@contrast/assess 1.31.0 → 1.33.0

package/lib/dataflow/sources/install/body-parser1.test.js

@@ -0,0 +1,248 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+
+describe('assess dataflow sources body-parser v1', function () {
+  let core, simulateRequestScope, req, res, next, bodyParser;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+    req = {};
+    res = {};
+    next = sinon.stub();
+
+    sinon.stub(core.assess.dataflow.sources, 'handle');
+
+    const bodyParserMock = (body) => (req, res, next) => {
+      req.body = body;
+      next();
+    };
+    bodyParserMock.json = (body) => (req, res, next) => {
+      req.body = body;
+      next();
+    };
+    bodyParserMock.raw = (body) => (req, res, next) => {
+      req.body = body;
+      next();
+    };
+    bodyParserMock.text = (body) => (req, res, next) => {
+      req.body = body;
+      next();
+    };
+    bodyParserMock.urlencoded = (body) => (req, res, next) => {
+      req.body = body;
+      next();
+    };
+
+    require('./body-parser1')(core).install();
+    bodyParser = core.depHooks.resolve.yield(bodyParserMock)[0];
+  });
+
+  // tests are not properly patching the default function
+  describe('bodyParser', function () {
+    it('handles a json request body as expected', function () {
+      const body = { foo: 'bar' };
+      const middleware = bodyParser(body);
+      req.headers = { 'content-type': 'application/json' };
+
+      simulateRequestScope(() => {
+        middleware(req, res, next);
+
+        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+          context: 'req.body',
+          name: 'body-parser.bodyParser',
+          inputType: InputType.JSON_VALUE,
+          stacktraceOpts: {
+            constructorOpt: sinon.match.func,
+          },
+          data: body,
+          sourceContext: core.scopes.sources.getStore().assess
+        });
+      });
+    });
+
+    it('handles a urlencoded request body as expected', function () {
+      const body = { foo: 'bar' };
+      const middleware = bodyParser(body);
+      req.headers = { 'content-type': 'application/x-www-form-urlencoded' };
+
+      simulateRequestScope(() => {
+        middleware(req, res, next);
+
+        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+          context: 'req.body',
+          name: 'body-parser.bodyParser',
+          inputType: InputType.PARAMETER_VALUE,
+          stacktraceOpts: {
+            constructorOpt: sinon.match.func,
+          },
+          data: body,
+          sourceContext: core.scopes.sources.getStore().assess
+        });
+      });
+    });
+
+    it('handles an unknown format request body as expected', function () {
+      const body = 'text';
+      const middleware = bodyParser(body);
+
+      simulateRequestScope(() => {
+        middleware(req, res, next);
+
+        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+          context: 'req',
+          name: 'body-parser.bodyParser',
+          inputType: InputType.BODY,
+          stacktraceOpts: {
+            constructorOpt: sinon.match.func,
+          },
+          data: { body },
+          sourceContext: core.scopes.sources.getStore().assess
+        });
+      });
+    });
+
+    it('does not handle the request when not in context', function () {
+      const middleware = bodyParser('text');
+
+      simulateRequestScope(() => {
+        middleware(req, res, next);
+
+        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        expect(core.logger.error).to.have.been.calledWith(
+          { funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
+          'unable to handle source. Missing `sourceContext`'
+        );
+      }, {});
+    });
+
+    it('does not handle the request when already tracked', function () {
+      const middleware = bodyParser('text');
+
