@contrast/assess 1.34.0 → 1.36.0

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -15,17 +15,15 @@
 
 'use strict';
 
-const {
-  DataflowTag: { SQL_ENCODED }
-} = require('@contrast/common');
+const { DataflowTag: { SQL_ENCODED } } = require('@contrast/common');
 const { patchType, createModuleLabel } = require('../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     depHooks,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -41,7 +39,7 @@ module.exports = function(core) {
           patchType,
           post(data) {
             const { args, result, hooked, orig } = data;
-            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+            if (!result || !args[0] || !getSourceContext()) return;
 
             const argInfo = tracker.getData(args[0]);
 

package/lib/dataflow/propagation/install/sql-template-strings.test.js

@@ -80,12 +80,12 @@ describe('assess dataflow propagation sql-template-strings', function () {
     });
   });
 
-  it('will not propagate if there is no assess context', function () {
+  it('will not propagate if there is no assess policy in request context', function () {
     simulateRequestScope(function () {
       const value = trackString('foo');
       const result = mockSqlTemplateStrings.SQL(['foo', value].join());
       expect(tracker.getData(result.strings.toString())).to.be.null;
-    }, {});
+    }, { assess: { policy: null } });
   });
 
   it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/string/concat.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { ArrayPrototypeJoin } = require('@contrast/common');
+const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
 const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'concat', {
         name,
         patchType,
+        usePerf: true,
         post(data) {
           const { obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/concat.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string concat', function () {
   let core, trackString, simulateRequestScope, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -23,6 +24,18 @@ describe('assess dataflow propagation string concat', function () {
     sinon.resetHistory();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   [
     {
       str: 'foo',
@@ -112,12 +125,12 @@ describe('assess dataflow propagation string concat', function () {
     });
   });
 
-  it('will not propagate if there is no assess context', function () {
+  it('will not propagate if there is no assess policy in request context', function () {
     simulateRequestScope(function () {
       const value = trackString('foo');
       const result = value.concat('bar');
       expect(tracker.getData(result)).to.be.null;
-    }, {});
+    }, { assess: { policy: null } });
   });
 
   it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -15,13 +15,14 @@
 
 'use strict';
 
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -35,9 +36,10 @@ module.exports = function(core) {
         patcher.patch(String.prototype, method, {
           name,
           patchType,
+          usePerf: true,
           post(data) {
             const { obj, result, hooked, orig } = data;
-            if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+            if (!result || !getSourceContext(PROPAGATOR)) return;
 
             const objInfo = tracker.getData(obj);
 

package/lib/dataflow/propagation/install/string/format-methods.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string format-methods', function () {
   let core, trackString, simulateRequestScope, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -23,6 +24,18 @@ describe('assess dataflow propagation string format-methods', function () {
     sinon.resetHistory();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   ['toLowerCase', 'toUpperCase', 'toLocaleLowerCase', 'toLocaleUpperCase'].forEach((method) => {
     it(method, function () {
       simulateRequestScope(function () {
@@ -41,12 +54,12 @@ describe('assess dataflow propagation string format-methods', function () {
     });
   });
 
-  it('will not propagate if there is no assess context', function () {
+  it('will not propagate if there is no assess policy in request context', function () {
     simulateRequestScope(function () {
       const value = trackString('foo');
       const result = value.toLowerCase('bar');
       expect(tracker.getData(result)).to.be.null;
-    }, {});
+    }, { assess: { policy: null } });
   });
 
   it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -14,7 +14,6 @@
  */
 
 'use strict';
-
 const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createAppendTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
@@ -62,6 +61,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'anchor', {
         name,
         patchType,
+        usePost: true,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/html-methods.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string html-methods', function () {
   let core, trackString, simulateRequestScope, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -23,6 +24,18 @@ describe('assess dataflow propagation string html-methods', function () {
     sinon.resetHistory();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   [
     {
       method: 'anchor',
@@ -144,12 +157,12 @@ describe('assess dataflow propagation string html-methods', function () {
     });
   });
 
-  it('will not propagate if there is no assess context', function () {
+  it('will not propagate if there is no assess policy in request context', function () {
     simulateRequestScope(function () {
       const value = trackString('foo');
       const result = value.anchor('bar');
       expect(tracker.getData(result)).to.be.null;
-    }, {});
+    }, { assess: { policy: null } });
   });
 
   it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/string/index.js

@@ -15,8 +15,7 @@
 
 'use strict';
 
