@contrast/assess 1.33.0 → 1.33.1

package/lib/dataflow/propagation/index.js

@@ -34,6 +34,7 @@ module.exports = function(core) {
   require('./install/encode-uri')(core);
   require('./install/escape-html')(core);
   require('./install/escape')(core);
+  require('./install/fastify-send')(core);
   require('./install/handlebars-utils-escape-expression')(core);
   require('./install/isnumeric-0')(core);
   require('./install/mustache-escape')(core);

package/lib/dataflow/propagation/install/fastify-send.js

@@ -0,0 +1,47 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+
+const { patchType } = require('../common');
+const { StringPrototypeSlice } = require('@contrast/common');
+
+module.exports = function (core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+  } = core;
+
+  return core.assess.dataflow.propagation.fastifySend = {
+    install() {
+      depHooks.resolve({ name: '@fastify/send', file: 'lib/SendStream.js' }, (_SendStream) => {
+        patcher.patch(_SendStream.prototype, 'sendFile', {
+          name: '@fastify/send/lib/SendStream.js',
+          patchType,
+          pre(data) {
+            const { args } = data;
+
+            if (!sources.getStore()?.assess || instrumentation.isLocked()) {
+              return;
+            }
+
+            const untrackedPath = StringPrototypeSlice.call(` ${args[0]}`, 1);
+            args[0] = untrackedPath;
+          },
+        });
+      });
+    }
+  };
+};

package/lib/dataflow/propagation/install/fastify-send.test.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const { expect } = require('chai');
+const sinon = require('sinon');
+const { initAssessFixture } = require('../../../../../test/fixtures');
+
+describe('assess @fastify/send', function() {
+  let core, simulateRequestScope, sendFileStub, SendStreamMock, trackString, tracker;
+
+  beforeEach(function() {
+    ({
+      core,
+      simulateRequestScope,
+      trackString
+    } = initAssessFixture());
+    tracker = core.assess.dataflow.tracker;
+    core.assess.dataflow.propagation.fastifySend.install();
+
+    sendFileStub = sinon.stub();
+    SendStreamMock = class SendStream {
+      sendFile(path) {
+        sendFileStub(path);
+      }
+    };
+    core.depHooks.resolve
+      .withArgs({ name: '@fastify/send', file: 'lib/SendStream.js' })
+      .yield(SendStreamMock);
+  });
+
+  afterEach(function() {
+    sinon.resetHistory();
+  });
+
+  it('should create an untagged copy of the string to pass to original sendFile', function() {
+    simulateRequestScope(() => {
+      const path = trackString('foo');
+      const s = new SendStreamMock();
+      s.sendFile(path);
+
+      expect(sendFileStub).to.have.been.calledWith(path);
+      expect(tracker.getData(sendFileStub.getCall(0).firstArg)).to.be.null;
+    });
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.33.0",
+  "version": "1.33.1",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,7 +18,14 @@
   },
   "dependencies": {
     "@contrast/common": "1.24.0",
+    "@contrast/config": "1.31.0",
+    "@contrast/core": "1.35.1",
+    "@contrast/dep-hooks": "1.3.4",
     "@contrast/distringuish": "^5.0.0",
-    "@contrast/scopes": "1.4.1"
+    "@contrast/instrumentation": "1.13.1",
+    "@contrast/logger": "1.8.5",
+    "@contrast/patcher": "1.7.5",
+    "@contrast/rewriter": "1.11.1",
+    "@contrast/scopes": "1.4.2"
   }
 }