@contrast/assess 1.31.0 → 1.33.0

package/lib/dataflow/sources/handler.test.js

@@ -0,0 +1,463 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const {
+  DataflowTag,
+  InputType
+} = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+
+describe('assess dataflow sources handler', function () {
+  let core, simulateRequestScope, sources, tracker;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+    core.config.assess.max_context_source_events = 100;
+
+    // we want to remove previous calls to `logger` methods from before these tests.
+    sinon.reset();
+
+    sources = core.assess.dataflow.sources;
+    tracker = core.assess.dataflow.tracker;
+
+    sinon.spy(tracker, 'track');
+    core.assess.dataflow.propagation.bufferInstrumentation.install();
+  });
+
+  it('composes methods on core correctly', function () {
+    expect(sources.createTags).to.be.a('function');
+    expect(sources.handle).to.be.a('function');
+  });
+
+  describe('createTags', function () {
+    [
+      {
+        arg: {
+          value: ''
+        },
+        expected: null,
+      },
+      {
+        arg: {
+          value: undefined
+        },
+        expected: null,
+      },
+      {
+        arg: {
+          inputType: InputType.QUERYSTRING,
+          name: 'foo',
+          value: 'a',
+        },
+        expected: {
+          [DataflowTag.UNTRUSTED]: [0, 0]
+        }
+      },
+      {
+        arg: {
+          inputType: InputType.QUERYSTRING,
+          fieldName: 'foo',
+          value: 'ab',
+        },
+        expected: {
+          [DataflowTag.UNTRUSTED]: [0, 1]
+        }
+      },
+      {
+        arg: {
+          inputType: InputType.HEADER,
+          fieldName: 'foo',
+          value: 'abcd',
+        },
+        expected: {
+          [DataflowTag.UNTRUSTED]: [0, 3]
+        }
+      },
+      {
+        arg: {
+          inputType: InputType.HEADER,
+          fieldName: 'referer',
+          value: 'abcd',
+          tagNames: ['excluded:sql-injection'],
+        },
+        expected: {
+          [DataflowTag.HEADER]: [0, 3],
+          [DataflowTag.UNTRUSTED]: [0, 3],
+          ['excluded:sql-injection']: [0, 3],
+        }
+      }
+    ].forEach(({ arg, expected }) => {
+      it('creates expected tags based on name, value, and input type', function () {
+        const result = sources.createTags(arg);
+        expect(result).to.deep.equal(expected);
+      });
+    });
+  });
+
+  describe('handle', function () {
+    it('does not handle when no assess source context is active', function () {
+      const result = sources.handle({
+        name: 'test-source-name',
+        inputType: InputType.QUERYSTRING,
+        data: {
+          prop1: 'foo',
+        }
+      });
+      expect(result).to.be.null;
+    });
+
+    it('does nothing when async store\'s assess policy is null', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const trackedObj = sources.handle({
+          name: 'test-source-name',
+          inputType: InputType.QUERYSTRING,
+          sourceContext
+        });
+
+        expect(trackedObj).to.be.undefined;
+        expect(core.logger.trace).not.to.have.been.called;
+        expect(core.logger.warn).not.to.have.been.called;
+        expect(tracker.track).not.to.have.been.called;
+      }, { assess: { policy: null } });
+    });
+
+    it('does nothing when no data is passed', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const trackedObj = sources.handle({
+          name: 'test-source-name',
+          inputType: InputType.QUERYSTRING,
+          sourceContext
+        });
+
+        expect(trackedObj).to.be.undefined;
+        expect(core.logger.trace).not.to.have.been.called;
+        expect(core.logger.warn).not.to.have.been.called;
+        expect(tracker.track).not.to.have.been.called;
+      });
+    });
+
+    it('traverses objects and tracks string values', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const trackedObj = sources.handle({
+          name: 'test-source-name',
+          inputType: InputType.QUERYSTRING,
+          data: {
+            prop1: 'foo',