+      simulateRequestScope(() => {
+        // run twice
+        middleware(req, res, next);
+        expect(core.assess.dataflow.sources.handle).to.have.been.calledOnce;
+        middleware(req, res, next);
+
+        expect(core.assess.dataflow.sources.handle).to.have.been.calledOnce;
+        expect(core.logger.trace).to.have.been.calledWith(
+          { funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
+          'values already tracked',
+        );
+      });
+    });
+
+    it('logs errors in the handle method', function () {
+      const middleware = bodyParser('text');
+      const err = new Error('yikes!');
+      core.assess.dataflow.sources.handle.throws(err);
+      simulateRequestScope(() => {
+        middleware(req, res, next);
+
+        expect(core.logger.error).to.have.been.calledWith(
+          { err, funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
+          'unable to handle source',
+        );
+      });
+    });
+  });
+
+  [
+    {
+      method: 'json',
+      body: { json: 'body' },
+      inputType: InputType.JSON_VALUE,
+      context: 'req.body',
+      data: { json: 'body' },
+    },
+    {
+      method: 'raw',
+      body: Buffer.from('raw'),
+      inputType: InputType.BODY,
+      context: 'req',
+      data: { body: Buffer.from('raw') }
+    },
+    {
+      method: 'text',
+      body: 'text',
+      inputType: InputType.BODY,
+      context: 'req',
+      data: { body: 'text' }
+    },
+    {
+      method: 'urlencoded',
+      body: { urlencoded: 'yes' },
+      inputType: InputType.PARAMETER_VALUE,
+      context: 'req.body',
+      data: { urlencoded: 'yes' }
+    },
+  ].forEach(({ method, body, inputType, context, data }) => {
+    describe(`bodyParser.${method}`, function () {
+      let middleware;
+
+      beforeEach(function () {
+        middleware = bodyParser[method](body);
+      });
+
+      it('handles the request body as expected', function () {
+        simulateRequestScope(() => {
+          middleware(req, res, next);
+
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+            context,
+            name: `body-parser.${method}.${method}Parser`,
+            inputType,
+            stacktraceOpts: {
+              constructorOpt: sinon.match.func,
+            },
+            data,
+            sourceContext: core.scopes.sources.getStore().assess
+          });
+        });
+      });
+
+      it('does not handle the request when not in context', function () {
+        simulateRequestScope(() => {
+          middleware(req, res, next);
+
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+          expect(core.logger.error).to.have.been.calledWith(
+            { funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
+            'unable to handle source. Missing `sourceContext`',
+          );
+        }, {});
+      });
+
+      it('does not handle the request when already tracked', function () {
+        simulateRequestScope(() => {
+          core.scopes.sources.getStore().assess.parsedBody = true;
+          middleware(req, res, next);
+
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+          expect(core.logger.trace).to.have.been.calledWith(
+            { funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
+            'values already tracked',
+          );
+        });
+      });
+
+      it('logs errors in the handle method', function () {
+        const err = new Error('yikes!');
+        core.assess.dataflow.sources.handle.throws(err);
+
+        simulateRequestScope(() => {
+          middleware(req, res, next);
+
+          expect(core.logger.error).to.have.been.calledWith(
+            { err, funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
+            'unable to handle source',
+          );
+        });
+      });
+    });
+  });
+});

