.calledWithMatch(koaBodyparserMock, {
+      name: 'koa-bodyparser',
+      patchType: 'assess-dataflow-source',
+      post: sinon.match.func
+    });
+  });
+
+  it('calls `.handle` when parsing body is successful and in right context', function () {
+    let scCall1, scCall2, scCall3;
+
+    simulateRequestScope(() => {
+      const bParser = patchedKoaBodyparser(body);
+      bParser({ request: { body: {} } }, nextStub);
+
+      scCall1 = core.scopes.sources.getStore()?.assess;
+    });
+    simulateRequestScope(() => {
+      scCall2 = core.scopes.sources.getStore()?.assess;
+      scCall2.reqData.headers = {
+        'content-type': 'application/json'
+      };
+
+      const bParser = patchedKoaBodyparser(body);
+      bParser({ request: {} }, nextStub);
+    });
+    simulateRequestScope(() => {
+      const bParser = patchedKoaBodyparser('non-object-body');
+      bParser({ request: {} }, nextStub);
+
+      scCall3 = core.scopes.sources.getStore()?.assess;
+    });
+
+
+    expect(core.patcher.patch).to.have.been.calledThrice;
+    expect(core.patcher.patch).to.have.been.calledWithMatch(sinon.match.func, {
+      name: 'koa-body',
+      patchType: 'assess-dataflow-source',
+      pre: sinon.match.func
+    });
+
+    expect(nextStub).to.have.been.calledThrice;
+    expect(sources.handle).to.have.been.calledThrice;
+    expect(sources.handle).to.have.been.calledWithMatch({
+      context: 'ctx.request.body',
+      name: 'koa-body',
+      stacktraceOpts: {
+        constructorOpt: sinon.match.func,
+      },
+      inputType: InputType.PARAMETER_VALUE,
+      data: { parameter: 'parsed' },
+      sourceContext: scCall1
+    });
+    expect(sources.handle).to.have.been.calledWithMatch({
+      context: 'ctx.request.body',
+      name: 'koa-body',
+      stacktraceOpts: {
+        constructorOpt: sinon.match.func,
+      },
+      inputType: InputType.JSON_VALUE,
+      data: { parameter: 'parsed' },
+      sourceContext: scCall2
+    });
+    expect(sources.handle).to.have.been.calledWithMatch({
+      context: 'ctx.request.body',
+      name: 'koa-body',
+      stacktraceOpts: {
+        constructorOpt: sinon.match.func,
+      },
+      inputType: InputType.BODY,
+      data: 'non-object-body',
+      sourceContext: scCall3
+    });
+  });
+
+  it('does not call `.handle` when not in context', function () {
+    simulateRequestScope(() => {
+      const cParser = patchedKoaBodyparser(body);
+      cParser({ request: {} }, nextStub);
+    }, {});
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(nextStub).to.have.been.calledOnce;
+  });
+
+  it('does not call `.handle` when the values are already tracked', function () {
+    simulateRequestScope(() => {
+      const sourceContext = core.scopes.sources.getStore()?.assess;
+      sourceContext.parsedBody = true;
+
+      const cParser = patchedKoaBodyparser(body);
+      cParser({ request: {} }, nextStub);
+    });
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(core.logger.trace).to.have.been.calledWith(
+      { funcKey: 'assess-dataflow-source:koa-body' },
+      'values already tracked',
+    );
+    expect(nextStub).to.have.been.calledOnce;
+  });
+
+  it('handles a case with an error in the `.handle` method', function () {
+    const err = new Error('test');
+
+    core.assess.dataflow.sources.handle = () => {
+      throw err;
+    };
+
+    simulateRequestScope(() => {
+      const cParser = patchedKoaBodyparser(body);
+      cParser({ request: {} }, nextStub);
+    });
+
+    expect(core.logger.error).to.have.been.calledWith(
+      { err, inputType: InputType.PARAMETER_VALUE, funcKey: 'assess-dataflow-source:koa-body' },
+      'unable to handle Koa source',
+    );
+    expect(nextStub).to.have.been.calledOnce;
+    expect(nextStub).not.to.have.been.calledWith(err);
+  });
+});

package/lib/dataflow/sources/install/koa/koa-multer.test.js

@@ -0,0 +1,197 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const koaMulter = require('./koa-multer');
+const { InputType } = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow sources Koa multer', function () {
+  let core,
+    koaMulterMock,
+    patchedKoaMulter,
+    simulateRequestScope;
+
+  ['koa-multer', '@koa/multer'].forEach((name) => {
+    describe(name, function() {
+      beforeEach(function () {
+        ({ core, simulateRequestScope } = initAssessFixture());
+
+        sinon.spy(core.patcher, 'patch');
+
+        core.assess.dataflow.sources.handle = sinon.stub();
+
+        koaMulterMock = function() {
+          const multer = {
+            _makeMiddleware() {
+              return function(req, res, next) {