+            prop2: ['bar', 'bugs'],
+          },
+          sourceContext
+        });
+
+        expect(tracker.getData(trackedObj.prop1)).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop1',
+          result: { tracked: true, value: 'foo' },
+          inputType: InputType.QUERYSTRING,
+          stack: [],
+          value: 'foo',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 2],
+          },
+        });
+
+        expect(tracker.getData(trackedObj.prop2[0])).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop2.0',
+          result: { tracked: true, value: 'bar' },
+          inputType: InputType.QUERYSTRING,
+          stack: [],
+          value: 'bar',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 2],
+          },
+        });
+
+        expect(tracker.getData(trackedObj.prop2[1])).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop2.1',
+          result: { tracked: true, value: 'bugs' },
+          inputType: InputType.QUERYSTRING,
+          stack: [],
+          value: 'bugs',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 3],
+          },
+        });
+
+        core.config.assess.stacktraces = 'ALL';
+        const anotherTrackedObj = sources.handle({
+          name: 'test-source-name',
+          inputType: InputType.QUERYSTRING,
+          data: { prop1: 'foo' },
+          sourceContext
+        });
+
+        const trackData = tracker.getData(anotherTrackedObj.prop1);
+        expect(trackData).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop1',
+          result: { tracked: true, value: 'foo' },
+          inputType: InputType.QUERYSTRING,
+          value: 'foo',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 2],
+          }
+        });
+
+        const pathSep = process.platform === 'win32' ? '\\' : '/';
+
+        expect(trackData.stack.some((entry) => entry.file?.includes(`core${pathSep}lib${pathSep}capture-stacktrace.js`))).to.be.true;
+        expect(trackData.stack.some((entry) => entry.method?.includes('core.createSnapshot'))).to.be.true;
+        expect(trackData.stack.some((entry) => entry.file?.includes(`assess${pathSep}lib${pathSep}dataflow${pathSep}sources${pathSep}handler.js`))).to.be.true;
+        expect(trackData.stack.some((entry) => entry.method?.includes('sources.handle'))).to.be.true;
+      });
+    });
+
+    it('traverses objects and tracks string values by specific keys', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const trackedObj = sources.handle({
+          name: 'test-source-name',
+          keys: ['prop1', 'prop3'],
+          inputType: InputType.QUERYSTRING,
+          data: {
+            prop1: 'foo',
+            prop2: ['bar', 'bugs'],
+            prop3: {
+              foo: 'yellow'
+            }
+          },
+          sourceContext
+        });
+
+        expect(tracker.getData(trackedObj.prop1)).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop1',
+          result: { tracked: true, value: 'foo' },
+          inputType: InputType.QUERYSTRING,
+          stack: [],
+          value: 'foo',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 2],
+          },
+        });
+        expect(tracker.getData(trackedObj.prop2[0])).to.be.null;
+        expect(tracker.getData(trackedObj.prop2[1])).to.be.null;
+        expect(tracker.getData(trackedObj.prop3.foo)).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop3.foo',
+          result: { tracked: true, value: 'yellow' },
+          inputType: InputType.QUERYSTRING,
+          stack: [],
+          value: 'yellow',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 5],
+          },
+        });
+      });
+    });
+
+    it('traverses objects and tracks Buffer values', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const event = {
+          name: 'test-source-name',
+          inputType: InputType.QUERYSTRING,
+          data: {
+            prop1: Buffer.from('foo'),
+            prop2: Buffer.from('ascii', 'ascii'),
+            prop3: Buffer.from('base64', 'base64'),
+            prop4: Buffer.from('binary', 'binary'),
+            prop5: {
