@contrast/assess 1.35.0 → 1.37.0

package/lib/dataflow/propagation/install/path/extname.js

@@ -14,19 +14,19 @@
  */
 
 'use strict';
-const { patchType } = require('../../common');
+
 const { isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
-const {
-  excludeExtensionDotFromTags
-} = require('./common');
+const { patchType } = require('../../common');
+const { excludeExtensionDotFromTags } = require('./common');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -43,12 +43,7 @@ module.exports = function(core) {
             patchType,
             post(data) {
               const { args, result, name, hooked, orig } = data;
-              if (
-                !result ||
-                !sources.getStore()?.assess ||
-                instrumentation.isLocked()
-              )
-                return;
+              if (!result || !getSourceContext(PROPAGATOR)) return;
 
               const pathStr = args[0];
 

package/lib/dataflow/propagation/install/path/extname.test.js

@@ -36,14 +36,14 @@ describe('assess dataflow propagation path extname', function () {
         });
       });
 
-      it('will not propagate if there is no assess context', function () {
+      it('will not propagate if there is no assess policy in request context', function () {
         simulateRequestScope(function () {
           const myPath = trackString('/path/to/file.txt');
 
           const result = path.extname(myPath);
 
           expect(tracker.getData(result)).to.be.null;
-        }, {});
+        }, { assess: { policy: null } });
       });
 
       it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/path/format.js

@@ -14,20 +14,19 @@
  */
 
 'use strict';
-const { ArrayPrototypeJoin, isString } = require('@contrast/common');
-const { patchType } = require('../../common');
+
+const { primordials: { ArrayPrototypeJoin }, isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createMergedTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
-const {
-  createArgTagsInResult,
-  excludeExtensionDotFromTags
-} = require('./common');
+const { patchType } = require('../../common');
+const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -44,12 +43,7 @@ module.exports = function(core) {
             patchType,
             post(data) {
               const { args, result, name: patchName, hooked, orig } = data;
-              if (
-                !result ||
-                !sources.getStore()?.assess ||
-                instrumentation.isLocked()
-              )
-                return;
+              if (!result || !getSourceContext(PROPAGATOR)) return;
 
               const pathProps = [];
               const { dir, root, base, name, ext } = args[0];

package/lib/dataflow/propagation/install/path/format.test.js

@@ -39,7 +39,7 @@ describe('assess dataflow propagation path format', function () {
         });
       });
 
-      it('will not propagate if there is no assess context', function () {
+      it('will not propagate if there is no assess policy in request context', function () {
         simulateRequestScope(function () {
           const dir = trackString('/path/to');
 
@@ -49,7 +49,7 @@ describe('assess dataflow propagation path format', function () {
           });
 
           expect(tracker.getData(result)).to.be.null;
-        }, {});
+        }, { assess: { policy: null } });
       });
 
       it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -14,20 +14,19 @@
  */
 
 'use strict';
-const { isString, ArrayPrototypeJoin } = require('@contrast/common');
+
+const { isString, primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createMergedTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
-const {
-  createArgTagsInResult,
-  excludeExtensionDotFromTags,
-} = require('./common');
+const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -46,12 +45,8 @@ module.exports = function(core) {
               patchType,
               post(data) {
                 const { args: origArgs, result, hooked, orig } = data;
-                if (
-                  !result ||
-                  !sources.getStore()?.assess ||
-                  instrumentation.isLocked()
-                )
-                  return;
+
+                if (!result || !getSourceContext(PROPAGATOR)) return;
 
                 const pathSegments = [...origArgs].reverse();
                 const args = [];

package/lib/dataflow/propagation/install/path/join-and-resolve.test.js

@@ -45,7 +45,7 @@ describe('assess dataflow propagation path', function () {
             });
           });
 
