@contrast/assess 1.31.0 → 1.33.0

package/lib/dataflow/propagation/install/string/index.test.js

@@ -0,0 +1,103 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation string', function () {
+  let core, trackString, simulateRequestScope, instr;
+
+  beforeEach(function () {
+    ({ core, trackString, simulateRequestScope } = initAssessFixture());
+    instr = core.assess.dataflow.propagation.stringInstrumentation;
+  });
+
+  const propagatorList = ['concat', 'replace', 'substring', 'trim'];
+
+  it('composes different installers', function () {
+    propagatorList.forEach((name) => {
+      expect(instr[name]).to.have.property('install').and.be.a('function');
+      expect(instr[name]).to.have.property('uninstall').and.be.a('function');
+    });
+  });
+
+  it('dispatches installation to sub-components', function () {
+    const installs = [];
+    const uninstalls = [];
+    // stub these to prevent side effects
+    propagatorList.forEach((name) => {
+      const instr = core.assess.dataflow.propagation.stringInstrumentation;
+      installs.push(sinon.stub(instr[name], 'install'));
+      uninstalls.push(sinon.stub(instr[name], 'uninstall'));
+    });
+
+    instr.install();
+    instr.uninstall();
+
+    expect(installs).to.have.lengthOf(4);
+    installs.forEach((installer) => {
+      expect(installer).to.have.been.called;
+    });
+    expect(uninstalls).to.have.lengthOf(4);
+    uninstalls.forEach((installer) => {
+      expect(installer).to.have.been.called;
+    });
+  });
+
+  describe('utils patchCustomMatcher', function () {
+    let tracker, arg, patchedFn, argInfo;
+    const customFn = (str) => str;
+    const methodCustomArg = {
+      [Symbol.match]: customFn,
+    };
+
+    beforeEach(function () {
+      tracker = core.assess.dataflow.tracker;
+      simulateRequestScope(function () {
+        arg = trackString('foo');
+        argInfo = tracker.getData(arg);
+        patchedFn = instr.utils.patchCustomMatcher(
+          methodCustomArg[Symbol.match],
+          argInfo,
+          methodCustomArg,
+          'String.prototype.match',
+          'testPatch'
+        );
+      });
+    });
+
+    it('places a propagation event on the function\'s argument', function () {
+      simulateRequestScope(function () {
+        const res = patchedFn(arg);
+        const resInfo = tracker.getData(res);
+
+        expect(resInfo).to.not.equal(argInfo);
+        expect(resInfo.context).to.equal('\'foo\'.match(Object)');
+        expect(resInfo.history).to.deep.equal([argInfo]);
+        expect(resInfo.name).to.equal('String.prototype.match');
+        expect(resInfo.methodName).to.equal('prototype.match');
+        expect(resInfo.object).to.deep.equal({
+          value: argInfo.value,
+          tracked: true,
+        });
+        expect(resInfo.tags).to.deep.equal(argInfo.tags);
+      });
+    });
+
+    it('does not create a propagation event if the function is called out of request scope', function () {
+      const res = patchedFn(arg);
+
+      expect(tracker.getData(res)).to.equal(argInfo);
+    });
+
+    it('does not create a propagation event if the function is called with locked instrumentation', function () {
+      simulateRequestScope(function () {
+        core.scopes.instrumentation.run({ lock: true }, () => {
+          const res = patchedFn(arg);
+
+          expect(tracker.getData(res)).to.equal(argInfo);
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/propagation/install/string/match-all.test.js

@@ -0,0 +1,399 @@
+'use strict';
+
+const { DataflowTag: { UNTRUSTED } } = require('@contrast/common');
+const { expect } = require('chai');
+const { inspect } = require('util');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+
+function createItem(idx, itemValue = [''], input = 'foo', groups = undefined) {
+  const item = [...itemValue];
+  item.index = idx;
+  item.input = input;
+  item.groups = groups;
+
+  return item;
+}
+
+describe('assess dataflow propagation string matchAll', function () {
+  let core, simulateRequestScope, trackString, tracker;
+
