@contrast/assess 1.31.0 → 1.33.0

package/lib/dataflow/sources/install/koa/koa2.test.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const koaInstr = require('./koa2');
+
+describe('assess dataflow  koa v2.x', function () {
+  let core,
+    simulateRequestScope,
+    koaMock,
+    nextStub,
+    query,
+    sources;
+
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sources = core.assess.dataflow.sources;
+    sinon.spy(sources, 'handle');
+    sinon.spy(core.patcher, 'patch');
+
+    query = { parameter: 'parsed-query' };
+    koaMock = {
+      prototype: {
+        middleware: [],
+        use: (newMiddleware) => {
+          newMiddleware && koaMock.prototype.middleware && koaMock.prototype.middleware.push(newMiddleware);
+        },
+      }
+    };
+
+    nextStub = sinon.stub();
+
+    koaInstr(core).install();
+    core.depHooks.resolve.yield(koaMock);
+    core.patcher.patch.resetHistory();
+  });
+
+  it('calls patcher for every necessary instrumentation', function () {
+    core.depHooks.resolve.yield(koaMock);
+
+    expect(core.patcher.patch).to.have.been.calledOnce;
+    expect(core.patcher.patch).to.have.been.calledWithMatch(koaMock.prototype, 'use', {
+      name: 'Koa.Application',
+      patchType: 'assess-dataflow-source',
+      pre: sinon.match.func
+    });
+  });
+
+  describe('contrastStartMiddleware', function () {
+    it('successfully injects contrastMiddleware', function () {
+      koaMock.prototype.use('test');
+
+      expect(koaMock.prototype.middleware.length).to.equal(2);
+      expect(koaMock.prototype.middleware[0]._isContrastStartMiddleware).to.be.true;
+    });
+
+    it('does not inject contrastMiddleware if there is one already injected', function () {
+      koaMock.prototype.middleware.push({ _isContrastStartMiddleware: true });
+      koaMock.prototype.use();
+
+      expect(koaMock.prototype.middleware.length).to.equal(1);
+    });
+
+    it('calls `.handle` if there is query on the ctx for `contrastStartMiddleware`', function () {
+      koaMock.prototype.use();
+
+      const contrastStartMiddleware = koaMock.prototype.middleware[0];
+      let sourceContext;
+
+      simulateRequestScope(() => {
+        contrastStartMiddleware({ query }, nextStub);
+
+        sourceContext = core.scopes.sources.getStore()?.assess;
+      });
+
+      expect(nextStub).to.have.been.calledOnce;
+      expect(sources.handle).to.have.been.calledOnce;
+      expect(sources.handle).to.have.been.calledWithMatch({
+        context: 'ctx.query',
+        name: 'Koa.Application',
+        stacktraceOpts: {
+          constructorOpt: sinon.match.func,
+        },
+        inputType: InputType.QUERYSTRING,
+        data: { parameter: 'parsed-query' },
+        sourceContext
+      });
+    });
+
+    it('does not call `.handle` if there is query on the ctx for `contrastStartMiddleware`, but we have already analyzed it', function () {
+      koaMock.prototype.use();
+
+      const contrastStartMiddleware = koaMock.prototype.middleware[0];
+
+      simulateRequestScope(() => {
+        const sourceContext = core.scopes.sources.getStore()?.assess;
+        sourceContext.parsedQuery = 'analyzed-query';
+        contrastStartMiddleware({ query }, nextStub);
+      });
+
+      expect(nextStub).to.have.been.calledOnce;
+      expect(sources.handle).not.to.have.been.called;
+    });
+
+    it('does not call `.handle` if there is no context', function () {
+      koaMock.prototype.use();
+
+      const contrastStartMiddleware = koaMock.prototype.middleware[0];
+
+      simulateRequestScope(() => {
+        contrastStartMiddleware({ query }, nextStub);
+      }, {});
+
+      expect(nextStub).to.have.been.calledOnce;
+      expect(sources.handle).not.to.have.been.called;
+    });
+
+    it('handles a case with an error in the `.handle` method', function () {
+      koaMock.prototype.use();
+
+      const err = new Error('test');
+      const contrastStartMiddleware = koaMock.prototype.middleware[0];
+
+      core.assess.dataflow.sources.handle = () => {
+        throw err;
+      };
+
+      simulateRequestScope(() => {
+        contrastStartMiddleware({ query }, nextStub);
+      });
+
+      expect(core.logger.error).to.have.been.called;
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:Koa.Application' },
+        'unable to handle Koa source',
+      );
+      expect(nextStub).to.have.been.calledOnce;
+      expect(nextStub).not.to.have.been.calledWith(err);
+    });
+  });
+});

