@contrast/assess 1.36.0 → 1.38.0

package/lib/crypto-analysis/install/crypto.js

@@ -50,7 +50,7 @@ const SAFE_HASH_ALGORITHMS = new Set([
   'sha512',
   'sha512withrsaencryption',
 ]);
-const SAFE_HASH_LIBS = ['etag', 'browserify', 'deps-sort'];
+const SAFE_HASH_LIBS = ['etag', 'browserify', 'deps-sort', 'cookie-signature'];
 const SAFE_CIPHER_ALGORITHM_PREFIXES = ['des-ede', 'id-aes', 'aes', 'rsa'];
 
 /**

package/lib/dataflow/propagation/install/JSON/parse.js

@@ -100,6 +100,7 @@ module.exports = function (core) {
       patcher.patch(JSON, 'parse', {
         name: 'JSON.parse',
         patchType,
+        usePerf: 'sync',
         pre(data) {
           if (!data.args[0] || !getSourceContext(PROPAGATOR)) return;
           const [input, reviver] = data.args;

package/lib/dataflow/propagation/install/JSON/stringify.js

@@ -165,6 +165,7 @@ module.exports = function(core) {
       patcher.patch(JSON, 'stringify', {
         name: 'JSON.stringify',
         patchType,
+        usePerf: 'sync',
         pre(data) {
           if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -69,6 +69,7 @@ module.exports = function(core) {
       patcher.patch(Array.prototype, 'join', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/buffer.js

@@ -82,6 +82,7 @@ module.exports = function(core) {
       patcher.patch(global.Buffer, 'from', {
         patchType,
         name: bufferFrom,
+        usePerf: 'sync',
         post(data) {
           const firstArg = data.args[0];
           const argType = isString(firstArg) ? 'string' : Buffer.isBuffer(firstArg) ? 'buffer' : null;

package/lib/dataflow/propagation/install/contrast-methods/number.js

@@ -36,6 +36,7 @@ module.exports = function (core) {
       patcher.patch(global.ContrastMethods, 'Number', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args: [value], result } = data;
           if (

package/lib/dataflow/propagation/install/contrast-methods/string.js

@@ -44,6 +44,7 @@ module.exports = function(core) {
       patcher.patch(global.ContrastMethods, 'String', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           if (!data.result || !getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -33,6 +33,7 @@ module.exports = function(core) {
       patcher.patch(global.ContrastMethods, 'tag', {
         name: 'ContrastMethods.tag',
         patchType,
+        usePerf: 'sync',
         post(data) {
           if (!data.result || !getSourceContext(PROPAGATOR)) {
             return;

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(global, 'decodeURIComponent', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
           if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -38,6 +38,7 @@ module.exports = function(core) {
         patcher.patch(ejsUtils, 'escapeXML', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/ejs/template.js

@@ -60,6 +60,7 @@ module.exports = function (core) {
         patcher.patch(_export.Template.prototype, 'generateSource', {
           name: 'ejs.Template.prototype.generateSource',
           patchType,
+          usePerf: 'sync',
           post(data) {
             if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/encode-uri.js

@@ -48,6 +48,7 @@ module.exports = function(core) {
         patcher.patch(global, methodName, {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/escape-html.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         return patcher.patch(escapeHtml, {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/escape.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(global, 'escape', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
           if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/fastify-send.js

@@ -30,6 +30,7 @@ module.exports = function (core) {
         patcher.patch(_SendStream.prototype, 'sendFile', {
           name: '@fastify/send/lib/SendStream.js',
           patchType,
+          usePerf: 'sync',
           pre(data) {
             const { args } = data;
 

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         patcher.patch(handlebars.Utils, 'escapeExpression', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/isnumeric-0.js

@@ -38,6 +38,7 @@ module.exports = function (core) {
         return patcher.patch(_export, {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args: [value], result } = data;
             if (

package/lib/dataflow/propagation/install/joi/boolean.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -45,6 +45,7 @@ module.exports = function(core) {
     patcher.patch(def.coerce, 'method', {
       name: 'joi.boolean.coerce',
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (
           !data.result?.value ||

package/lib/dataflow/propagation/install/joi/expression.js

@@ -24,7 +24,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -38,6 +38,7 @@ module.exports = function(core) {
     return patcher.patch(joi, method, {
       name: `joi.${method}`,
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (!data.result || !getSourceContext()) return;
 