-          it('will not propagate if there is no assess context', function () {
+          it('will not propagate if there is no assess policy in request context', function () {
             simulateRequestScope(function () {
               const seg1 = trackString('/path');
               const seg2 = trackString('/to');
@@ -54,7 +54,7 @@ describe('assess dataflow propagation path', function () {
               const result = path[method](seg1, seg2, seg3);
 
               expect(tracker.getData(result)).to.be.null;
-            }, {});
+            }, { assess: { policy: null } });
           });
 
           it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/path/normalize.js

@@ -15,18 +15,16 @@
 
 'use strict';
 const { isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
-const {
-  createArgTagsInResult,
-  excludeExtensionDotFromTags,
-} = require('./common');
+const { createArgTagsInResult, excludeExtensionDotFromTags, } = require('./common');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -43,12 +41,7 @@ module.exports = function(core) {
             patchType,
             post(data) {
               const { args, result, name, hooked, orig } = data;
-              if (
-                !result ||
-                !sources.getStore()?.assess ||
-                instrumentation.isLocked()
-              )
-                return;
+              if (!result || !getSourceContext(PROPAGATOR)) return;
 
               const pathStr = args[0];
 

package/lib/dataflow/propagation/install/path/normalize.test.js

@@ -42,14 +42,14 @@ describe('assess dataflow propagation path normalize', function () {
         });
       });
 
-      it('will not propagate if there is no assess context', function () {
+      it('will not propagate if there is no assess policy in request context', function () {
         simulateRequestScope(function () {
           const myPath = trackString('/path');
 
           const result = path.normalize(myPath);
 
           expect(tracker.getData(result)).to.be.null;
-        }, {});
+        }, { assess: { policy: null } });
       });
 
       it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/path/parse.js

@@ -15,6 +15,7 @@
 
 'use strict';
 const { isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 const { excludeExtensionDotFromTags } = require('./common');
@@ -23,8 +24,8 @@ module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       inspect, // todo: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
@@ -42,15 +43,9 @@ module.exports = function(core) {
             patchType,
             post(data) {
               const { args, result, name: patchName, hooked, orig } = data;
-              if (
-                !result ||
-                !sources.getStore()?.assess ||
-                instrumentation.isLocked()
-              )
-                return;
+              if (!result || !getSourceContext(PROPAGATOR)) return;
 
               const [path] = args;
-
               if (!path || !isString(path)) return;
 
               const strInfo = tracker.getData(path);

package/lib/dataflow/propagation/install/path/parse.test.js

@@ -40,7 +40,7 @@ describe('assess dataflow propagation path parse', function () {
         });
       });
 
-      it('will not propagate if there is no assess context', function () {
+      it('will not propagate if there is no assess policy in request context', function () {
         simulateRequestScope(function () {
           const str = trackString('/path/to/file.txt');
           const result = path.parse(str);
@@ -48,7 +48,7 @@ describe('assess dataflow propagation path parse', function () {
             const valInfo = tracker.getData(result[key]);
             expect(valInfo).to.be.null;
           });
-        }, {});
+        }, { assess: { policy: null } });
       });
 
       it('will not propagate if instrumentation is locked', function () {

package/lib/dataflow/propagation/install/path/relative.js

@@ -14,19 +14,18 @@
  */
 
 'use strict';
+
 const { isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
-const {
-  createArgTagsInResult,
-  excludeExtensionDotFromTags,
-} = require('./common');
+const { createArgTagsInResult, excludeExtensionDotFromTags, } = require('./common');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -43,12 +42,7 @@ module.exports = function(core) {
             patchType,
             post(data) {
               const { args, result, name, hooked, orig } = data;
-              if (
-                !result ||
-                !sources.getStore()?.assess ||
-                instrumentation.isLocked()
-              )
-                return;
+              if (!result || !getSourceContext(PROPAGATOR)) return;
 
               const [fromStr, toStr] = args;
 

package/lib/dataflow/propagation/install/path/relative.test.js

@@ -41,14 +41,14 @@ describe('assess dataflow propagation path relative', function () {
         });
       });
 
-      it('will not propagate if there is no assess context', function () {
+      it('will not propagate if there is no assess policy in request context', function () {
         simulateRequestScope(function () {
           const myPath = trackString('/path');
 
           const result = path.relative('/to', myPath);
 
           expect(tracker.getData(result)).to.be.null;
-        }, {});
+        }, { assess: { policy: null } });
       });
 
       it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/path/toNamespacedPath.js

@@ -14,19 +14,18 @@
  */
 
 'use strict';
+
 const { isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
-const {
-  createArgTagsInResult,
-  excludeExtensionDotFromTags
-} = require('./common');
+const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
 
 module.exports = function(core) {
   const {
     depHooks,
     patcher,
-    scopes: { sources, instrumentation },
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -42,12 +41,7 @@ module.exports = function(core) {
             patchType,
             post(data) {
               const { args, result, name, hooked, orig } = data;
-              if (
-                !result ||
-                !sources.getStore()?.assess ||
-                instrumentation.isLocked()
-              )
-                return;
+              if (!result || !getSourceContext(PROPAGATOR)) return;
 
               const pathStr = args[0];
 

package/lib/dataflow/propagation/install/path/toNamespacedPath.test.js

@@ -35,14 +35,14 @@ describe('assess dataflow propagation path toNamespacedPath', function () {
       });
     });
 
-    it('will not propagate if there is no assess context', function () {
+    it('will not propagate if there is no assess policy in request context', function () {
       simulateRequestScope(function () {
         const myPath = trackString('C:\\path\\to\\file.txt');
 
         const result = path.toNamespacedPath(myPath);
 
         expect(tracker.getData(result)).to.be.null;
-      }, {});
+      }, { assess: { policy: null } });
     });
 
     it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/pug/index.js

@@ -14,6 +14,7 @@
  */
 'use strict';
 
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
 
 /** @type {import('@contrast/rewriter').RewriteOpts} */
@@ -22,8 +23,12 @@ const REWRITE_OPTS = { isModule: false, inject: false, wrap: false };
 module.exports = function (core) {
   const store = { lock: true, name: 'assess:propagators:pug-compile' };
   const {
-    scopes: { sources, instrumentation },
-    patcher, logger, rewriter, depHooks,
+    patcher,
+    logger,
+    rewriter,
+    depHooks,
+    scopes: { instrumentation },
+    assess: { getSourceContext },
   } = core;
 
   const pugInstrumentation = {
@@ -34,7 +39,7 @@ module.exports = function (core) {
           name: 'pug.compile',
           patchType,
           pre(data) {
-            if (!sources.getStore()?.assess || instrumentation.isLocked()) return;
+            if (!getSourceContext(PROPAGATOR)) return;
 
             const opts = data.args[1] || {};
             const plugins = opts.plugins || [];

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -15,20 +15,17 @@
 
 'use strict';
 
-const {
-  DataflowTag: { WEAK_URL_ENCODED }
-} = require('@contrast/common');
-const {
-  createFullLengthCopyTags
-} = require('../../tag-utils');
+const { DataflowTag: { WEAK_URL_ENCODED } } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
+const { createFullLengthCopyTags } = require('../../tag-utils');
 const { patchType, createModuleLabel } = require('../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     depHooks,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -44,7 +41,7 @@ module.exports = function(core) {
           patchType,
           post(data) {
             const { args, result, hooked, orig } = data;
-            if (!result || !args[0] || !sources.getStore()?.assess || instrumentation.isLocked()) return;
+            if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
 
             const argInfo = tracker.getData(args[0]);
 

package/lib/dataflow/propagation/install/pug-runtime-escape.test.js

@@ -54,7 +54,7 @@ describe('assess dataflow propagation pugRuntime.escape', function () {
       const value = trackString('foo');
       const result = mockPugRuntime.escape(value);
       expect(tracker.getData(result)).to.be.null;
-    }, {});
+    }, { assess: { policy: null } });
   });
 
   it('will not propagate if there instrumentation is locked', function () {

package/lib/dataflow/propagation/install/querystring/escape.js

@@ -15,19 +15,20 @@
 'use strict';
 
 const { DataflowTag: { URL_ENCODED } } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createFullLengthCopyTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
     assess: {
+      getSourceContext,
       inspect, // todo: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     },
     depHooks,
     patcher,
-    scopes,
   } = core;
 
   return core.assess.dataflow.propagation.querystringInstrumentation.escape = {
@@ -43,8 +44,7 @@ module.exports = function(core) {
             const strInfo = tracker.getData(value);
             if (!strInfo) return;
 
-            const sourceContext = scopes.sources.getStore()?.assess;
-            if (!sourceContext) return;
+            if (!getSourceContext(PROPAGATOR)) return;
 
             let tags;
             if (value !== data.result) {

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -18,17 +18,18 @@
 const querystring = require('querystring');
 const {
   DataflowTag: { URL_ENCODED },
-  ArrayPrototypeJoin,
+  primordials: { ArrayPrototypeJoin },
 } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     depHooks,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -105,15 +106,10 @@ module.exports = function(core) {
             name: `querystring.${method}`,
             patchType,
             pre(data) {
-              if (!sources.getStore()?.assess || instrumentation.isLocked()) return;
-              const input = data.args[0];
-              if (!input) {
-                return;
-              }
-              const trackingData = tracker.getData(input);
-              if (!trackingData) {
-                return;
-              }
+              if (!data.args[0] || !getSourceContext(PROPAGATOR)) return;
+
+              const trackingData = tracker.getData(data.args[0]);
+              if (!trackingData) return;
 
               data.idx = 0;
               data.origArgs = [...data.args];

package/lib/dataflow/propagation/install/querystring/stringify.js

@@ -16,6 +16,7 @@
 
 const querystring = require('querystring');
 const { isString } = require('@contrast/common');
+const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const utils = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -24,21 +25,20 @@ const moduleName = 'querystring';
 module.exports = function(core) {
   const {
     assess: {
+      getSourceContext,
       inspect, // todo: remove
       dataflow: { tracker },
       eventFactory: { createPropagationEvent },
     },
     depHooks,
     patcher,
-    scopes,
   } = core;
 
   /**
    * Adds custom encoding function to capture key/value tags and history during stringification
    */
   function pre(data) {
-    const sourceContext = scopes.sources.getStore()?.assess;
-    if (!sourceContext) return;
+    if (!getSourceContext(PROPAGATOR)) return;
 
     const [input] = data.args;
     const escape = typeof data.args[3]?.encodeURIComponent === 'function'

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -14,14 +14,16 @@
  */
 
 'use strict';
+
+const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../tag-utils');
 const { patchType } = require('../common');
 
 module.exports = function(core) {
   const {
-    scopes: { sources, instrumentation },
     patcher,
     assess: {
+      getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -83,8 +85,7 @@ module.exports = function(core) {
             !obj ||
             !args[0] ||
             !result?.length ||
-            !sources.getStore()?.assess ||
-            instrumentation.isLocked()
+            !getSourceContext(PROPAGATOR)
           )
             return;
 

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.test.js

@@ -104,11 +104,12 @@ describe('assess dataflow propagation RegExp exec', function () {
     it.skip('propagates strings when iteratively called', function() {
       simulateRequestScope(() => {
         const re = /^\/?$/i;
-        //                          0123456789*1234567
+        // eslint-disable-next-line
         const extern = trackString('');
 
         let ret;
         while ((ret = re.exec(''))) {
+          // eslint-disable-next-line
           const matchInfo = tracker.getData(ret[0]);
           // console.log(re.lastIndex, ret.index, ret.indices);
           re.lastIndex += 1;
@@ -153,6 +154,8 @@ describe('assess dataflow propagation RegExp exec', function () {
 
     it('does not propagate if we exeeded the maximum propagation count for a group', function () {
       simulateRequestScope(() => {
+        core.scopes.sources.getStore().assess.propagationEventsCount = 498;
+
         const re = /foo(?<bar>bar)/;
         const extern = trackString('foobar');
 
@@ -173,7 +176,7 @@ describe('assess dataflow propagation RegExp exec', function () {
           [UNTRUSTED]: [0, 2]
         });
         expect(barGroupInfo).to.be.null;
-      }, { assess: { propagationEventsCount: 498 } });
+      });
     });
 
 
@@ -251,7 +254,6 @@ describe('assess dataflow propagation RegExp exec', function () {
         const blackInfo = tracker.getData(ret[3]);
         const colorGroupInfo = tracker.getData(ret.groups.color);
 
-
         expect(ret).to.deep.equal([
           'Quick Brown Fox Jumps Over The Lazy Black',
           'Brown',