@contrast/assess 1.31.0 → 1.32.0

package/lib/dataflow/propagation/install/joi/ref.test.js

@@ -0,0 +1,607 @@
+'use strict';
+
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { DataflowTag } = require('@contrast/common');
+
+describe('assess dataflow propagation joi string and ref', function() {
+  let core, joi, tracker, trackString, simulateRequestScope;
+
+  beforeEach(function() {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+
+    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/types/string.js', version: '>=17.0.0' }).yields(require('joi-17/lib/types/string'));
+    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/types/keys.js', version: '>=17.0.0' }).yields(require('joi-17/lib/types/keys'));
+    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/validator', version: '>=17.0.0' }).yields(require('joi-17/lib/validator'));
+    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/values.js', version: '>=17.0.0' }).yields(require('joi-17/lib/values'));
+
+    require('./index')(core).install();
+    joi = require('joi-17');
+  });
+
+  afterEach(function() {
+    Object.keys(require.cache).forEach((key) => {
+      if (key.includes('joi')) {
+        delete require.cache[key];
+      }
+    });
+  });
+
+  describe('Validator tests for joi/lib/ref.js', function() {
+    const schemaMethods = ['object', 'object.keys'];
+
+    /**
+     * Builds a schema to be used in tests. Returns joi.object(data) or
+     * object().keys(data) based on `methods` arg.
+     * @param {string} methods dot-delimited path e.g. object or object.keys
+     * @param {object} schemaData data used to make schema
+     * @returns {object} the schema instance
+     */
+    function getSchema(methods, schemaData) {
+      return methods
+        .split('.')
+        .reduce(
+          (acc, method, i, arr) =>
+            acc[method](i === arr.length - 1 ? schemaData : undefined),
+          joi
+        );
+    }
+
+    schemaMethods.forEach((methods) => {
+      it(`untracked refs of tracked values will not be tracked (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.string().guid(),
+            b: joi.ref('a'),
+          });
+          const data = {
+            a: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            b: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
+          };
+
+          const result = schema.validate(data, { convert: false });
+          // result
+          makeAssertions(tracker.getData(result.value.a));
+          expect(tracker.getData(result.value.b)).to.be.null;
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a));
+          // validation outcome
+          expect(result.errors).to.be.undefined;
+        });
+      });
+
+      it(`untracked refs of tracked values will not be tracked (nested) (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: { aa: joi.string().guid() },
+            b: joi.ref('a.aa'),
+            c: { cc: { ccc: joi.ref('....a.aa') } },
+          });
+          const data = {
+            a: { aa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265') },
+            b: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
+            c: { cc: { ccc: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265' } },
+          };
+
+          const result = schema.validate(data, { convert: false });
+
+          // validation outcome
+          expect(result.errors).to.be.undefined;
+          // result
+          expect(tracker.getData(result.value.b)).to.be.null;
+          expect(tracker.getData(result.value.c.cc.ccc)).to.be.null;
+          makeAssertions(tracker.getData(result.value.a.aa));
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a.aa));
+        });
+      });
+
+      it(`tracked refs of tracked values should not be tracked when convert: true and mapped value is untracked (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.string().guid(),
+            b: joi.ref('a', {
+              map: [['fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265', 'foo']],
+            }),
+          });
+          const data = {
+            a: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            b: trackString('foo'),
+          };
+
+          const result = schema.validate(data, { convert: true });
+
+          // validation outcome
+          expect(result.errors).to.be.undefined;
+          // result
+          makeAssertions(tracker.getData(result.value.a));
+          expect(tracker.getData(result.value.b)).to.be.null;
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a));
+          // orig 'b' value's untracked as it's equal to an untracked value
+          expect(tracker.getData(data.b)).to.be.null;
+        });
+      });
+
+      it(`tracked refs of tracked values should not be tracked when convert: false and mapped value is untracked (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.string().guid(),
+            b: joi.ref('a', {
+              map: [['fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265', 'foo']],
+            }),
+          });
+          const data = {
+            a: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
+            b: trackString('foo'),
+          };
+
+          const result = schema.validate(data, { convert: false });
+
+          // result
