@contrast/assess 1.36.0 → 1.38.0

package/lib/dataflow/propagation/install/path/relative.js

@@ -40,6 +40,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'relative', {
             name: `path.${os}.relative`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/toNamespacedPath.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'toNamespacedPath', {
             name: `path.${os}.toNamespacedPath`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/pug/index.js

@@ -38,6 +38,7 @@ module.exports = function (core) {
         (pug) => patcher.patch(pug, 'compile', {
           name: 'pug.compile',
           patchType,
+          usePerf: 'tbd',
           pre(data) {
             if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         patcher.patch(pugRuntime, 'escape', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/querystring/escape.js

@@ -23,7 +23,7 @@ module.exports = function(core) {
   const {
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     },
@@ -37,6 +37,7 @@ module.exports = function(core) {
         patcher.patch(_export, 'escape', {
           name: 'querystring.escape',
           patchType,
+          usePerf: 'sync',
           post(data) {
             const [value] = data.args;
             if (!value?.length || !data.result?.length) return value;

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -105,6 +105,7 @@ module.exports = function(core) {
           patcher.patch(module, method, {
             name: `querystring.${method}`,
             patchType,
+            usePerf: 'sync',
             pre(data) {
               if (!data.args[0] || !getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/querystring/stringify.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
   const {
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       dataflow: { tracker },
       eventFactory: { createPropagationEvent },
     },
@@ -147,6 +147,7 @@ module.exports = function(core) {
           patcher.patch(_export, methodName, {
             name: `querystring.${methodName}`,
             patchType,
+            usePerf: 'sync',
             pre,
             post
           });

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -78,6 +78,7 @@ module.exports = function(core) {
       patcher.patch(RegExp.prototype, 'exec', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, obj, result, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/send.js

@@ -31,6 +31,7 @@ module.exports = function (core) {
     return patcher.patch(sendModuleExport, {
       name: 'send',
       patchType,
+      usePerf: 'sync',
       post(data) {
         patcher.patch(data.result, 'sendFile', {
           name: 'send.sendFile',

package/lib/dataflow/propagation/install/sequelize/query-generator.js

@@ -50,6 +50,7 @@ module.exports = function(core) {
             patcher.patch(_export.prototype, 'quoteIdentifier', {
               name: `sequelize.${constructor}.prototype.quoteIdentifier`,
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const strInfo = tracker.getData(data.result);
                 if (!strInfo || !getSourceContext()) return;

package/lib/dataflow/propagation/install/sequelize/sql-string.js

@@ -62,6 +62,7 @@ module.exports = function(core) {
           patcher.patch(sqlString, 'escape', {
             name,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
         patcher.patch(sqlTemplateStrings, 'SQL', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext()) return;

package/lib/dataflow/propagation/install/string/concat.js

@@ -37,7 +37,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'concat', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         post(data) {
           const { obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -36,7 +36,7 @@ module.exports = function(core) {
         patcher.patch(String.prototype, method, {
           name,
           patchType,
-          usePerf: true,
+          usePerf: 'sync',
           post(data) {
             const { obj, result, hooked, orig } = data;
             if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -32,7 +32,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }

package/lib/dataflow/propagation/install/string/index.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
     return patcher.patch(matcherFn, {
       name,
       patchType,
-      usePerf: true,
+      usePerf: 'sync',
       pre(data) {
         const { args: origArgs, hooked, orig } = data;
         if (

package/lib/dataflow/propagation/install/string/match-all.js

@@ -75,7 +75,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'matchAll', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         around(origFn, data) {
           const { args, obj, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/string/match.js

@@ -79,7 +79,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'match', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         around(origFn, data) {
           const { args, obj } = data;
           if (

package/lib/dataflow/propagation/install/string/replace.js

@@ -150,7 +150,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'replace', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         pre(data) {
           if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/string/slice.js

@@ -54,7 +54,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'slice', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/split.js

@@ -37,7 +37,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'split', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (

package/lib/dataflow/propagation/install/string/substring.js

@@ -62,7 +62,7 @@ module.exports = function(core) {
         patcher.patch(String.prototype, method, {
           name: `String.prototype.${method}`,
           patchType,
-          usePerf: true,
+          usePerf: 'sync',
           post(data) {
             const { obj, args: origArgs, result, name, hooked, orig } = data;
             if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/trim.js

@@ -92,21 +92,21 @@ module.exports = function(core) {
         name: 'String.prototype.trim',
         patchType,
         post: createPostHook('trim'),
-        usePerf: true,
+        usePerf: 'sync',
       });
 
       patcher.patch(String.prototype, 'trimStart', {
         name: 'String.prototype.trimStart',
         patchType,
         post: createPostHook('trimStart'),
-        usePerf: true,
+        usePerf: 'sync',
       });
 
       patcher.patch(String.prototype, 'trimEnd', {
         name: 'String.prototype.trimEnd',
         patchType,
         post: createPostHook('trimEnd', 0),
-        usePerf: true,
+        usePerf: 'sync',
       });
     },
     uninstall() {

package/lib/dataflow/propagation/install/unescape.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(global, 'unescape', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
           if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(url, method, {
             name,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, hooked, orig } = data;
               if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/url/parse.js