+                next();
+              };
+            }
+          };
+
+          multer.any = function() {
+            const middleware = multer._makeMiddleware();
+
+            return (ctx, next) =>
+              new Promise((resolve, reject) => {
+                middleware(ctx.req, ctx.res, (err) => {
+                  err ? reject(err) : resolve(ctx);
+                });
+              }).then(next);
+          };
+
+          return multer;
+        };
+
+        koaMulter(core).install();
+
+        [patchedKoaMulter] = core.depHooks.resolve
+          .withArgs({ name })
+          .yield(koaMulterMock);
+
+      });
+
+      it('skip instrumentation if it is our of scope', async function () {
+        const ctx = {
+          req: {},
+          res: {}
+        };
+        const next = sinon.stub();
+        const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
+
+        await middleware(ctx, next);
+        expect(next).to.have.been.called;
+        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      });
+
+      it('skip instrumentation if there are no files ', function () {
+        simulateRequestScope(async () => {
+          const ctx = {
+            req: {},
+            res: {}
+          };
+          const next = sinon.stub();
+          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
+
+          await middleware(ctx, next);
+          expect(next).to.have.been.called;
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
+
+      it('handle sources (file)', function () {
+        simulateRequestScope(async () => {
+          const ctx = {
+            req: {
+              file: {
+                property: 'file'
+              }
+            },
+            res: {}
+          };
+          const next = sinon.stub();
+          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
+
+          await middleware(ctx, next);
+          expect(next).to.have.been.called;
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+            context: 'req',
+            data: ctx.req,
+            keys: ['file'],
+            name: 'multer',
+            inputType: InputType.BODY,
+          });
+        });
+      });
+
+      it('handle sources (files)', function () {
+        simulateRequestScope(async () => {
+          const ctx = {
+            req: {
+              files: [
+                {
+                  property: 'file0'
+                },
+                {
+                  property: 'file1'
+                }
+              ]
+            },
+            res: {}
+          };
+
+          const next = sinon.stub();
+          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
+
+          await middleware(ctx, next);
+          expect(next).to.have.been.called;
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+            context: 'req.files',
+            data: ctx.req.files[0],
+            keys: [0],
+            name: 'multer',
+            inputType: InputType.BODY,
+          });
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+            context: 'req.files',
+            data: ctx.req.files[1],
+            keys: [1],
+            name: 'multer',
+            inputType: InputType.BODY,
+          });
+        });
+      });
+
+      it('handle sources (body)', function () {
+        simulateRequestScope(async () => {
+          const ctx = {
+            req: {
+              body: {
+                name: 'John'
+              }
+            },
+            res: {}
+          };
+
+          const next = sinon.stub();
+          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
+
+          await middleware(ctx, next);
+          expect(next).to.have.been.called;
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+            context: 'req',
+            data: ctx.req,
+            keys: ['body'],
+            name: 'multer',
+            inputType: InputType.BODY,
+          });
+        });
+      });
+
+      it('should log error if there is an issue handling sources', function () {
+        simulateRequestScope(async () => {
+          const err = new Error();
+          const ctx = {
+            req: {
+              file: {
+                property: 'file'
+              }
+            },
+            res: {}
+          };
+          core.assess.dataflow.sources.handle.callsFake(() => {
+            throw err;
+          });
+
+          const next = sinon.stub();
+          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
+
+          await middleware(ctx, next);
+          expect(next).to.have.been.called;