+  beforeEach(function () {
+    ({
+      core,
+      trackString,
+      simulateRequestScope
+    } = initAssessFixture());
+
+    tracker = core.assess.dataflow.tracker;
+
+    core.assess.dataflow.propagation.regExpExec.install();
+    core.assess.dataflow.propagation.stringInstrumentation.matchAll.install();
+    core.assess.dataflow.propagation.stringInstrumentation.substring.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.regExpExec.uninstall();
+    core.assess.dataflow.propagation.stringInstrumentation.matchAll.uninstall();
+    core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
+  });
+
+  describe('base cases', function () {
+    [
+      [],
+      [undefined],
+      ['']
+    ].forEach((val) => {
+      it(`returns empty strings from matchAll for ${inspect(val[0])}`, function () {
+        simulateRequestScope(() => {
+
+          const ret = 'foo'.matchAll(val[0]);
+
+          expect([...ret]).to.deep.equal([
+            createItem(0),
+            createItem(1),
+            createItem(2),
+            createItem(4)
+          ]);
+          expect(tracker.getData(ret[0])).to.be.null;
+        });
+      });
+    });
+
+    it('returns null when no matchAll is found', function () {
+      simulateRequestScope(() => {
+        const ret = ''.matchAll('foo');
+
+        expect([...ret]).to.deep.equal([]);
+      });
+    });
+
+    it('returns first match string', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.matchAll(/f/g);
+        const consumed = [...ret];
+
+        expect(consumed).to.deep.equal([createItem(0, 'f')]);
+        expect(tracker.getData(consumed[0[0]])).to.be.null;
+      });
+    });
+
+    it('returns all match strings', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.matchAll(/o/g);
+        const consumed = [...ret];
+
+        expect(consumed).to.deep.equal([
+          createItem(0, 'o'),
+          createItem(1, 'o'),
+        ]);
+        consumed.forEach((val) => {
+          expect(tracker.getData(val[0])).to.be.null;
+        });
+      });
+    });
+
+    it('converts string to regex and returns matchAll result', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.matchAll('f');
+        const consumed = [...ret];
+
+        expect(consumed).to.deep.equal([createItem(0, 'f')]);
+        expect(tracker.getData(consumed[0[0]])).to.be.null;
+      });
+    });
+
+    it('returns match from custom matcher', function () {
+      simulateRequestScope(() => {
+        const ret = 'foo'.matchAll({
+          [Symbol.matchAll](_str) {
+            return ['foo'];
+          },
+        });
+
+        expect(ret).to.deep.equal(['foo']);
+        expect(tracker.getData(ret[0])).to.be.null;
+      });
+    });
+  });
+
+  describe('propagation', function () {
+    it('keeps track of tracked of all globally matched strings', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo');
+
+        const ret = extern.matchAll(/foo/g);
+        const consumed = [...ret];
+
+        expect(consumed).to.deep.equal([
+          createItem(0, ['foo'], 'foobarfoo'),
+          createItem(0, ['foo'], 'foobarfoo')
+        ]);
+        consumed.forEach((val) => {
+          const valInfo = tracker.getData(val[0]);
+
+          expect(valInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(valInfo.name).to.equal('String.prototype.matchAll');
+        });
+      });
+    });
+
+    it('keeps track of partially tracked matched strings', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo', {
+          tags: {
+            [UNTRUSTED]: [0, 5]
+          }
+        });
+
+        const ret = extern.matchAll(/foo/g);
+        const consumed = [...ret];
+        const firstArgInfo = tracker.getData(consumed[0][0]);
+
+        expect(consumed).to.deep.equal([
+          createItem(0, ['foo'], 'foobarfoo'),
+          createItem(0, ['foo'], 'foobarfoo')
+        ]);
+        expect(firstArgInfo.tags).to.deep.equal({
+          [UNTRUSTED]: [0, 2]
+        });
+        expect(firstArgInfo.name).to.equal('String.prototype.matchAll');