package/lib/dataflow/sources/install/multer1.test.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const multer = require('./multer1');
+
+describe('assess dataflow sources multer', function () {
+  let core,
+    simulateRequestScope,
+    multerMakeMiddlewareMock,
+    multerMiddlewareMock;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sinon.spy(core.patcher, 'patch');
+
+    core.assess.dataflow.sources.handle = sinon.stub();
+
+    multerMakeMiddlewareMock = function () {
+      return multerMiddlewareMock;
+    };
+
+    multerMiddlewareMock = function (req, res, next) {
+      next();
+    };
+
+    multer(core).install();
+
+    const [patchedFunction] = core.depHooks.resolve
+      .withArgs({ name: 'multer', file: 'lib/make-middleware.js' })
+      .yield(multerMakeMiddlewareMock);
+    multerMakeMiddlewareMock = patchedFunction;
+  });
+
+  it('skip instrumentation if it is out of scope', function () {
+    multerMakeMiddlewareMock()({}, {}, () => ({}));
+    expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+  });
+
+  it('skip instrumentation if there are no files ', function () {
+    simulateRequestScope(() => {
+      const nextFunction = sinon.stub();
+      const req = {};
+      const res = {};
+
+      multerMakeMiddlewareMock()(req, res, nextFunction);
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+      expect(nextFunction).to.have.been.called;
+    });
+  });
+
+  it('handle sources', function () {
+    simulateRequestScope(() => {
+      const nextFunction = sinon.stub();
+      const file = {
+        property: 'file',
+      };
+      const files = [
+        {
+          property: 'files.0',
+        },
+        {
+          property: 'files.1',
+        },
+      ];
+
+      const body = {
+        name: 'John'
+      };
+
+      const req = {
+        file,
+        files,
+        body,
+      };
+      const res = {};
+
+      multerMakeMiddlewareMock()(req, res, nextFunction);
+
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+        context: 'req',
+        data: req,
+        keys: ['file'],
+        name: 'multer',
+        inputType: InputType.BODY,
+      });
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+        context: 'req.files',
+        data: files[0],
+        keys: [0],
+        name: 'multer',
+        inputType: InputType.BODY,
+      });
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+        context: 'req.files',
+        data: files[1],
+        keys: [1],
+        name: 'multer',
+        inputType: InputType.BODY,
+      });
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
+        context: 'req',
+        data: req,
+        keys: ['body'],
+        name: 'multer',
+        inputType: InputType.BODY,
+      });
+      expect(nextFunction).to.have.been.called;
+    });
+  });
+
+  it('should log error if there is an issue handling sources', function () {
+    simulateRequestScope(() => {
+      const nextFunction = sinon.stub();
+      const file = {
+        property: 'foo',
+      };
+      const req = { file };
+      const res = {};
+      const err = new Error();
+
+      core.assess.dataflow.sources.handle.callsFake(() => {
+        throw err;
+      });
+
+      multerMakeMiddlewareMock()(req, res, nextFunction);
+
+      expect(
+        core.assess.dataflow.sources.handle,
+      ).to.have.been.calledWithMatch({
+        context: 'req',
+        data: { file },
+        keys: ['file'],
+        name: 'multer',
+        inputType: InputType.BODY,
+      });
+
+      expect(core.logger.error).to.have.been.calledWith({ err }, 'error handling multer Assess dataflow %s.%s source', 'req', 'file');
+      expect(nextFunction).to.have.been.called;
+    });
+  });
+});