+          expect(tracker.getData(result.value.a)).to.be.null;
+          expect(tracker.getData(result.value.b)).to.be.null;
+          // orig
+          expect(tracker.getData(data.b)).to.be.null;
+          // validation outcome
+          expect(result.errors).to.be.undefined;
+        });
+      });
+
+      it(`tracked refs of tracked values should also be validated (${methods})`, function(done) {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.string().guid(),
+            b: joi.ref('a'),
+          });
+          const data = {
+            a: trackString(
+              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'
+            ),
+            b: trackString(
+              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
+              {
+                tags: {
+                  [DataflowTag.UNTRUSTED]: [0, 35],
+                  [DataflowTag.CUSTOM]: [0, 35]
+                }
+              }
+            ),
+          };
+
+          // Check with validateAsync to make sure it works too
+          schema.validateAsync(data, {
+            convert: true,
+            abortEarly: false,
+          })
+            .then((result) => {
+              // result
+              makeAssertions(tracker.getData(result.a));
+              makeAssertions(tracker.getData(result.b));
+              // orig (target: A)
+              makeAssertions(tracker.getData(data.a));
+              makeAssertions(tracker.getData(data.b), {
+                tags: {
+                  [DataflowTag.UNTRUSTED]: [0, 35],
+                  [DataflowTag.CUSTOM]: [0, 35],
+                  [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 35],
+                  [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+                },
+              });
+              done();
+            })
+            .catch(err => done(err));
+        });
+      });
+
+      it(`tracked refs of tracked values should also be partially validated even if overall validation fails, { convert: true } (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.string().guid(),
+            b: joi.ref('a'),
+          });
+          // The last character of these guids are invalid, BUT the string() schema
+          // validation should still apply the string-type-checked tag
+          const data = {
+            a: trackString(
+              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-'
+            ),
+            b: trackString(
+              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-',
+              {
+                tags: {
+                  [DataflowTag.UNTRUSTED]: [0, 35],
+                  [DataflowTag.CUSTOM]: [0, 35]
+                }
+              }
+            ),
+          };
+
+          // We need abortEarly in order to have joi continue to validate ref,
+          // although the full validation of the target key fails
+          const result = schema.validate(data, {
+            convert: true,
+            abortEarly: false,
+          });
+
+          const overrides = {
+            name: 'Joi.string.validate',
+            tags: {
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+            },
+            methodName: 'string.validate'
+          };
+
+          // validation outcome
+          expect(result.error.details[0].message).to.equal(
+            '"a" must be a valid GUID'
+          );
+          // result
+          makeAssertions(tracker.getData(result.value.a), overrides);
+          makeAssertions(tracker.getData(result.value.b), overrides);
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a), overrides);
+          makeAssertions(tracker.getData(data.b), {
+            ...overrides,
+            tags: {
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.CUSTOM]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+            },
+          });
+        });
+      });
+
+      it(`tracked refs of tracked values should also be partially validated even if overall validation fails, { convert: false } (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.string().guid(),
+            b: joi.ref('a'),
+          });
+          // The last character of these guids are invalid, BUT the string() schema
+          // validation should still apply the string-type-checked tag
+          const data = {
+            a: trackString(
+              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-'
+            ),
+            b: trackString(
+              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-',
+              {
+                tags: {
+                  [DataflowTag.UNTRUSTED]: [0, 35],
+                  [DataflowTag.CUSTOM]: [0, 35]
+                }
+              }
+            ),
+          };
+
+          // We need abortEarly in order to have joi continue to validate ref,
+          // although the full validation of the target key fails
+          const result = schema.validate(data, {
+            convert: false,
+            abortEarly: false,
+          });
+
+          const overrides = {
+            name: 'Joi.string.validate',
+            tags: {
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+            },
+            methodName: 'string.validate'
+          };
+
+          // validation outcome