package/lib/dataflow/propagation/install/joi/index.js

@@ -29,7 +29,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -46,6 +46,7 @@ module.exports = function(core) {
       patcher.patch(parentObj, 'validateAsync', {
         name: `Joi.${parentObjType}.validateAsync`,
         patchType,
+        usePerf: 'tbd',
         post(data) {
           const childNodes = data.obj?.$_terms.items?.length
             ? data.obj.$_terms.items
@@ -96,6 +97,7 @@ module.exports = function(core) {
       patcher.patch(parentObj.rules.custom, 'validate', {
         name: `joi.${objName}.custom.valdiate`,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const {
             args: [input, schema],

package/lib/dataflow/propagation/install/joi/keys.js

@@ -131,6 +131,7 @@ module.exports = function(core) {
           patcher.patch(Object.getPrototypeOf(joi), 'keys', {
             name: 'joi.keys',
             patchType,
+            usePerf: 'sync',
             pre(data) {
               const [value] = data.args;
               const joi = data.obj.$_root;

package/lib/dataflow/propagation/install/joi/number.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -43,6 +43,7 @@ module.exports = function(core) {
     patcher.patch(def.coerce, 'method', {
       name: 'joi.number.coerce',
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (
           !data.result?.value ||

package/lib/dataflow/propagation/install/joi/string-schema.js

@@ -42,7 +42,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: {
         tracker, propagation: {
@@ -105,6 +105,7 @@ module.exports = function(core) {
     patcher.patch(validatorObj, 'validate', {
       name: patchName,
       patchType,
+      usePerf: 'sync',
       post(data) {
         const [input, schema] = data.args;
 
@@ -137,6 +138,7 @@ module.exports = function(core) {
     patcher.patch(coerce, 'method', {
       name: 'joi.string._definition.coerce',
       patchType,
+      usePerf: 'sync',
       post(data) {
         const { args, result } = data;
 

package/lib/dataflow/propagation/install/joi/values.js

@@ -27,7 +27,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -37,6 +37,7 @@ module.exports = function(core) {
     patcher.patch(values.prototype, 'get', {
       name: 'joi.values',
       patchType,
+      usePerf: 'sync',
       post(data) {
         const {
           args: [value, state, prefs],

package/lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -107,6 +107,7 @@ module.exports = function (core) {
         patcher.patch(SchemaMap.prototype, 'doValidateSync', {
           name: doValidateSyncName,
           patchType,
+          usePerf: 'sync',
           post: (data) => {
             if (!assess.trust_custom_validators || data.result || !getSourceContext()) return;
 
@@ -119,6 +120,7 @@ module.exports = function (core) {
         patcher.patch(SchemaMap.prototype, 'doValidate', {
           name: doValidateName,
           patchType,
+          usePerf: 'tbd',
           pre: (data) => {
             if (!assess.trust_custom_validators) return;
 

package/lib/dataflow/propagation/install/mongoose/schema-mixed.js

@@ -134,6 +134,7 @@ module.exports = function (core) {
         patcher.patch(SchemaMixed.prototype, 'doValidate', {
           name: doValidateName,
           patchType,
+          usePerf: 'tbd',
           pre: (data) => {
             if (!assess.trust_custom_validators || !getSourceContext()) {
               return;
@@ -147,6 +148,7 @@ module.exports = function (core) {
             data.args[1] = patcher.patch(cb, {
               name: doValidateName,
               patchType,
+              usePerf: 'tbd',
               pre({ args: [err] }) {
                 if (err) return;
 

package/lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -15,6 +15,7 @@
 
 'use strict';
 
+const semver = require('semver');
 const { DataflowTag, primordials: { StringPrototypeSubstring } } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { userDefinedType } = require('./common');
@@ -34,10 +35,104 @@ module.exports = function (core) {
     },
   } = core;
 