package/lib/dataflow/sources/install/qs6.test.js

@@ -0,0 +1,131 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+const qsInstr = require('./qs6');
+
+describe('assess dataflow sources qs v6.x', function () {
+  let core, simulateRequestScope, qsMock, patchedQs, query, sources;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sources = core.assess.dataflow.sources;
+    sinon.spy(sources, 'handle');
+
+    query = 'querystring';
+    qsMock = {
+      parse: (query) => ({ query } || {})
+    };
+    sinon.spy(core.patcher, 'patch');
+
+    qsInstr(core).install();
+    patchedQs = core.depHooks.resolve.yield(qsMock)[0];
+    core.patcher.patch.resetHistory();
+  });
+
+  it('calls patcher on the `.parse` method', function () {
+    core.depHooks.resolve.yield(qsMock);
+
+    expect(core.patcher.patch).to.have.been.calledOnce;
+    expect(core.patcher.patch).to.have.been.calledWithMatch(qsMock, 'parse', {
+      name: 'qs.parse',
+      patchType: 'assess-dataflow-source',
+      post: sinon.match.func
+    });
+  });
+
+  it('calls `.handle` when parsing is successful, in right context and with reqData.queries present', function () {
+    let sourceContext;
+
+    simulateRequestScope(() => {
+      sourceContext = core.scopes.sources.getStore()?.assess;
+
+      Object.assign(sourceContext.reqData, {
+        queries: 'querystring'
+      });
+      patchedQs.parse(query);
+    });
+
+    expect(sources.handle).to.have.been.calledOnce;
+    expect(sources.handle).to.have.been.calledWithMatch({
+      context: 'req.query',
+      name: 'qs.parse',
+      stacktraceOpts: {
+        constructorOpt: sinon.match.func,
+      },
+      inputType: InputType.QUERYSTRING,
+      data: { query: 'querystring' },
+      sourceContext
+    });
+  });
+
+  it('does not call `.handle` when parsing is successful, in right context but with reqData.queries not present', function () {
+    simulateRequestScope(() => {
+      patchedQs.parse(query);
+    });
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(core.logger.debug).not.to.have.been.called;
+  });
+
+  it('does not call `.handle` when not in context', function () {
+    simulateRequestScope(() => {
+      patchedQs.parse(query);
+    }, {});
+
+    expect(sources.handle).not.to.have.been.called;
+  });
+
+  it('does not call `.handle` when the values are already tracked', function () {
+    simulateRequestScope(() => {
+      const sourceContext = core.scopes.sources.getStore()?.assess;
+      sourceContext.parsedQuery = true;
+
+      patchedQs.parse(query);
+    });
+
+    expect(sources.handle).not.to.have.been.called;
+    expect(core.logger.trace).to.have.been.calledWith(
+      { inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:qs.parse' },
+      'values already tracked',
+    );
+  });
+
+  it('does not call `.handle` when `qs` does not return a result', function () {
+    simulateRequestScope(() => {
+      const sourceContext = core.scopes.sources.getStore()?.assess;
+
+      Object.assign(sourceContext.reqData, {
+        queries: 'querystring'
+      });
+      patchedQs.parse(null);
+    });
+
+    expect(sources.handle).not.to.have.been.called;
+  });
+
+  it('handles a case with an error in the `.handle` method', function () {
+    const err = new Error('test');
+
+    core.assess.dataflow.sources.handle = () => {
+      throw err;
+    };
+
+    simulateRequestScope(() => {
+      const sourceContext = core.scopes.sources.getStore()?.assess;
+
+      Object.assign(sourceContext.reqData, {
+        queries: 'querystring'
+      });
+      patchedQs.parse(query);
+    });
+
+    expect(core.logger.error).to.have.been.calledWith(
+      { err, inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:qs.parse' },
+      'unable to handle source',
+    );
+  });
+});

package/lib/dataflow/sources/install/querystring.test.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const { InputType } = require('@contrast/common');
+
+describe('assess dataflow sources querystring', function () {
+  let core, simulateRequestScope, querystring;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+
+    sinon.stub(core.assess.dataflow.sources, 'handle');
+
+    const querystringMock = {
+      parse: (query) => ({ query })
+    };
+
+    require('./querystring')(core).install();
+    querystring = core.depHooks.resolve.yield(querystringMock)[0];
+  });
+
+  it('calls `.handle` when parsing is successful, in right context and with reqData.queries present', function () {
+    simulateRequestScope(() => {
+      querystring.parse('query');
+
+      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
+        context: 'req.query',
+        name: 'querystring.parse',
+        stacktraceOpts: {
+          constructorOpt: sinon.match.func,
+          prependFrames: sinon.match.array,
+        },
+        inputType: InputType.QUERYSTRING,
+        data: { query: 'query' },
+        sourceContext: core.scopes.sources.getStore().assess
+      });
+    }, { assess: { reqData: { queries: 'query' } } });
+  });
+
+  it('does not call `.handle` when parsing is successful, in right context but without matching reqData.queries', function () {
+    simulateRequestScope(() => {
+      querystring.parse('query1');
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+    }, { assess: { reqData: { queries: 'query2' } } });
+  });
+
+  it('does not call `.handle` when not in context', function () {
+    simulateRequestScope(() => {
+      querystring.parse('query');
+
+      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+    }, {});
+  });
+
+  it('does not call `.handle` when the values are already tracked', function () {
+    simulateRequestScope(() => {
+      querystring.parse('query');
+
+      expect(core.logger.trace).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:querystring.parse' },
+        'values already tracked'
+      );
+    }, { assess: { parsedQuery: true } });
+  });
+
+  it('handles a case with an error in the `.handle` method', function () {
+    const err = new Error('test');
+    core.assess.dataflow.sources.handle.throws(err);
+
+    simulateRequestScope(() => {
+      querystring.parse('query');
+
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, funcKey: 'assess-dataflow-source:querystring.parse' },
+        'unable to handle source'
+      );
+    }, { assess: { reqData: { queries: 'query' } } });
+  });
+});