+              foo: Buffer.from('yellow'),
+            },
+            prop6: 'a string value',
+          },
+          sourceContext
+        };
+
+        sources.handle(event);
+
+        expect(tracker.getData(event.data.prop1.toString())).to.be.ok;
+        expect(tracker.getData(event.data.prop2.toString())).to.be.ok;
+        expect(tracker.getData(event.data.prop3.toString())).to.be.ok;
+        expect(tracker.getData(event.data.prop4.toString())).to.be.ok;
+        expect(tracker.getData(event.data.prop5.foo.toString())).to.be.ok;
+        expect(tracker.getData(event.data.prop6)).to.be.ok;
+        // we don't cache metadata since buffer's content can change
+        expect(
+          tracker.getData(event.data.prop1.toString())
+        ).not.to.equal(
+          tracker.getData(event.data.prop1.toString())
+        );
+      });
+    });
+
+    it('appropriately tracks when data param is Buffer instance', function () {
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const event = {
+          name: 'test-source-name',
+          inputType: InputType.QUERYSTRING,
+          data: Buffer.from('foo'),
+          sourceContext
+        };
+
+        sources.handle(event);
+
+        expect(tracker.getData(event.data)).to.be.ok;
+      });
+    });
+
+    it('exits source handling when configured max source events is reached', function () {
+      core.config.assess.max_context_source_events = 1;
+      simulateRequestScope(() => {
+        const name = 'test-source-name';
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        const trackedObj = sources.handle({
+          name,
+          inputType: InputType.QUERYSTRING,
+          data: {
+            prop1: 'foo',
+            prop2: ['bar', 'bugs'],
+          },
+          sourceContext
+        });
+
+        expect(tracker.getData(trackedObj.prop1)).to.be.like({
+          name: 'test-source-name',
+          pathName: 'prop1',
+          result: { tracked: true, value: 'foo' },
+          inputType: InputType.QUERYSTRING,
+          stack: [],
+          value: 'foo',
+          tags: {
+            [DataflowTag.UNTRUSTED]: [0, 2],
+          },
+        });
+
+        expect(tracker.getData(trackedObj.prop2[0])).to.be.null;
+        expect(tracker.getData(trackedObj.prop2[1])).to.be.null;
+        expect(core.logger.trace).to.have.been.calledWith(
+          { sourceName: name, inputType: InputType.QUERYSTRING },
+          'exiting assess source handling - %s max events exceeded',
+          1
+        );
+      });
+    });
+
+    it('logs an error when cannot create an event', function () {
+      simulateRequestScope(() => {
+        const name = 'test-source-name';
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        sources.handle({
+          name,
+          inputType: 'wrong-input-type',
+          data: {
+            prop1: 'foo',
+          },
+          sourceContext
+        });
+
+        expect(tracker.track).not.to.have.been.called;
+        expect(core.logger.trace).not.to.have.been.called;
+        expect(core.logger.warn).to.have.been.calledOnceWith(
+          { inputType: 'wrong-input-type', sourceName: 'test-source-name', pathName: 'prop1', value: 'foo' },
+          'unable to create source event',
+        );
+      });
+    });
+  });
+
+  describe('traversal', function () {
+    const { traverse } = require('./handler');
+    let visitorSpy;
+
+    beforeEach(function () {
+      visitorSpy = sinon.stub();
+    });
+
+    it('doesn\'t revist seen references', function () {
+      const obj = {
+        prop1: 'foo',
+        prop2: { foo: 'bar' },
+        prop3: [
+          'hello',
+          ['world'],
+          { key: 'val' },
+        ]
+      };
+
+      obj.circ = obj;
+
+      traverse(obj, (path, key, value) => {
+        // copy path, otherwise it will be empty by assertion time
+        visitorSpy(Array.from(path), key, value);
+      });
+
+      const visitorArgs = [
+        [['prop1'], 'prop1', 'foo'],
+        [['prop2', 'foo'], 'foo', 'bar'],
+        [['prop3', '0'], '0', 'hello'],