+        expect(tracker.getData(consumed[1][0])).to.be.null;
+      });
+    });
+
+    it('keeps track of tracked strings with multiple ranges', function () {
+      simulateRequestScope(() => {
+        const extern = trackString('foobarfoo', {
+          tags: {
+            foo: [0, 2, 6, 8],
+            bar: [3, 5],
+            foobar: [0, 5],
+            barfoo: [3, 8]
+          }
+        });
+
+        const ret = extern.matchAll(/foo/g);
+        const consumed = [...ret];
+        const retFirstArgInfo = tracker.getData(consumed[0][0]);
+        const retSecondArgInfo = tracker.getData(consumed[1][0]);
+
+        expect(consumed).to.deep.equal([
+          createItem(0, ['foo'], 'foobarfoo'),
+          createItem(0, ['foo'], 'foobarfoo')
+        ]);
+        expect(retFirstArgInfo.tags).to.deep.equal({
+          foo: [0, 2],
+          foobar: [0, 2]
+        });
+        expect(retFirstArgInfo.name).to.equal('String.prototype.matchAll');
+        expect(retSecondArgInfo.tags).to.deep.equal({
+          foo: [0, 2],
+          barfoo: [0, 2]
+        });
+        expect(retSecondArgInfo.name).to.equal('String.prototype.matchAll');
+      });
+    });
+
+    describe('empty or full matches', function () {
+      it('handles full string matches', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.matchAll(/(?<full>foobar)/g);
+          const consumed = [...ret];
+          const matchInfo = tracker.getData(consumed[0][0]);
+          const captrueMatchInfo = tracker.getData(consumed[0][1]);
+          const fullGroupInfo = tracker.getData(consumed[0].groups.full);
+
+          expect(consumed[0]).to.deep.equal([
+            'foobar',
+            'foobar',
+          ]);
+          expect(matchInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 5]
+          });
+          expect(matchInfo.name).to.equal('String.prototype.matchAll');
+          expect(captrueMatchInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 5]
+          });
+          expect(captrueMatchInfo.name).to.equal('String.prototype.matchAll');
+          expect(consumed[0].groups.full).to.equal('foobar');
+          expect(fullGroupInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 5]
+          });
+          expect(fullGroupInfo.name).to.equal('String.prototype.matchAll');
+        });
+      });
+
+      it('handles empty string matches', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar');
+
+          const ret = extern.matchAll(/(?<empty>)/g);
+          const consumed = [...ret];
+          const matchInfo = tracker.getData(consumed[0][0]);
+          const captrueMatchInfo = tracker.getData(consumed[0][1]);
+          const emptyGroupInfo = tracker.getData(consumed[0].groups.empty);
+
+          expect(consumed[0]).to.deep.equal([
+            '',
+            '',
+          ]);
+          expect(matchInfo).to.be.null;
+          expect(captrueMatchInfo).to.be.null;
+          expect(consumed[0].groups.empty).to.equal('');
+          expect(emptyGroupInfo).to.be.null;
+        });
+      });
+    });
+
+    describe('capture groups', function () {
+      it('keeps track of tracked strings within matched capture groups', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar', {
+            tags: {
+              [UNTRUSTED]: [0, 5]
+            }
+          });
+
+          const ret = extern.matchAll(/(foo)|(bar)/g);
+          const consumed = [...ret];
+          const retFirstArgInfo = tracker.getData(consumed[0][0]);
+          const retSecondArgInfo = tracker.getData(consumed[1][0]);
+
+          expect(consumed).to.deep.equal([
+            createItem(0, ['foo', 'foo', undefined], 'foobarfoo'),
+            createItem(3, ['bar', undefined, 'bar'], 'foobarfoo'),
+          ]);
+          expect(ret.groups).to.be.undefined;
+          expect(retFirstArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retFirstArgInfo.name).to.equal('String.prototype.matchAll');
+          expect(retSecondArgInfo.tags).to.deep.equal({
+            [UNTRUSTED]: [0, 2]
+          });
+          expect(retSecondArgInfo.name).to.equal('String.prototype.matchAll');