+  function patchCastForQuery(SchemaString, { version }) {
+    if (semver.gte(version, '7.0.0')) {
+      patcher.patch(SchemaString.prototype, 'castForQuery', {
+        name: 'mongoose.SchemaString.prototype.castForQuery',
+        patchType,
+        post(data) {
+          // if a conditional is provided as the first argument castForQuery gets
+          // called subsequently with the individual value(s)
+          if (!getSourceContext() || data.args[0]) return;
+
+          const strInfo = tracker.getData(data.result);
+          if (!strInfo) return;
+
+          const event = createPropagationEvent({
+            addedTags: [DataflowTag.STRING_TYPE_CHECKED],
+            name: data.name,
+            moduleName: 'mongoose',
+            methodName: 'SchemaString.prototype.castForQuery',
+            history: [{ ...strInfo }],
+            object: {
+              tracked: false,
+              value: 'mongoose.SchemaString',
+            },
+            args: [{ tracked: true, value: strInfo.value }],
+            result: { tracked: true, value: data.result },
+            source: 'P1',
+            tags: {
+              ...strInfo.tags,
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, data.result.length - 1],
+            },
+            target: 'R',
+            stacktraceOpts: {
+              prependFrames: [data.orig],
+            },
+          });
+
+          if (!event) return;
+
+          // in case the event type changed e.g. Source->Propagation
+          for (const key of Object.keys(strInfo)) {
+            if (key === 'value' || key === 'extern') continue;
+            delete strInfo[key];
+          }
+
+          Object.assign(strInfo, event);
+        }
+      });
+    } else {
+      // v6
+      patcher.patch(SchemaString.prototype, '_castForQuery', {
+        name: 'mongoose.SchemaString.prototype._castForQuery',
+        patchType,
+        post(data) {
+          const strInfo = tracker.getData(data.result);
+          if (!strInfo) return;
+
+          const event = createPropagationEvent({
+            addedTags: [DataflowTag.STRING_TYPE_CHECKED],
+            name: data.name,
+            moduleName: 'mongoose',
+            methodName: 'SchemaString.prototype._castForQuery',
+            history: [{ ...strInfo }],
+            object: {
+              tracked: false,
+              value: 'mongoose.SchemaString',
+            },
+            args: [{ tracked: true, value: strInfo.value }],
+            result: { tracked: true, value: data.result },
+            source: 'P0',
+            tags: {
+              ...strInfo.tags,
+              [DataflowTag.STRING_TYPE_CHECKED]: [0, data.result.length - 1],
+            },
+            target: 'R',
+            stacktraceOpts: {
+              prependFrames: [data.orig],
+            },
+          });
+
+          if (!event) return;
+
+          // in case the event type changed e.g. Source->Propagation
+          for (const key of Object.keys(strInfo)) {
+            if (key === 'value' || key === 'extern') continue;
+            delete strInfo[key];
+          }
+
+          Object.assign(strInfo, event);
+        }
+      });
+    }
+  }
+
   function patchEnum(SchemaString) {
     patcher.patch(SchemaString.prototype, 'enum', {
       name: 'mongoose.SchemaString.prototype.enum',
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (!data.result) return;
 
@@ -50,6 +145,7 @@ module.exports = function (core) {
         patcher.patch(enumValidator, 'validator', {
           name: 'mongoose.SchemaString.prototype.enum.validator',
           patchType,
+          usePerf: 'sync',
           post(data) {
             const sourceContext = sources.getStore()?.assess;
             if (!sourceContext) return;
@@ -69,6 +165,7 @@ module.exports = function (core) {
     patcher.patch(SchemaString.prototype, 'doValidate', {
       name,
       patchType,
+      usePerf: 'tbd',
       pre(data) {
         const [value, cb] = data.args;
         if (!value || typeof cb !== 'function' || !getSourceContext()) return;
@@ -80,6 +177,7 @@ module.exports = function (core) {
         data.args[1] = patcher.patch(cb, {
           name,
           patchType,
+          usePerf: 'tbd',
           pre(data) {
             const {
               args: [err],
@@ -109,6 +207,7 @@ module.exports = function (core) {
     patcher.patch(SchemaString.prototype, 'doValidateSync', {
       name,
       patchType,
+      usePerf: 'sync',
       post(data) {
         const {
           args: [value],
@@ -196,7 +295,8 @@ module.exports = function (core) {
           file: 'lib/schema/string.js',
           version: '>=6.0.0',
         },
-        (SchemaString) => {
+        (SchemaString, metadata) => {
+          patchCastForQuery(SchemaString, metadata);
           patchEnum(SchemaString);
           patchDoValidate(SchemaString);
           patchDoValidateSync(SchemaString);

package/lib/dataflow/propagation/install/mongoose/schema-string.test.js

@@ -4,7 +4,7 @@ const { expect } = require('chai');
 const sinon = require('sinon');
 const { initAssessFixture } = require('@contrast/test/fixtures');
 