+        [['prop3', '1', '0'], '0', 'world'],
+        [['prop3', '2', 'key'], 'key', 'val'],
+        [['circ', 'prop1'], 'prop1', 'foo'],
+      ];
+
+      visitorArgs.forEach((args) => {
+        expect(visitorSpy).to.have.been.calledWithMatch(...args);
+      });
+      expect(visitorSpy).to.have.callCount(visitorArgs.length);
+    });
+
+    it('will not recurse into buffers or visit numbers, null, Maps, Sets, or undefined', function () {
+      const b = Buffer.from('buffer content');
+
+      traverse({
+        b,
+        numberThree: 3,
+        numberNine: Number('9'),
+        null: null,
+        undefined,
+        set: new Set(['frog', 'beetle']),
+        map: new Map([['k', 'v']])
+      }, (path, key, value) => {
+        visitorSpy(Array.from(path), key, value);
+      });
+
+      expect(visitorSpy).to.have.been.calledWithMatch(['b'], 'b', b).and.have.callCount(1);
+    });
+
+    it('visits and traverses objects created by Object.create(null)', function () {
+      const o = Object.create(null);
+      o.foo = 'bar';
+      o.x = Object.assign(Object.create(null), { abc: 'xyz' });
+
+      traverse(o, (path, key, value) => {
+        visitorSpy(Array.from(path), key, value);
+      });
+
+      [
+        [['foo'], 'foo', 'bar'],
+        [['x'], 'x', { abc: 'xyz' }],
+        [['x', 'abc'], 'abc', 'xyz']
+      ].forEach((args) => {
+        expect(visitorSpy).to.have.been.calledWithMatch(...args);
+      });
+    });
+
+
+    it('halts when callback returns `false`', function () {
+      traverse({ values: ['one', 'two'] }, (path, key, value, obj) => {
+        visitorSpy();
+        return false;
+      });
+
+      expect(visitorSpy).to.have.callCount(1);
+    });
+  });
+});

package/lib/dataflow/sources/index.test.js

@@ -0,0 +1,58 @@
+'use strict';
+
+const { expect } = require('chai');
+const proxyquire = require('proxyquire');
+const mocks = require('@contrast/test/mocks');
+
+const moduleMock = (moduleName, mock) => (deps) => {
+  deps.assess.dataflow.sources[moduleName] = mock[moduleName];
+};
+
+describe('assess dataflow sources', function () {
+  let core, sourcesMock, sourcesModule, modulesWithInstall;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.assess = mocks.assess();
+    core.logger = mocks.logger();
+    sourcesMock = core.assess.dataflow.sources;
+    sourcesModule = proxyquire('.', {
+      './install/http': moduleMock('httpSourcesInstr', sourcesMock),
+      './install/express': moduleMock('expressInstrumentation', sourcesMock),
+      './install/fastify': moduleMock('fastifyInstrumentation', sourcesMock),
+      './install/hapi': moduleMock('hapiInstrumentation', sourcesMock),
+      './install/koa': moduleMock('koaInstrumentation', sourcesMock),
+      './install/restify': moduleMock('restifyInstrumentation', sourcesMock),
+      './install/body-parser1': moduleMock('bodyParser1Instrumentation', sourcesMock),
+      './install/cookie-parser1': moduleMock('cookieParser1Instrumentation', sourcesMock),
+      './install/busboy': moduleMock('busboyInstrumentation', sourcesMock),
+      './install/multer1': moduleMock('multer1Instrumentation', sourcesMock),
+      './install/formidable1': moduleMock('formidable1Instrumentation', sourcesMock),
+      './install/qs6': moduleMock('qs6Instrumentation', sourcesMock),
+      './install/querystring': moduleMock('querystringInstrumentation', sourcesMock),
+    });
+    modulesWithInstall = [
+      'httpSourcesInstr',
+      'expressInstrumentation',
+      'fastifyInstrumentation',
+      'hapiInstrumentation',
+      'koaInstrumentation',
+      'restifyInstrumentation',
+      'bodyParser1Instrumentation',
+      'busboyInstrumentation',
+      'multer1Instrumentation',
+      'cookieParser1Instrumentation',
+      'formidable1Instrumentation',
+      'qs6Instrumentation',
+      'querystringInstrumentation',
+    ];
+  });
+
+  it('installs the components', function () {
+    sourcesModule(core).install();
+    modulesWithInstall.forEach((module) => {
+      expect(sourcesMock[module].install).to.have.been.calledOnce;
+    });
+  });
+});
+