@contrast/assess 1.32.0 → 1.33.1

package/lib/dataflow/propagation/index.js

@@ -34,6 +34,7 @@ module.exports = function(core) {
   require('./install/encode-uri')(core);
   require('./install/escape-html')(core);
   require('./install/escape')(core);
+  require('./install/fastify-send')(core);
   require('./install/handlebars-utils-escape-expression')(core);
   require('./install/isnumeric-0')(core);
   require('./install/mustache-escape')(core);

package/lib/dataflow/propagation/install/fastify-send.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { patchType } = require('../common');
+const { StringPrototypeSlice } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+  } = core;
+
+  return core.assess.dataflow.propagation.fastifySend = {
+    install() {
+      depHooks.resolve({ name: '@fastify/send', file: 'lib/SendStream.js' }, (_SendStream) => {
+        patcher.patch(_SendStream.prototype, 'sendFile', {
+          name: '@fastify/send/lib/SendStream.js',
+          patchType,
+          pre(data) {
+            const { args } = data;
+
+            if (!sources.getStore()?.assess || instrumentation.isLocked()) {
+              return;
+            }
+
+            const untrackedPath = StringPrototypeSlice.call(` ${args[0]}`, 1);
+            args[0] = untrackedPath;
+          },
+        });
+      });
+    }
+  };
+};

package/lib/dataflow/propagation/install/fastify-send.test.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('../../../../../test/fixtures');
+
+describe('assess @fastify/send', function() {
+  let core, simulateRequestScope, sendFileStub, SendStreamMock, trackString, tracker;
+
+  beforeEach(function() {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.fastifySend.install();
+
+    sendFileStub = sinon.stub();
+    SendStreamMock = class SendStream {
+      sendFile(path) {
+        sendFileStub(path);
+      }
+    };
+    core.depHooks.resolve
+      .withArgs({ name: '@fastify/send', file: 'lib/SendStream.js' })
+      .yield(SendStreamMock);
+  });
+
+  afterEach(function() {
+    sinon.resetHistory();
+  });
+
+  it('should create an untagged copy of the string to pass to original sendFile', function() {
+    simulateRequestScope(() => {
+      const path = trackString('foo');
+      const s = new SendStreamMock();
+      s.sendFile(path);
+
+      expect(sendFileStub).to.have.been.calledWith(path);
+      expect(tracker.getData(sendFileStub.getCall(0).firstArg)).to.be.null;
+    });
+  });
+});

package/lib/dataflow/tracker.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const distringuish = require('@contrast/distringuish');
-const { isString } = require('@contrast/common');
+const { BufferPrototypeToString, BufferFrom, isString } = require('@contrast/common');
 
 module.exports = function tracker(core) {
   const {
@@ -58,6 +58,11 @@ module.exports = function tracker(core) {
     }
 
     if (typeof value === 'string') {
+      // todo: don't track string representations of numbers
+      // if (!isNaN(+value)) {
+      //   return { extern: null };
+      // }
+
       if (distringuish.getProperties(value)) {
         const err = new Error();
         logger.error({ err, value }, 'tracker.track called with a string value that is already tracked');
@@ -68,7 +73,7 @@ module.exports = function tracker(core) {
 
       if (extern == 2) {
         // Try work-around for some wrong/unknown encoding
-        extern = distringuish.externalize(Buffer.from(value).toString());
+        extern = distringuish.externalize(BufferPrototypeToString.call(BufferFrom(value)));
       }
 
       if (!extern || !isString(extern)) {

package/lib/get-source-context.js

@@ -37,9 +37,18 @@ module.exports = function(core) {
    */
   return core.assess.getSourceContext = function getSourceContext(type, ...rest) {
     const ctx = sources.getStore()?.assess;
-
+    // <unsafe>
+    // This method is expected to be called by all Assess instrumentation components prior to doing work.
+    // Until we check policy, and whether instrumentation is locked, any instrumentation that is called before
+    // the </unsafe> section below will result in infinite recursion.
+    //
+    // E.g. Uncommenting any line below will cause a stack overflow:
+    // 'asdf'.concat()
+    // console.log() // even though this is deadzoned, we haven't checked whether instrumentation is locked yet
+    //
     // policy will not exist if assess is altogether disabled for the active request e.g. url exclusion
     if (!ctx?.policy || instrumentation.isLocked()) return null;
+    // </unsafe> but still be careful
 
     switch (type) {
       case InstrumentationType.PROPAGATOR: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.32.0",
+  "version": "1.33.1",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -17,8 +17,15 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.23.0",
+    "@contrast/common": "1.24.0",
+    "@contrast/config": "1.31.0",
+    "@contrast/core": "1.35.1",
+    "@contrast/dep-hooks": "1.3.4",
     "@contrast/distringuish": "^5.0.0",
-    "@contrast/scopes": "1.4.1"
+    "@contrast/instrumentation": "1.13.1",
+    "@contrast/logger": "1.8.5",
+    "@contrast/patcher": "1.7.5",
+    "@contrast/rewriter": "1.11.1",
+    "@contrast/scopes": "1.4.2"
   }
 }