package/lib/dataflow/sources/install/busboy.test.js

@@ -0,0 +1,152 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const busboyInstr = require('./busboy');
+
+describe('assess dataflow sources busboy', function () {
+  let core, simulateRequestScope, mockBusboy0, mockBusboy1, sources, emitMethodVersions;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    mockBusboy0 = function () { };
+    mockBusboy0.prototype.emit = function () { };
+
+    mockBusboy1 = function () {
+      return {
+        emit() { }
+      };
+    };
+    sinon.spy(mockBusboy0.prototype, 'emit');
+    sinon.spy(core.patcher, 'patch');
+
+    sources = core.assess.dataflow.sources;
+    sinon.spy(sources, 'handle');
+
+    busboyInstr(core).install();
+    core.depHooks.resolve.withArgs({ name: 'busboy', version: '<1.0.0' }).yield(mockBusboy0);
+    core.depHooks.resolve.withArgs({ name: 'busboy', version: '>=1.0.0' }).yield(mockBusboy1);
+    const patchedBusboy1 = core.patcher.patch.getCall(1).returnValue;
+
+    emitMethodVersions = {
+      'v0': mockBusboy0.prototype.emit,
+      'v1': patchedBusboy1().emit
+    };
+  });
+
+  it('calls patcher on the `.emit` method', function () {
+    expect(core.patcher.patch).to.have.been.calledWithMatch(mockBusboy0.prototype, 'emit', {
+      name: 'busboy.prototype.emit',
+      patchType: 'assess-dataflow-source',
+      pre: sinon.match.func
+    });
+
+    expect(core.patcher.patch).to.have.been.calledWithMatch(mockBusboy1, {
+      name: 'busboy',
+      patchType: 'assess-dataflow-source',
+      post: sinon.match.func
+    });
+  });
+
+  [
+    { version: 'v0', finalEvent: 'finish' },
+    { version: 'v1', finalEvent: 'close' }
+  ].forEach(({ version, finalEvent }) => {
+    describe(version, function () {
+      it('calls `.handle` when there are fields of data to be tracked and it is in right context', function () {
+        let sourceContext;
+
+        simulateRequestScope(() => {
+          emitMethodVersions[version]('field', 'field1', 'value1');
+          emitMethodVersions[version]('field', 'field2', 'value2');
+          emitMethodVersions[version](finalEvent);
+
+          sourceContext = core.scopes.sources.getStore()?.assess;
+        });
+
+        expect(sources.handle).to.have.been.calledTwice;
+        expect(sources.handle).to.have.been.calledWithMatch({
+          context: 'req.body',
+          name: 'busboy',
+          stacktraceOpts: {
+            constructorOpt: sinon.match.func,
+            prependFrames: [sinon.match.func],
+          },
+          inputType: InputType.MULTIPART_VALUE,
+          data: { field1: 'value1' },
+          sourceContext
+        });
+        expect(sources.handle).to.have.been.calledWithMatch({
+          context: 'req.body',
+          name: 'busboy',
+          stacktraceOpts: {
+            constructorOpt: sinon.match.func,
+            prependFrames: [sinon.match.func],
+          },
+          inputType: InputType.MULTIPART_VALUE,
+          data: { field2: 'value2' },
+          sourceContext
+        });
+      });
+
+      it('logs an error when `.handle` throws one', function () {
+        const err = new Error('test');
+
+        core.assess.dataflow.sources.handle = () => {
+          throw err;
+        };
+
+        simulateRequestScope(() => {
+          emitMethodVersions[version]('field', 'field1', 'value1');
+          emitMethodVersions[version](finalEvent);
+        });
+
+        expect(core.logger.error).to.have.been.calledOnceWith(
+          { err, inputType: InputType.MULTIPART_VALUE, funcKey: sinon.match.string },
+          'unable to handle source'
+        );
+      });
+
+      it('does not call `.handle` when not in context', function () {
+        simulateRequestScope(() => {
+          emitMethodVersions[version]('field', 'field1', 'value1');
+          emitMethodVersions[version]('field', 'field2', 'value2');
+          emitMethodVersions[version](finalEvent);
+        }, {});
+
+        expect(sources.handle).not.to.have.been.called;
+      });
+
+      it('does not call `.handle` when the values are already tracked', function () {
+        simulateRequestScope(() => {
+          const sourceContext = core.scopes.sources.getStore()?.assess;
+          sourceContext.parsedBody = true;
+
+          emitMethodVersions[version]('field', 'field1', 'value1');
+          emitMethodVersions[version]('field', 'field2', 'value2');
+          emitMethodVersions[version](finalEvent);
+        });
+
+        expect(sources.handle).not.to.have.been.called;
+        expect(core.logger.trace).to.have.been.calledWith(
+          { inputType: InputType.MULTIPART_VALUE, funcKey: sinon.match.string },
+          'values already tracked');
+      });
+
+      it('does not call `.handle` when `.emit` call does not contain field name or data', function () {
+        simulateRequestScope(() => {
+          emitMethodVersions[version]('field', null, 'value1');
+          emitMethodVersions[version]('field', 'field2', null);
+          emitMethodVersions[version](finalEvent);
+        }, {});
+
+        expect(sources.handle).not.to.have.been.called;
+        expect(core.logger.debug).not.to.have.been.called;
+      });
+    });
+  });
+});
+