-const { callChildComponentMethodsSync } = require('@contrast/common');
-const { StringPrototypeSplit } = require('@contrast/common');
+const { callChildComponentMethodsSync, primordials: { StringPrototypeSplit } } = require('@contrast/common');
 const { getAdjustedUntrackedValue } = require('../../../tag-utils');
 
 module.exports = function(core) {
@@ -46,6 +45,7 @@ module.exports = function(core) {
     return patcher.patch(matcherFn, {
       name,
       patchType,
+      usePerf: true,
       pre(data) {
         const { args: origArgs, hooked, orig } = data;
         if (

package/lib/dataflow/propagation/install/string/match-all.js

@@ -36,7 +36,7 @@ module.exports = function(core) {
     objInfo,
     startIdx,
     match,
-    untrackedResult,
+    //untrackedResult,
     metadata,
   }) {
     const tags = createSubsetTags(objInfo.tags, startIdx, match.length);
@@ -75,6 +75,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'matchAll', {
         name,
         patchType,
+        usePerf: true,
         around(origFn, data) {
           const { args, obj, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/string/match-all.test.js

@@ -17,6 +17,7 @@ function createItem(idx, itemValue = [''], input = 'foo', groups = undefined) {
 
 describe('assess dataflow propagation string matchAll', function () {
   let core, simulateRequestScope, trackString, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -38,6 +39,18 @@ describe('assess dataflow propagation string matchAll', function () {
     core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   describe('base cases', function () {
     [
       [],

package/lib/dataflow/propagation/install/string/match.js

@@ -14,15 +14,18 @@
  */
 
 'use strict';
-const { ArrayPrototypeJoin } = require('@contrast/common');
-const { patchType } = require('../../common');
+
+const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
+const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
+    scopes,
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
@@ -76,18 +79,16 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'match', {
         name,
         patchType,
+        usePerf: true,
         around(origFn, data) {
           const { args, obj } = data;
           if (
             !obj ||
             !args.length ||
-            !sources.getStore()?.assess ||
             typeof obj !== 'string' ||
-            instrumentation.isLocked() ||
-            (args.length === 1 && !args[0])
-          )
-            return origFn();
-
+            (args.length === 1 && !args[0]) ||
+            !getSourceContext(PROPAGATOR)
+          ) return origFn();
           const objInfo = tracker.getData(obj);
 
           if (!objInfo) return origFn();
@@ -108,7 +109,7 @@ module.exports = function(core) {
             return origFn();
           }
 
-          const result = (data.result = core.scopes.instrumentation.run(
+          const result = (data.result = scopes.instrumentation.run(
             { lock: true },
             () => origFn()
           ));

package/lib/dataflow/propagation/install/string/match.test.js

@@ -7,6 +7,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string match', function () {
   let core, simulateRequestScope, trackString, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -28,6 +29,18 @@ describe('assess dataflow propagation string match', function () {
     core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   describe('base cases', function () {
     [
       [],

package/lib/dataflow/propagation/install/string/replace.js

@@ -17,9 +17,13 @@
 
 const {
   DataflowTag: { UNTRUSTED },
-  StringPrototypeMatch,
-  ArrayPrototypeJoin,
-  StringPrototypeSubstring,
+  primordials: {
+    StringPrototypeMatch,
+    ArrayPrototypeJoin,
+    ArrayPrototypeSlice,
+    StringPrototypeSubstring,
+    StringPrototypeReplace
+  }
 } = require('@contrast/common');
 const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const {
@@ -45,15 +49,16 @@ module.exports = function(core) {
     const len = args.length;
     const lastEl = args[len - 1];
     const hasNamedGroup = typeof lastEl === 'object';
-    const captureGroups = args.slice(1, hasNamedGroup ? -3 : -2);
+    const captureGroups = ArrayPrototypeSlice.call(args, 1, hasNamedGroup ? -3 : -2);
     const matchIdx = args[hasNamedGroup ? len - 3 : len - 2];
     const str = hasNamedGroup ? args[len - 2] : lastEl;
     const namedGroups = hasNamedGroup ? lastEl : null;
     return { match, captureGroups, matchIdx, str, namedGroups };
   }
 
+  // these functions specifically use the patched versions of Substring so that
+  // the tags are propagated.
   function replaceSpecialCharacters(replacement, { captureGroups, match, str, namedGroups }, replacementType) {
-    const origReplace = patcher.unwrap(String.prototype.replace);
     let ret = replacement;
     [
       {
@@ -79,22 +84,22 @@ module.exports = function(core) {
         if (tracker.getData(replace)) {
           ret = ret.replace(regex, replace);
         } else {
-          ret = origReplace.call(ret, regex, replace);
+          ret = StringPrototypeReplace.call(ret, regex, replace);
         }
       }
     });
 