+          expect(result.error.details[0].message).to.equal(
+            '"a" must be a valid GUID'
+          );
+          // result
+          makeAssertions(tracker.getData(result.value.a), overrides);
+          makeAssertions(tracker.getData(result.value.b), {
+            ...overrides,
+            tags: {
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.CUSTOM]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+            },
+          });
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a), overrides);
+          makeAssertions(tracker.getData(data.b), {
+            ...overrides,
+            tags: {
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.CUSTOM]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+            },
+          });
+        });
+      });
+
+      it(`object refs where both target and ref are tracked - ref gets same validation tags (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.object({
+              aa: joi.object({
+                aaa: joi.string().guid(),
+              }),
+              foo: joi.string().guid(),
+            }),
+            b: joi.ref('a'),
+          });
+          const data = {
+            a: {
+              aa: {
+                aaa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+              },
+              foo: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            },
+            b: {
+              aa: {
+                aaa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+              },
+              foo: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            },
+          };
+
+          const result = schema.validate(data, { convert: false });
+
+          // validation outcome
+          expect(result.error).to.be.undefined;
+          //result
+          makeAssertions(tracker.getData(result.value.a.foo));
+          makeAssertions(tracker.getData(result.value.b.foo));
+
+          makeAssertions(tracker.getData(result.value.a.aa.aaa));
+          makeAssertions(tracker.getData(result.value.b.aa.aaa));
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a.foo));
+          makeAssertions(tracker.getData(data.b.foo));
+
+          makeAssertions(tracker.getData(data.a.aa.aaa));
+          makeAssertions(tracker.getData(data.b.aa.aaa));
+        });
+      });
+
+      it(`should tag the refs even when the target is not - (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: { aa: joi.string().guid() },
+            b: joi.ref('a.aa'),
+            c: { cc: { ccc: joi.ref('....a.aa') } },
+            d: { dd: { ddd: joi.ref('....a.aa') } },
+          });
+
+          const data = {
+            a: { aa: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265' },
+            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            c: { cc: { ccc: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265') } },
+            d: { dd: { ddd: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265' } },
+          };
+
+          const result = schema.validate(data, { convert: false });
+
+          // validation outcome
+          expect(result.error).to.be.undefined;
+          expect(tracker.getData(result.value.a)).to.be.null;
+          expect(tracker.getData(result.value.d.dd.ddd)).to.be.null;
+
+          makeAssertions(tracker.getData(result.value.b));
+          makeAssertions(tracker.getData(result.value.c.cc.ccc));
+        });
+      });
+
+      Object.entries({
+        base64: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: 'aGVsbG8=',
+        },
+        guid: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
+        },
+        alphanum: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: 'rtgtr2342',
+        },
+        hex: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: '54455354',
+        },
+        isoDate: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: '2018-11-28T18:25:32.000Z',
+        },
+        isoDuration: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: 'P3Y6M4DT12H30M5S',
+        },
+        token: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: '_azAZ09',
+        },
+        creditCard: {
+          tag: DataflowTag.LIMITED_CHARS,
+          value: '4111111111111111',
+        },
+        ip: {
+          tag: DataflowTag.LIMITED_CHARS,
+          value: '0.0.0.0',
+        },
+        hostname: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: 'www.contrastsecurity.com',
+        },
+        domain: {
+          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
+          value: 'www.contrastsecurity.com',
+        },
+      }).forEach(([key, { value, tag }]) => {
+        it(`should tag the refs even when the target is not - string schemas(${key}) (${methods})`, function() {
+          simulateRequestScope(() => {
+            const schema = getSchema(methods, {
+              a: { [key]: joi.string()[key]() },
+              [key]: joi.ref(`a.${key}`),
+            });
+
+            const data = {
+              a: { [key]: value },
+              [key]: trackString(value),
+            };
+
+            const result = schema.validate(data, { convert: false });
+
+            // validation outcome
+            expect(result.error).to.be.undefined;
+
+            expect(tracker.getData(result.value.a[key])).to.be.null;