-describe('assess dataflow propagation mongoose.StringSchema', function () {
+describe('assess dataflow propagation mongoose.SchemaString', function () {
   let core,
     trackString,
     simulateRequestScope,
@@ -28,6 +28,9 @@ describe('assess dataflow propagation mongoose.StringSchema', function () {
         validator: enumStub,
       }];
     };
+    MockSchemaString.prototype.castForQuery = function($c, v) {
+      return v;
+    };
     MockSchemaString.prototype.enum = function () {
       return this;
     };
@@ -39,7 +42,7 @@ describe('assess dataflow propagation mongoose.StringSchema', function () {
 
     tracker = core.assess.dataflow.tracker;
     core.assess.dataflow.propagation.mongooseInstrumentation.schemaString.install();
-    core.depHooks.resolve.yield(MockSchemaString);
+    core.depHooks.resolve.yield(MockSchemaString, { version: '7.5.3' });
   });
 
   afterEach(function () {
@@ -60,6 +63,42 @@ describe('assess dataflow propagation mongoose.StringSchema', function () {
     });
   });
 
+  describe('SchemaString#castForQuery()', function () {
+    it('adds STRING_TYPE_CHECKED when called directly on a value', function () {
+      simulateRequestScope(function () {
+        const str = trackString('foo');
+        const strInfo = tracker.getData(str);
+
+        mockSchemaString.castForQuery(null, str);
+
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          addedTags: ['STRING_TYPE_CHECKED'],
+          tags: { UNTRUSTED: [0, 2], STRING_TYPE_CHECKED: [0, 2] },
+        });
+      });
+    });
+
+    it('does not add STRING_TYPE_CHECKED when called with a conditional', function () {
+      simulateRequestScope(function () {
+        const str = trackString('foo');
+        const strInfo = tracker.getData(str);
+
+        mockSchemaString.castForQuery('$ne', str);
+
+        expect(strInfo).to.deep.include({
+          value: 'foo',
+          tags: { UNTRUSTED: [0, 2] },
+        });
+        expect(strInfo).not.to.deep.include({
+          addedTags: ['STRING_TYPE_CHECKED'],
+          tags: { UNTRUSTED: [0, 2], STRING_TYPE_CHECKED: [0, 2] },
+        });
+
+      });
+    });
+  });
+
   it('SchemaString.doValidate adds STRING_TYPE_CHECKED tag', function () {
     return new Promise((resolve) => {
       simulateRequestScope(function () {

package/lib/dataflow/propagation/install/mustache-escape.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         return patcher.patch(mustache, 'escape', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -92,6 +92,7 @@ module.exports = function(core) {
           patcher.patch(mysql, 'escape', {
             name: `${lib}.escape`,
             patchType,
+            usePerf: 'sync',
             post: createPostHook(`${lib}.escape`, `${createModuleLabel(lib, version)}`)
           });
         });
@@ -101,6 +102,7 @@ module.exports = function(core) {
         patcher.patch(mysqlConnection.prototype, 'escape', {
           name: 'mysql.Connection.prototype.escape',
           patchType,
+          usePerf: 'sync',
           post: createPostHook('mysql/lib/Connection.escape', `[${createModuleLabel('mysql', version)}].Connection`)
         });
       });
@@ -109,6 +111,7 @@ module.exports = function(core) {
         patcher.patch(mysqlConnection.prototype, 'escape', {
           name: 'mysql.Connection.prototype.escape',
           patchType,
+          usePerf: 'sync',
           post: createPostHook('mysql2/lib/connection.Connection.escape', `[${createModuleLabel('mysql2', version)}].Connection`)
         });
       });

package/lib/dataflow/propagation/install/parse-int.js

@@ -36,6 +36,7 @@ module.exports = function (core) {
       patcher.patch(global, 'parseInt', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args: [value], result } = data;
           if (

package/lib/dataflow/propagation/install/path/basename.js

@@ -40,6 +40,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'basename', {
             name: `path.${os}.basename`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args: origArgs, result, name, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/path/dirname.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'dirname', {
             name: `path.${os}.dirname`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/path/extname.js

@@ -41,6 +41,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'extname', {
             name: `path.${os}.extname`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/format.js

@@ -41,6 +41,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'format', {
             name: `path.${os}.format`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name: patchName, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -43,6 +43,7 @@ module.exports = function(core) {
             patcher.patch(path[os], method, {
               name,
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const { args: origArgs, result, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/path/normalize.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'normalize', {
             name: `path.${os}.normalize`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/parse.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -41,6 +41,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'parse', {
             name: `path.${os}.parse`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name: patchName, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;