-    const numberedGroupMatches = replacementType !== 'function' && replacement.match(/\$[1-9][0-9]|\$[1-9]/g);
+    const numberedGroupMatches = replacementType !== 'function' && StringPrototypeMatch.call(replacement, /\$[1-9][0-9]|\$[1-9]/g);
     if (numberedGroupMatches) {
       numberedGroupMatches.forEach((numberedGroup) => {
         const group = Number(StringPrototypeSubstring.call(numberedGroup, 1));
-        ret = origReplace.call(ret, numberedGroup, captureGroups[group - 1] || '');
+        ret = StringPrototypeReplace.call(ret, numberedGroup, captureGroups[group - 1] || '');
       });
     }
 
     if (namedGroups) {
       for (const name in namedGroups) {
-        ret = origReplace.call(ret, `$${name}`, namedGroups[name]);
+        ret = StringPrototypeReplace.call(ret, `$${name}`, namedGroups[name]);
       }
     }
 
@@ -145,6 +150,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'replace', {
         name,
         patchType,
+        usePerf: true,
         pre(data) {
           if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/string/replace.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string replace', function () {
   let core, simulateRequestScope, trackString, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -24,6 +25,18 @@ describe('assess dataflow propagation string replace', function () {
     core.assess.dataflow.propagation.stringInstrumentation.replace.uninstall();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   ['string', 'function'].forEach((replacerType) => {
     function getReplacement(replacerType, replacement) {
       return replacerType === 'function' ? () => replacement : replacement;

package/lib/dataflow/propagation/install/string/slice.js

@@ -13,7 +13,7 @@
  * way not consistent with the End User License Agreement.
  */
 'use strict';
-const { ArrayPrototypeJoin } = require('@contrast/common');
+const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
 const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
@@ -54,6 +54,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'slice', {
         name,
         patchType,
+        usePerf: true,
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/slice.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string slice', function () {
   let core, tracker, trackString, simulateRequestScope;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -23,6 +24,18 @@ describe('assess dataflow propagation string slice', function () {
     sinon.resetHistory();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   [
     {
       desc: 'not tracked',

package/lib/dataflow/propagation/install/string/split.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { ArrayPrototypeJoin } = require('@contrast/common');
+const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
 const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'split', {
         name,
         patchType,
+        usePerf: true,
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (

package/lib/dataflow/propagation/install/string/split.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string split', function () {
   let core, simulateRequestScope, trackString, tracker;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -27,6 +28,18 @@ describe('assess dataflow propagation string split', function () {
     core.assess.dataflow.propagation.stringInstrumentation.split.uninstall();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   describe('base cases', function () {
     it('normal split on non-tracked string', function () {
       simulateRequestScope(() => {

package/lib/dataflow/propagation/install/string/substring.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { ArrayPrototypeJoin } = require('@contrast/common');
+const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
 const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
@@ -62,6 +62,7 @@ module.exports = function(core) {
         patcher.patch(String.prototype, method, {
           name: `String.prototype.${method}`,
           patchType,
+          usePerf: true,
           post(data) {
             const { obj, args: origArgs, result, name, hooked, orig } = data;
             if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/substring.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string substring', function () {
   let core, tracker, trackString, simulateRequestScope;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -23,6 +24,18 @@ describe('assess dataflow propagation string substring', function () {
     sinon.resetHistory();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   [
     {
       desc: 'below',

package/lib/dataflow/propagation/install/string/trim.js

@@ -92,18 +92,21 @@ module.exports = function(core) {
         name: 'String.prototype.trim',
         patchType,
         post: createPostHook('trim'),
+        usePerf: true,
       });
 
       patcher.patch(String.prototype, 'trimStart', {
         name: 'String.prototype.trimStart',
         patchType,
-        post: createPostHook('trimStart')
+        post: createPostHook('trimStart'),
+        usePerf: true,
       });
 
       patcher.patch(String.prototype, 'trimEnd', {
         name: 'String.prototype.trimEnd',
         patchType,
         post: createPostHook('trimEnd', 0),
+        usePerf: true,
       });
     },
     uninstall() {

package/lib/dataflow/propagation/install/string/trim.test.js

@@ -6,6 +6,7 @@ const { initAssessFixture } = require('@contrast/test/fixtures');
 
 describe('assess dataflow propagation string trim', function () {
   let core, tracker, trackString, simulateRequestScope;
+  const allPatcher = new Map();
 
   beforeEach(function () {
     ({
@@ -23,6 +24,18 @@ describe('assess dataflow propagation string trim', function () {
     sinon.resetHistory();
   });
 
+  // eslint-disable-next-line mocha/no-sibling-hooks
+  afterEach(function() {
+    core.Perf.fromAllToMap('patcher', allPatcher);
+  });
+
+  after(function() {
+    const stats = core.Perf.getStats(allPatcher);
+    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
+      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
+    }
+  });
+
   [
     {
       str: 'not-tracked',