@@ -24,7 +24,7 @@ module.exports = function(core) {
     depHooks,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -87,6 +87,7 @@ module.exports = function(core) {
         patcher.patch(url, 'parse', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -25,7 +25,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
@@ -66,6 +66,7 @@ module.exports = function(core) {
         patcher.patch(url, 'URLSearchParams', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, obj, result } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
@@ -120,6 +121,7 @@ module.exports = function(core) {
             patcher.patch(obj.prototype, 'toString', {
               name: 'url.URLSearchParams.toString',
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const { obj: params } = data;
 

package/lib/dataflow/propagation/install/url/url.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     depHooks,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -92,6 +92,7 @@ module.exports = function(core) {
         patcher.patch(url, 'URL', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/util-format.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         return patcher.patch(util, 'format', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !isString(args[0]) || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -70,6 +70,7 @@ module.exports = function (core) {
             return patcher.patch(...getPatcherArgs(index), {
               name,
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const matches = validator === 'matches';
                 if (
@@ -105,6 +106,7 @@ module.exports = function (core) {
           (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${untracker}`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               if (data.result && getSourceContext()) {
                 const trackingData = tracker.getData(data.args[0]);

package/lib/dataflow/sinks/install/child-process.js

@@ -34,7 +34,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -64,7 +64,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/fs-original.js

@@ -0,0 +1,170 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+const { patchType } = require('../common');
+
+const {
+  DataflowTag: {
+    URL_ENCODED,
+    LIMITED_CHARS,
+    ALPHANUM_SPACE_HYPHEN,
+    SAFE_PATH,
+    UNTRUSTED,
+  },
+  FS_METHODS,
+  Rule: { PATH_TRAVERSAL: ruleId },
+  isString,
+  ArrayPrototypeJoin,
+} = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    assess: {
+      inspect, // TODO NODE-3455: remove
+      getSourceContext,
+      eventFactory: { createSinkEvent },
+      dataflow: {
+        tracker,
+        sinks: { isVulnerable, reportFindings },
+      },
+    },
+  } = core;
+
+  const safeTags = [
+    `excluded:${ruleId}`,
+    URL_ENCODED,
+    LIMITED_CHARS,
+    ALPHANUM_SPACE_HYPHEN,
+    SAFE_PATH,
+  ];
+
+  function getValues(indices, args) {
+    return indices.reduce((acc, idx) => {
+      const value = args[idx];
+      if (value && isString(value)) acc.push(value);
+      return acc;
+    }, []);
+  }
+
+  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
+    const { name: methodName, indices } = method;
+    if (!getSourceContext(RULE, ruleId)) return;
+
+    const values = getValues(indices, data.args);
+    if (!values.length) return;
+
+    const args = values.map((v) => {
+      const strInfo = tracker.getData(v);
+      return {
+        value: strInfo ? strInfo.value : v,
+        tracked: !!strInfo,
+        strInfo
+      };
+    });
+    for (let i = 0; i < values.length; i++) {
+      const { strInfo } = args[i];
+
+      if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
+        continue;
+      }
+
+      const event = createSinkEvent({
+        name,
+        moduleName,
+        methodName: fullMethodName || methodName,
+        context: `${name}(${ArrayPrototypeJoin.call(
+          args.map((a) => inspect(a.value)),
+          ', '
+        )})`,
+        history: [strInfo],
+        object: {
+          value: 'fs',
+          tracked: false,
+        },
+        args: args.map(({ value, tracked }) => ({ value, tracked })),
+        tags: strInfo.tags,
+        source: `P${i}`,
+        stacktraceOpts: {
+          contructorOpt: data.hooked,
+          prependFrames: [data.orig],
+        },
+      });
+
+      if (event) {
+        reportFindings({
+          ruleId,
+          sinkEvent: event,
+        });
+      }
+    }
+  };
+
+  core.assess.dataflow.sinks.pathTraversal = {
+    install() {
+      depHooks.resolve({ name: 'fs' }, (fs) => {
+        for (const method of FS_METHODS) {
+          // not all methods are available on every OS or Node version.
+          if (fs[method.name]) {
+            const name = `fs.${method.name}`;
+            patcher.patch(fs, method.name, {
+              name,
+              patchType,
+              pre: pre(name, method),
+            });
+          }
+
+          if (method.sync) {
+            const syncName = `${method.name}Sync`;
+            if (fs[syncName]) {
+              const name = `fs.${syncName}`;
+              patcher.patch(fs, syncName, {
+                name,
+                patchType,
+                pre: pre(name, method, 'fs', syncName),
+              });
+            }
+          }
+
+          if (method.promises && fs.promises && fs.promises[method.name]) {
+            const name = `fs.promises.${method.name}`;
+            patcher.patch(fs.promises, method.name, {
+              name,
+              patchType,
+              pre: pre(name, method, 'fs.promises'),
+            });
+          }
+        }
+      });
+
+      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
+        for (const method of FS_METHODS) {
+          if (method.promises && fsPromises[method.name]) {
+            const name = `fsPromises.${method.name}`;
+            patcher.patch(fsPromises, method.name, {
+              name,
+              patchType,
+              pre: pre(name, method, 'fsPromises'),
+            });
+          }
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.sinks.pathTraversal;
+};

package/lib/dataflow/sinks/install/fs.js

@@ -35,7 +35,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/function.js

@@ -46,7 +46,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/http/request.js

@@ -46,7 +46,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -46,7 +46,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/libxmljs.js

@@ -47,7 +47,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/marsdb.js

@@ -50,7 +50,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/mongodb.js

@@ -82,7 +82,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/mysql.js

@@ -53,7 +53,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {