@contrast/assess 1.36.0 → 1.37.0

package/lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -15,6 +15,7 @@
 
 'use strict';
 
+const semver = require('semver');
 const { DataflowTag, primordials: { StringPrototypeSubstring } } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { userDefinedType } = require('./common');
@@ -34,6 +35,99 @@ module.exports = function (core) {
     },
   } = core;
 
+  function patchCastForQuery(SchemaString, { version }) {
+    if (semver.gte(version, '7.0.0')) {
+      patcher.patch(SchemaString.prototype, 'castForQuery', {
+        name: 'mongoose.SchemaString.prototype.castForQuery',
+        patchType,
+        post(data) {
+          // if a conditional is provided as the first argument castForQuery gets
+          // called subsequently with the individual value(s)
+          if (!getSourceContext() || data.args[0]) return;
+
+          const strInfo = tracker.getData(data.result);
+          if (!strInfo) return;
+
+          const event = createPropagationEvent({
+            addedTags: [DataflowTag.STRING_TYPE_CHECKED],
+            name: data.name,
+            moduleName: 'mongoose',
+            methodName: 'SchemaString.prototype.castForQuery',
+            history: [{ ...strInfo }],
+            object: {
+              tracked: false,
+              value: 'mongoose.SchemaString',
+            },
+            args: [{ tracked: true, value: strInfo.value }],
+            result: { tracked: true, value: data.result },
+            source: 'P1',
+            tags: {
+              ...strInfo.tags,
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, data.result.length - 1],
+            },
+            target: 'R',
+            stacktraceOpts: {
+              prependFrames: [data.orig],
+            },
+          });
+
+          if (!event) return;
+
+          // in case the event type changed e.g. Source->Propagation
+          for (const key of Object.keys(strInfo)) {
+            if (key === 'value' || key === 'extern') continue;
+            delete strInfo[key];
+          }
+
+          Object.assign(strInfo, event);
+        }
+      });
+    } else {
+      // v6
+      patcher.patch(SchemaString.prototype, '_castForQuery', {
+        name: 'mongoose.SchemaString.prototype._castForQuery',
+        patchType,
+        post(data) {
+          const strInfo = tracker.getData(data.result);
+          if (!strInfo) return;
+
+          const event = createPropagationEvent({
+            addedTags: [DataflowTag.STRING_TYPE_CHECKED],
+            name: data.name,
+            moduleName: 'mongoose',
+            methodName: 'SchemaString.prototype._castForQuery',
+            history: [{ ...strInfo }],
+            object: {
+              tracked: false,
+              value: 'mongoose.SchemaString',
+            },
+            args: [{ tracked: true, value: strInfo.value }],
+            result: { tracked: true, value: data.result },
+            source: 'P0',
+            tags: {
+              ...strInfo.tags,
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, data.result.length - 1],
+            },
+            target: 'R',
+            stacktraceOpts: {
+              prependFrames: [data.orig],
+            },
+          });
+
+          if (!event) return;
+
+          // in case the event type changed e.g. Source->Propagation
+          for (const key of Object.keys(strInfo)) {
+            if (key === 'value' || key === 'extern') continue;
+            delete strInfo[key];
+          }
+
+          Object.assign(strInfo, event);
+        }
+      });
+    }
+  }
+
   function patchEnum(SchemaString) {
     patcher.patch(SchemaString.prototype, 'enum', {
       name: 'mongoose.SchemaString.prototype.enum',
@@ -196,7 +290,8 @@ module.exports = function (core) {
           file: 'lib/schema/string.js',
           version: '>=6.0.0',
         },
-        (SchemaString) => {
+        (SchemaString, metadata) => {
+          patchCastForQuery(SchemaString, metadata);
           patchEnum(SchemaString);
           patchDoValidate(SchemaString);
           patchDoValidateSync(SchemaString);

package/lib/dataflow/propagation/install/mongoose/schema-string.test.js

@@ -4,7 +4,7 @@ const { expect } = require('chai');
 const sinon = require('sinon');
 const { initAssessFixture } = require('@contrast/test/fixtures');
 
-describe('assess dataflow propagation mongoose.StringSchema', function () {
+describe('assess dataflow propagation mongoose.SchemaString', function () {
   let core,
     trackString,
     simulateRequestScope,
@@ -28,6 +28,9 @@ describe('assess dataflow propagation mongoose.StringSchema', function () {
         validator: enumStub,
       }];
     };
+    MockSchemaString.prototype.castForQuery = function($c, v) {
+      return v;
+    };
     MockSchemaString.prototype.enum = function () {
       return this;
     };
@@ -39,7 +42,7 @@ describe('assess dataflow propagation mongoose.StringSchema', function () {
 
     tracker = core.assess.dataflow.tracker;
     core.assess.dataflow.propagation.mongooseInstrumentation.schemaString.install();
-    core.depHooks.resolve.yield(MockSchemaString);
+    core.depHooks.resolve.yield(MockSchemaString, { version: '7.5.3' });
   });
 
   afterEach(function () {
@@ -60,6 +63,42 @@ describe('assess dataflow propagation mongoose.StringSchema', function () {
     });
   });
 
+  describe('SchemaString#castForQuery()', function () {
+    it('adds STRING_TYPE_CHECKED when called directly on a value', function () {
+      simulateRequestScope(function () {
+        const str = trackString('foo');
+        const strInfo = tracker.getData(str);
+
+        mockSchemaString.castForQuery(null, str);
+
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          addedTags: ['STRING_TYPE_CHECKED'],
+          tags: { UNTRUSTED: [0, 2], STRING_TYPE_CHECKED: [0, 2] },
+        });
+      });
+    });
+
+    it('does not add STRING_TYPE_CHECKED when called with a conditional', function () {
+      simulateRequestScope(function () {
+        const str = trackString('foo');
+        const strInfo = tracker.getData(str);
+
+        mockSchemaString.castForQuery('$ne', str);
+
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          tags: { UNTRUSTED: [0, 2] },
+        });
+        expect(strInfo).not.to.deep.include({
+          addedTags: ['STRING_TYPE_CHECKED'],
+          tags: { UNTRUSTED: [0, 2], STRING_TYPE_CHECKED: [0, 2] },
+        });
+
+      });
+    });
+  });
+
   it('SchemaString.doValidate adds STRING_TYPE_CHECKED tag', function () {
     return new Promise((resolve) => {
       simulateRequestScope(function () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -19,14 +19,14 @@
   "dependencies": {
     "@contrast/common": "1.26.0",
     "@contrast/config": "1.34.0",
-    "@contrast/core": "1.38.0",
-    "@contrast/dep-hooks": "1.6.0",
+    "@contrast/core": "1.39.0",
+    "@contrast/dep-hooks": "1.7.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.16.0",
-    "@contrast/logger": "1.11.0",
-    "@contrast/patcher": "1.10.0",
-    "@contrast/rewriter": "1.14.0",
-    "@contrast/scopes": "1.7.0",
+    "@contrast/instrumentation": "1.17.0",
+    "@contrast/logger": "1.12.0",
+    "@contrast/patcher": "1.11.0",
+    "@contrast/rewriter": "1.15.0",
+    "@contrast/scopes": "1.8.0",
     "semver": "^7.6.0"
   }
 }