+          expect(core.logger.error).to.have.been.calledWith({ err }, 'error handling Koa multer Assess dataflow %s.%s source', 'req', 'file');
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/sources/install/koa/koa-routers.test.js

@@ -0,0 +1,146 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const koaRouters = require('./koa-routers');
+
+describe('assess dataflow sources koa-router and @koa/router', function () {
+  let core,
+    simulateRequestScope,
+    routerMock,
+    legacyRouterMock,
+    params,
+    sources;
+
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sources = core.assess.dataflow.sources;
+    sinon.spy(sources, 'handle');
+    sinon.spy(core.patcher, 'patch');
+
+    params = { parameter: 'parsed-param' };
+    routerMock = {
+      prototype: {
+        params: (parameters) => parameters || {}
+      }
+    };
+
+    legacyRouterMock = {
+      prototype: {
+        params: (parameters) => parameters || {}
+      }
+    };
+    const mockDict = {
+      ['koa-router']: legacyRouterMock,
+      ['@koa/router']: routerMock,
+    };
+
+    core.depHooks.resolve.callsFake(function (desc, cb) {
+      const cbArg = mockDict[desc.name];
+      if (cbArg) {
+        cb(cbArg);
+      }
+    });
+
+    koaRouters(core).install();
+    core.patcher.patch.resetHistory();
+  });
+
+  it('calls patcher for every necessary instrumentation', function () {
+    koaRouters(core).install();
+    expect(core.patcher.patch).to.have.been.calledTwice;
+    expect(core.patcher.patch).to.have.been.calledWithMatch(legacyRouterMock.prototype, 'params', {
+      name: '[koa-router].layer.prototype',
+      patchType: 'assess-dataflow-source',
+      post: sinon.match.func
+    });
+    expect(core.patcher.patch).to.have.been.calledWithMatch(routerMock.prototype, 'params', {
+      name: '[@koa/router].layer.prototype',
+      patchType: 'assess-dataflow-source',
+      post: sinon.match.func
+    });
+  });
+
+  describe('koa routers post hook', function () {
+    let getParamsFn;
+    this.beforeEach(function () {
+      getParamsFn = function (routerName) {
+        return routerName == 'koa-router' ? legacyRouterMock.prototype.params : routerMock.prototype.params;
+      };
+    });
+    ['koa-router', '@koa/router'].forEach((router) => {
+      it(`[${router}] calls \`.handle\` when parsing is successful and in the right context`, function () {
+        const paramsFn = getParamsFn(router);
+        let sourceContext;
+
+        simulateRequestScope(() => {
+          paramsFn(params);
+
+          sourceContext = core.scopes.sources.getStore()?.assess;
+        });
+
+        expect(sources.handle).to.have.been.calledOnce;
+        expect(sources.handle).to.have.been.calledWithMatch({
+          context: 'ctx.params',
+          name: `[${router}].layer.prototype`,
+          stacktraceOpts: {
+            constructorOpt: sinon.match.func,
+            prependFrames: [sinon.match.func]
+          },
+          inputType: InputType.URL_PARAMETER,
+          data: { parameter: 'parsed-param' },
+          sourceContext
+        });
+      });
+
+      it(`[${router}] does not call \`.handle\` when there is no context`, function () {
+        const paramsFn = getParamsFn(router);
+
+        simulateRequestScope(() => {
+          paramsFn(params);
+        }, {});
+
+        expect(sources.handle).not.to.have.been.called;
+      });
+
+      it('does not call `.handle` when the values are already tracked', function () {
+        const paramsFn = getParamsFn(router);
+
+        simulateRequestScope(() => {
+          const sourceContext = core.scopes.sources.getStore()?.assess;
+          sourceContext.parsedParams = true;
+
+          paramsFn(params);
+        });
+
+        expect(sources.handle).not.to.have.been.called;
+        expect(core.logger.trace).to.have.been.calledWith(
+          { inputType: InputType.URL_PARAMETER, funcKey: `assess-dataflow-source:[${router}].layer.prototype` },
+          'values already tracked',
+        );
+      });
+
+      it('handles a case with an error in the `.handle` method', function () {
+        const paramsFn = getParamsFn(router);
+        const err = new Error('test');
+
+        core.assess.dataflow.sources.handle = () => {
+          throw err;
+        };
+
+        simulateRequestScope(() => {
+          paramsFn(params);
+        });
+
+        expect(core.logger.error).to.have.been.calledWith(
+          { err, inputType: InputType.URL_PARAMETER, funcKey: `assess-dataflow-source:[${router}].layer.prototype` },
+          'unable to handle Koa source',
+        );
+      });
+    });
+  });
+});