package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.test.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const sinon = require('sinon');
+const { expect } = require('chai');
+const { InputType } = require('@contrast/common');
+const { initAssessFixture } = require('@contrast/test/fixtures');
+const init = require('./fieldedTextBodyParser');
+
+describe('assess dataflow sources restify fieldedTextBodyParser', function () {
+  let core, simulateRequestScope, handle, middleware, req, res, next;
+
+  beforeEach(function () {
+    ({ core, simulateRequestScope } = initAssessFixture());
+    handle = sinon.stub(core.assess.dataflow.sources, 'handle');
+
+    let fieldedTextBodyParserStub = sinon.stub().returns(sinon.stub().callsArg(2));
+
+    req = {};
+    res = {};
+    next = sinon.stub();
+
+    core.depHooks.resolve
+      .withArgs({ name: 'restify', file: 'lib/plugins/fieldedTextBodyParser.js', version: '>=8' })
+      .callsFake((_, cb) => {
+        fieldedTextBodyParserStub = cb(fieldedTextBodyParserStub);
+      });
+
+    init(core).install();
+    middleware = fieldedTextBodyParserStub();
+  });
+
+  it('does not call `handle` when not in context', function () {
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(handle).not.to.have.been.called;
+      expect(core.logger.error).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:restify.plugins.fieldedTextBodyParser.parseFieldedText' },
+        'unable to handle source. Missing `sourceContext`'
+      );
+    }, {});
+  });
+
+  it('does not call `handle` when body is already tracked', function () {
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(handle).not.to.have.been.called;
+      expect(core.logger.trace).to.have.been.calledWith(
+        { funcKey: 'assess-dataflow-source:restify.plugins.fieldedTextBodyParser.parseFieldedText' },
+        'values already tracked'
+      );
+    }, { assess: { parsedBody: true } });
+  });
+
+  it('calls `handle` appropriately', function () {
+    req.body = [{ foo: 'bar' }];
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(handle).to.have.been.calledWith({
+        context: 'req.body',
+        data: req.body,
+        inputType: InputType.BODY,
+        name: 'restify.plugins.fieldedTextBodyParser.parseFieldedText',
+        stacktraceOpts: {
+          constructorOpt: sinon.match.func,
+        },
+        sourceContext: sinon.match.object,
+      });
+    });
+  });
+
+  it('logs errors in the `handle` method', function () {
+    const err = new Error('yikes!');
+    handle.throws(err);
+
+    simulateRequestScope(() => {
+      middleware(req, res, next);
+
+      expect(core.logger.error).to.have.been.calledWith(
+        { err, funcKey: 'assess-dataflow-source:restify.plugins.fieldedTextBodyParser.parseFieldedText' },
+        'unable to handle Restify source',
+      );
+    });
+  });
+});

package/lib/dataflow/sources/install/restify/index.test.js

@@ -0,0 +1,38 @@
+'use strict';
+
+const { expect } = require('chai');
+const proxyquire = require('proxyquire');
+const mocks = require('@contrast/test/mocks');
+
+const moduleMock = (moduleName, mock) => (deps) => {
+  deps.assess.dataflow.sources.restifyInstrumentation[moduleName] = mock[moduleName];
+};
+
+describe('assess dataflow sources restify', function () {
+  let core, restifyInstrumentation, init, modules;
+
+  beforeEach(function () {
+    core = mocks.core();
+    core.assess = mocks.assess();
+    restifyInstrumentation = core.assess.dataflow.sources.restifyInstrumentation;
+    init = proxyquire('.', {
+      './fieldedTextBodyParser': moduleMock('fieldedTextBodyParser', restifyInstrumentation),
+      './jsonBodyParser': moduleMock('jsonBodyParser', restifyInstrumentation),
+      './router': moduleMock('router', restifyInstrumentation),
+    });
+    modules = [
+      'fieldedTextBodyParser',
+      'jsonBodyParser',
+      'router',
+    ];
+  });
+
+  it('installs the components', function () {
+    init(core).install();
+
+    modules.forEach((module) => {
+      expect(restifyInstrumentation[module].install).to.have.been.calledOnce;
+    });
+  });
+});
+