package/lib/dataflow/sources/install/cookie-parser1.test.js

@@ -0,0 +1,143 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+
+describe('assess dataflow sources cookie-parser v1', function () {
+  let core, simulateRequestScope, req, res, next, cookieParser;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+    req = {};
+    res = {};
+    next = sinon.stub();
+
+    sinon.stub(core.assess.dataflow.sources, 'handle');
+
+    require('./cookie-parser1')(core).install();
+    cookieParser = core.depHooks.resolve.yield(
+      function cookieParser(props = {}) {
+        return function cookieParser(req, res, next) {
+          Object.assign(req, props);
+          next();
+        };
+      }
+    )[0];
+  });
+
+  it('handles cookies as expected', function () {
+    const cookies = { foo: 'bar' };
+    const middleware = cookieParser({ cookies });
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
+        context: 'req.cookies',
+        name: 'cookie-parser.cookieParser',
+        inputType: InputType.COOKIE_VALUE,
+        stacktraceOpts: {
+          constructorOpt: sinon.match.func,
+        },
+        data: cookies,
+        sourceContext: core.scopes.sources.getStore().assess
+      });
+    });
+  });
+
+  it('handles signed cookies as expected', function () {
+    const cookies = { foo: 'bar' };
+    const middleware = cookieParser({ signedCookies: cookies });
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
+        context: 'req.signedCookies',
+        name: 'cookie-parser.cookieParser',
+        inputType: InputType.COOKIE_VALUE,
+        stacktraceOpts: {
+          constructorOpt: sinon.match.func,
+        },
+        data: cookies,
+        sourceContext: core.scopes.sources.getStore().assess
+      });
+    });
+  });
+
+  it('does not handle the request when not in context', function () {
+    const middleware = cookieParser();
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      expect(core.logger.error).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
+        'unable to handle source. Missing `sourceContext`',
+      );
+    }, {});
+  });
+
+  it('does not handle the request when cookies already tracked', function () {
+    const middleware = cookieParser();
+
+    simulateRequestScope(() => {
+      core.scopes.sources.getStore().assess.parsedCookies = true;
+      middleware(req, res, next);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      expect(core.logger.trace).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
+        'cookies already tracked',
+      );
+    });
+  });
+
+  it('does not handle the request when signed cookies already tracked', function () {
+    const middleware = cookieParser();
+
+    simulateRequestScope(() => {
+      core.scopes.sources.getStore().assess.parsedSignedCookies = true;
+      middleware(req, res, next);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      expect(core.logger.trace).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
+        'signedCookies already tracked',
+      );
+    });
+  });
+
+  it('logs errors when handling cookies', function () {
+    const middleware = cookieParser({ cookies: {} });
+    const err = new Error('yikes!');
+    core.assess.dataflow.sources.handle.throws(err);
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
+        'unable to handle source',
+      );
+    });
+  });
+
+  it('logs errors when handling signed cookies', function () {
+    const middleware = cookieParser({ signedCookies: {} });
+    const err = new Error('yikes!');
+    core.assess.dataflow.sources.handle.throws(err);
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
+        'unable to handle source',
+      );
+    });
+  });
+});

package/lib/dataflow/sources/install/express/params.test.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+
+describe('assess dataflow sources express params', function () {
+  let core, simulateRequestScope, Layer, layer;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sinon.stub(core.assess.dataflow.sources, 'handle');
+
+    const LayerMock = sinon.stub();
+    LayerMock.prototype.match = sinon.stub().returns(true);
+
+    require('./params')(core).install();
+    Layer = core.depHooks.resolve.yield(LayerMock)[0];
+    layer = { keys: ['foo'], params: { foo: 'bar' } };
+  });
+
+  it('calls `.handle` when `match` adds params (and keys) to the Layer instance', function () {
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
+        context: 'req.params',
+        name: 'Layer.prototype.match',
+        inputType: InputType.PARAMETER_VALUE,
+        stacktraceOpts: {
+          constructorOpt: sinon.match.func,
+          prependFrames: sinon.match.array,
+        },
+        data: layer.params,
+        sourceContext: core.scopes.sources.getStore().assess
+      });
+    });
+  });
+
+  it('does not call `.handle` when `match` returns false', function () {
+    Layer.prototype.match.returns(false);
+
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+    });
+  });
+
+  it('does not call `.handle` when the layer is missing the expected properties', function () {
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, {}, ['/bar']);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+    });
+  });
+
+  it('does not call `.handle` when `match` adds no params or keys', function () {
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, { keys: [], params: {} }, ['/bar']);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+    });
+  });
+
+  it('does not call `.handle` when not in context', function () {
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      expect(core.logger.error).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+        'unable to handle source. Missing `sourceContext`'
+      );
+    }, {});
+  });
+
+  it('does not call `.handle` when the values are already tracked', function () {
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      expect(core.logger.trace).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+        'values already tracked'
+      );
+    }, { assess: { parsedParams: true } });
+  });
+
+  it('handles a case with an error in the `.handle` method', function () {
+    const err = new Error('test');
+    core.assess.dataflow.sources.handle.throws(err);
+
+    simulateRequestScope(() => {
+      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+        'unable to handle source'
+      );
+    });
+  });
+});