+        });
+      });
+
+      it('keeps track of tracked strings within matched named capture groups', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar', {
+            tags: {
+              [UNTRUSTED]: [0, 5]
+            }
+          });
+
+          const ret = extern.matchAll(/(?<fooOrBar>foo|bar)/g);
+          const consumed = [...ret];
+
+          const infos = [
+            tracker.getData(consumed[0][0]),
+            tracker.getData(consumed[0][1]),
+            tracker.getData(consumed[1][0]),
+            tracker.getData(consumed[1][1]),
+            tracker.getData(consumed[0].groups.fooOrBar),
+            tracker.getData(consumed[1].groups.fooOrBar)
+          ];
+
+          expect(consumed).to.deep.equal([
+            createItem(0, ['foo', 'foo'], 'foobar', { fooOrBar: 'foo' }),
+            createItem(0, ['bar', 'bar'], 'foobar', { fooOrBar: 'bar' })
+          ]);
+          expect(consumed[0].groups.fooOrBar).to.equal('foo');
+          expect(consumed[1].groups.fooOrBar).to.equal('bar');
+          infos.forEach((info) => {
+            expect(info.tags).to.deep.equal({
+              [UNTRUSTED]: [0, 2]
+            });
+            expect(info.name).to.equal('String.prototype.matchAll');
+          });
+        });
+      });
+
+      it('keeps track of tracked strings within multiple matched named capture groups', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar', {
+            tags: {
+              [UNTRUSTED]: [0, 5]
+            }
+          });
+
+          const ret = extern.matchAll(/(?<fizzOrBuzz>fizz|buzz)|(?<fooOrBar>foo|bar)/g);
+          const consumed = [...ret];
+          const infos = [
+            tracker.getData(consumed[0][0]),
+            tracker.getData(consumed[0][2]),
+            tracker.getData(consumed[1][0]),
+            tracker.getData(consumed[1][2]),
+            tracker.getData(consumed[0].groups.fooOrBar),
+            tracker.getData(consumed[1].groups.fooOrBar)
+          ];
+
+          expect(consumed).to.deep.equal([
+            createItem(0, ['foo', undefined, 'foo'], 'foobar', { fizzOrBuzz: undefined, fooOrBar: 'foo' }),
+            createItem(3, ['bar', undefined, 'bar'], 'foobar', { fizzOrBuzz: undefined, fooOrBar: 'bar' }),
+          ]);
+          expect(consumed[0].groups).to.deep.equal({ fizzOrBuzz: undefined, fooOrBar: 'foo' });
+          expect(consumed[1].groups).to.deep.equal({ fizzOrBuzz: undefined, fooOrBar: 'bar' });
+          infos.forEach((info) => {
+            expect(info.tags).to.deep.equal({
+              [UNTRUSTED]: [0, 2]
+            });
+            expect(info.name).to.equal('String.prototype.matchAll');
+          });
+        });
+      });
+    });
+
+    describe('custom matcher', function () {
+      it('keeps track of tracked string returned by custom matcher', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foo', {
+            tags: {
+              untrusted: [0, 2]
+            }
+          });
+
+          const ret = 'foo'.matchAll({
+            [Symbol.matchAll](_str) {
+              return [extern];
+            },
+          });
+          expect(ret).to.deep.equal(['foo']);
+          expect(tracker.getData(ret[0]).tags).to.deep.equal({
+            untrusted: [0, 2]
+          });
+        });
+      });
+
+      it('keeps track of tracked string copied by custom matcher', function () {
+        simulateRequestScope(() => {
+          const extern = trackString('foobar', {
+            tags: {
+              untrusted: [0, 5]
+            }
+          });
+
+          const ret = extern.matchAll({
+            [Symbol.matchAll](str) {
+              return [str.substring(0, 3)];
+            },
+          });
+          const retInfo = tracker.getData(ret[0]);
+
+          expect(ret).to.deep.equal(['foo']);
+          expect(retInfo.tags).to.deep.equal({
+            untrusted: [0, 2]
+          });
+          expect(retInfo.history[0].name).to.equal('String.prototype.matchAll');
+        });
+      });
+    });
+  });
+});
+