+            const { tags } = tracker.getData(result.value[key]);
+            expect(tags).to.deep.equal({
+              [DataflowTag.UNTRUSTED]: [0, value.length - 1],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, value.length - 1],
+              [tag]: [0, value.length - 1]
+            }
+            );
+          });
+        });
+      });
+
+      it(`ref used with adjust() option does merge the tags with the adjusted value (if any), { convert: true } (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema('object', {
+            a: joi.string().guid(),
+            b: joi.ref('a', {
+              adjust: (v) => v
+            }),
+          });
+          const data = {
+            a: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265', {
+              tags: {
+                [DataflowTag.UNTRUSTED]: [0, 35],
+                [DataflowTag.CUSTOM]: [0, 35]
+              }
+            }),
+          };
+
+          const result = schema.validate(data);
+
+          // validation result
+          expect(result.error).to.be.undefined;
+
+          const override = {
+            name: 'Joi.values.get',
+            methodName: 'values.get',
+            tags: {
+              [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35],
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.CUSTOM]: [0, 35]
+            }
+          };
+          // result
+          makeAssertions(tracker.getData(result.value.a), override);
+          makeAssertions(tracker.getData(result.value.b), override);
+          // orig
+          makeAssertions(tracker.getData(data.a), override);
+          makeAssertions(tracker.getData(data.b), override);
+        });
+      });
+
+      it(`tracked ref of tracked value gets validation tags using { in: true } (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi.array().items(joi.string().guid()),
+            b: joi.ref('a', { in: true }),
+            c: joi.string().guid(),
+            d: joi.ref('c', { in: true }),
+          });
+
+          const data = {
+            a: ['fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267', trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'), 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23263'],
+            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+            c: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
+            d: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
+          };
+
+          const result = schema.validate(data);
+
+          // validation result
+          expect(result.error).to.be.undefined;
+          // result
+          makeAssertions(tracker.getData(result.value.a[1]));
+          makeAssertions(tracker.getData(result.value.b));
+          makeAssertions(tracker.getData(result.value.c));
+          makeAssertions(tracker.getData(result.value.d));
+          // orig
+          makeAssertions(tracker.getData(data.a[1]));
+          makeAssertions(tracker.getData(data.b));
+          makeAssertions(tracker.getData(data.c));
+          makeAssertions(tracker.getData(data.d));
+        });
+      });
+
+      it(`tracked ref of tracked value gets validation tags using { iterables: true } (${methods})`, function() {
+        simulateRequestScope(() => {
+          const schema = getSchema(methods, {
+            a: joi
+              .object({
+                aa: joi.string().guid(),
+                bb: joi.string()
+              })
+              .cast('map'),
+            b: joi.ref('a.bb', { iterables: true }),
+          });
+          const data = {
+            a: {
+              aa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
+              bb: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
+            },
+            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
+          };
+
+          const result = schema.validate(data);
+
+          const overrides = {
+            name: 'Joi.string.validate',
+            methodName: 'string.validate',
+            tags: {
+              [DataflowTag.UNTRUSTED]: [0, 35],
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35],
+            }
+          };
+          // validation outcome
+          expect(result.error).to.be.undefined;
+          // result
+          makeAssertions(tracker.getData(result.value.a.get('aa')));
+          makeAssertions(tracker.getData(result.value.b), overrides);
+          // orig (target: A)
+          makeAssertions(tracker.getData(data.a.aa));
+          makeAssertions(tracker.getData(data.b), overrides);
+        });
+      });
+    });
+  });
+
+  function makeAssertions(trackData, overrides = {}) {
+    const assertionValues = {
+      name: 'Joi.string.guid',
+      tags: {
+        [DataflowTag.UNTRUSTED]: [0, 35],
+        [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 35],
+        [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
+      },
+      moduleName: 'joi',
+      methodName: 'string.guid',
+      ...overrides
+    };
+    expect(trackData.name).to.equal(assertionValues.name);
+    expect(trackData.tags).to.deep.equal(assertionValues.tags);
+    expect(trackData.moduleName).to.equal(assertionValues.moduleName);
+    expect(trackData.methodName).to.equal(assertionValues.methodName);
+  }
+});
+
+