@contrast/assess 1.31.0 → 1.33.0

package/lib/dataflow/propagation/install/path/format.test.js

@@ -0,0 +1,250 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { DataflowTag: { UNTRUSTED } } = require('@contrast/common');
+
+describe('assess dataflow propagation path format', function () {
+  let core, tracker, createPropagationEvent, trackString, simulateRequestScope;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope, trackString } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+    createPropagationEvent = sinon.spy(
+      core.assess.eventFactory,
+      'createPropagationEvent'
+    );
+    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
+  });
+
+  ['posix', 'win32'].forEach((os) => {
+    describe(os, function () {
+      let path;
+
+      beforeEach(function () {
+        path = require('path')[os];
+
+        core.depHooks.resolve.yields(path);
+        const formatInstr = require('./format')(core);
+        formatInstr.install();
+      });
+
+      it('should ignore empty object', function () {
+        simulateRequestScope(function () {
+          const result = path.format({});
+          const strInfo = tracker.getData(result);
+
+          expect(strInfo).to.be.null;
+        });
+      });
+
+      it('will not propagate if there is no assess context', function () {
+        simulateRequestScope(function () {
+          const dir = trackString('/path/to');
+
+          const result = path.format({
+            dir,
+            base: 'file.txt'
+          });
+
+          expect(tracker.getData(result)).to.be.null;
+        }, {});
+      });
+
+      it('will not propagate if there instrumentation is locked', function () {
+        simulateRequestScope(function () {
+          core.scopes.instrumentation.run({ lock: true }, function () {
+            const dir = trackString('/path/to');
+
+            const result = path.format({
+              dir,
+              base: 'file.txt'
+            });
+
+            expect(tracker.getData(result)).to.be.null;
+          });
+        });
+      });
+
+      it('will not propagate if the argument is not tracked', function () {
+        simulateRequestScope(function () {
+          const dir = '/path/to';
+
+          path.format({
+            dir,
+            base: 'file.txt'
+          });
+
+          expect(createPropagationEvent).to.not.have.been.called;
+        });
+      });
+
+      it('will not propagate if there no event created', function () {
+        simulateRequestScope(function () {
+          core.config.assess.max_propagation_events = 0;
+          const dir = trackString('/path/to');
+
+          const result = path.format({
+            dir,
+            base: 'file.txt'
+          });
+
+          expect(tracker.getData(result)).to.be.null;
+        });
+      });
+
+      it('should not propagate if tracked string is not in result', function() {
+        simulateRequestScope(function () {
+          const root = trackString('/root');
+
+          const result = path.format({
+            root,
+            dir: '/path/to',
+            base: 'file.txt'
+          });
+          expect(tracker.getData(result)).to.be.null;
+        });
+      });
+
+      it('should propagate tracked root', function() {
+        simulateRequestScope(function () {
+          const root = trackString('/root');
+
+          const result = path.format({
+            root,
+            base: '/file.txt'
+          });
+          const strInfo = tracker.getData(result);
+          expect(result).to.be.equal('/root/file.txt');
+          if (os === 'win32') {
+            expect(strInfo.tags).to.deep.equal({
+              [UNTRUSTED]: [1, 4],
+            });
+          } else {
+            expect(strInfo.tags).to.deep.equal({
+              [UNTRUSTED]: [0, 4],
+            });
+          }
+        });
+      });
+
+      it('should propagate tracked dir', function() {
+        simulateRequestScope(function () {
+          const dir = trackString('/path/to');
+
+          const result = path.format({
+            dir,
+            base: 'file.txt'
+          });
+          const strInfo = tracker.getData(result);
+          if (os === 'win32') {
+            expect(strInfo.tags).to.deep.equal({
+              [UNTRUSTED]: [1, 4, 6, 7],
+            });
+          } else {
+            expect(strInfo.tags).to.deep.equal({
+              [UNTRUSTED]: [0, 7],
+            });
+          }
+        });
+      });
+
+      it('should propagate tracked base', function() {
+        simulateRequestScope(function () {
+          const base = trackString('file.txt');
+
+          const result = path.format({
+            dir: '/path/to',
+            base
+          });
+          const strInfo = tracker.getData(result);
+          expect(strInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [9, 12, 14, 16]
+          });
+        });
+      });
+
+      it('should propagate tracked name', function() {
+        simulateRequestScope(function () {
+          const name = trackString('file');
+
+          const result = path.format({
+            dir: '/path/to',
+            name,
+            ext: '.txt'
+          });
+          const strInfo = tracker.getData(result);
+          expect(strInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [9, 12]
+          });
+        });
+      });
+
+      it('should propagate tracked ext', function() {
+        simulateRequestScope(function () {
+          const ext = trackString('.txt');
+
+          const result = path.format({
+            dir: '/path/to',
+            name: 'file',
+            ext
+          });
+          const strInfo = tracker.getData(result);
+          expect(strInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [14, 16]
+          });
+        });
+      });
+
+      it('should propagate multiple tracked properties', function() {
+        simulateRequestScope(function () {
+          const name = trackString('file');
+          const ext = trackString('.txt');
+
+          const result = path.format({
+            dir: '/path/to',
+            name,
+            ext
+          });
+          const strInfo = tracker.getData(result);
+          expect(strInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [9, 12, 14, 16]
+          });
+        });
+      });
+
+      it('should propagate multiple tag ranges', function() {
+        simulateRequestScope(function () {
+          const dir = trackString('/path/to', {
+            tags: {
+              UNTRUSTED: [1, 4, 6, 7]
+            }
+          });
+          const name = trackString('file', {
+            tags: {
+              'FOO': [0, 3]
+            }
+          });
+          const ext = trackString('.txt', {
+            tags: {
+              'BAR': [1, 3]
+            }
+          });
+
+          const result = path.format({
+            dir,
+            name,
+            ext
+          });
+          const strInfo = tracker.getData(result);
+          expect(strInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [1, 4, 6, 7],
+            'FOO': [9, 12],
+            'BAR': [14, 16]
+          });
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/path/index.test.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation string', function () {
+  let core, instr;
+
+  beforeEach(function () {
+    ({ core } = initAssessFixture());
+    instr = core.assess.dataflow.propagation.pathInstrumentation;
+  });
+
+  const propagatorList = [
+    'basename',
+    'dirname',
+    'joinAndResolve',
+    'normalize',
+    'relative'
+  ];
+
+  it('composes different installers', function () {
+    propagatorList.forEach((name) => {
+      expect(instr[name]).to.have.property('install').and.be.a('function');
+    });
+  });
+
+  it('dispatches installation to sub-components', function () {
+    const installs = [];
+    // stub these to prevent side effects
+    propagatorList.forEach((name) => {
+      const instr = core.assess.dataflow.propagation.pathInstrumentation;
+      installs.push(sinon.stub(instr[name], 'install'));
+    });
+
+    instr.install();
+
+    expect(installs).to.have.lengthOf(5);
+    installs.forEach((installer) => {
+      expect(installer).to.have.been.called;
+    });
+  });
+});
+