@contrast/assess 1.31.0 → 1.33.0

package/lib/dataflow/propagation/install/string/slice.test.js

@@ -0,0 +1,265 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow propagation string slice', function () {
+  let core, tracker, trackString, simulateRequestScope;
+
+  beforeEach(function () {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+
+    core.assess.dataflow.propagation.stringInstrumentation.slice.install();
+  });
+
+  afterEach(function () {
+    core.assess.dataflow.propagation.stringInstrumentation.slice.uninstall();
+    sinon.resetHistory();
+  });
+
+  [
+    {
+      desc: 'not tracked',
+      str: '-----------',
+      args: [0, 2],
+    },
+    {
+      desc: 'above',
+      str: '-----xx',
+      tags: {
+        untrusted: [5, 6]
+      },
+      expected: {
+        untrusted: [5, 6]
+      },
+      args: [0],
+      result: '-----xx',
+    },
+    {
+      desc: 'above',
+      str: '-----xx',
+      tags: {
+        untrusted: [5, 6]
+      },
+      args: [0, 3],
+      result: '---',
+    },
+    {
+      desc: 'highspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [1, 4],
+      expected: {
+        untrusted: [1, 2]
+      },
+      expectedResult: '-xx',
+    },
+    {
+      desc: 'within',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [1],
+      expected: {
+        untrusted: [1, 3]
+      },
+      result: '-xxx--',
+    },
+    {
+      desc: 'fullSpan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [2, 4],
+      expected: {
+        untrusted: [0, 1]
+      },
+      result: 'xx',
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [3, 5],
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4],
+        cat: [0, 2]
+      },
+      args: [3, 5],
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4],
+        cat: [0, 4]
+      },
+      args: [3, 5],
+      expected: {
+        untrusted: [0, 1],
+        cat: [0, 1]
+      },
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4],
+        cat: [4, 5]
+      },
+      args: [3, 5],
+      expected: {
+        untrusted: [0, 1],
+        cat: [1, 1]
+      },
+    },
+    {
+      desc: 'lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4],
+        cat: [6, 6]
+      },
+      args: [3, 5],
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+    // Negative implementation
+    {
+      desc: 'negative / not tracked',
+      str: '-----------',
+      args: [-3, -8],
+    },
+    {
+      desc: 'negative / above',
+      str: '-----xx',
+      tags: {
+        untrusted: [5, 6]
+      },
+      args: [-6, -3],
+      result: '---',
+    },
+    {
+      desc: 'above',
+      str: '-----xx',
+      tags: {
+        untrusted: [5, 6]
+      },
+      args: [2, -1],
+      result: '---x',
+      expected: {
+        untrusted: [3, 3]
+      },
+    },
+    {
+      desc: 'negative / highspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [-6, -3],
+      expected: {
+        untrusted: [1, 2]
+      },
+      expectedResult: '-xx',
+    },
+    {
+      desc: 'negative / within',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [-6],
+      expected: {
+        untrusted: [1, 3]
+      },
+      result: '-xxx--',
+    },
+    {
+      desc: 'negative / fullSpan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [-5, -3],
+      expected: {
+        untrusted: [0, 1]
+      },
+      result: 'xx',
+    },
+    {
+      desc: 'negative / lowspan',
+      str: '--xxx--',
+      tags: {
+        untrusted: [2, 4]
+      },
+      args: [-4, -2],
+      expected: {
+        untrusted: [0, 1]
+      },
+    },
+  ].forEach(({ desc, str, tags, args, expected }) => {
+    it(desc, function () {
+      simulateRequestScope(function () {
+        const extern = trackString(str, { tags });
+        const result = extern.slice(...args);
+        const strInfo = tracker.getData(result);
+
+        if (expected) {
+          expect(strInfo.tags).to.deep.equal(expected);
+        } else {
+          expect(strInfo).to.be.null;
+        }
+      });
+    });
+  });
+
+  it('won\'t do anything if the result is the same or not in proper scope', function () {
+    const extern = trackString('foo');
+
+    let result;
+
+    core.scopes.sources.run({}, function () {
+      result = extern.slice(5);
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+
+    core.scopes.sources.run(null, function () {
+      result = extern.slice(0, 2);
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+
+    core.scopes.instrumentation.run({ lock: true }, function () {
+      core.scopes.sources.run({}, function () {
+        result = extern.slice(0, 2);
+      });
+    });
+
+    expect(tracker.getData(result)).to.be.null;
+  });
+});