@contrast/assess 1.37.0 → 1.38.0

package/lib/crypto-analysis/install/crypto.js

@@ -50,7 +50,7 @@ const SAFE_HASH_ALGORITHMS = new Set([
   'sha512',
   'sha512withrsaencryption',
 ]);
-const SAFE_HASH_LIBS = ['etag', 'browserify', 'deps-sort'];
+const SAFE_HASH_LIBS = ['etag', 'browserify', 'deps-sort', 'cookie-signature'];
 const SAFE_CIPHER_ALGORITHM_PREFIXES = ['des-ede', 'id-aes', 'aes', 'rsa'];
 
 /**

package/lib/dataflow/propagation/install/JSON/parse.js

@@ -100,6 +100,7 @@ module.exports = function (core) {
       patcher.patch(JSON, 'parse', {
         name: 'JSON.parse',
         patchType,
+        usePerf: 'sync',
         pre(data) {
           if (!data.args[0] || !getSourceContext(PROPAGATOR)) return;
           const [input, reviver] = data.args;

package/lib/dataflow/propagation/install/JSON/stringify.js

@@ -165,6 +165,7 @@ module.exports = function(core) {
       patcher.patch(JSON, 'stringify', {
         name: 'JSON.stringify',
         patchType,
+        usePerf: 'sync',
         pre(data) {
           if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -69,6 +69,7 @@ module.exports = function(core) {
       patcher.patch(Array.prototype, 'join', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/buffer.js

@@ -82,6 +82,7 @@ module.exports = function(core) {
       patcher.patch(global.Buffer, 'from', {
         patchType,
         name: bufferFrom,
+        usePerf: 'sync',
         post(data) {
           const firstArg = data.args[0];
           const argType = isString(firstArg) ? 'string' : Buffer.isBuffer(firstArg) ? 'buffer' : null;

package/lib/dataflow/propagation/install/contrast-methods/number.js

@@ -36,6 +36,7 @@ module.exports = function (core) {
       patcher.patch(global.ContrastMethods, 'Number', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args: [value], result } = data;
           if (

package/lib/dataflow/propagation/install/contrast-methods/string.js

@@ -44,6 +44,7 @@ module.exports = function(core) {
       patcher.patch(global.ContrastMethods, 'String', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           if (!data.result || !getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -33,6 +33,7 @@ module.exports = function(core) {
       patcher.patch(global.ContrastMethods, 'tag', {
         name: 'ContrastMethods.tag',
         patchType,
+        usePerf: 'sync',
         post(data) {
           if (!data.result || !getSourceContext(PROPAGATOR)) {
             return;

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(global, 'decodeURIComponent', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
           if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -38,6 +38,7 @@ module.exports = function(core) {
         patcher.patch(ejsUtils, 'escapeXML', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/ejs/template.js

@@ -60,6 +60,7 @@ module.exports = function (core) {
         patcher.patch(_export.Template.prototype, 'generateSource', {
           name: 'ejs.Template.prototype.generateSource',
           patchType,
+          usePerf: 'sync',
           post(data) {
             if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/encode-uri.js

@@ -48,6 +48,7 @@ module.exports = function(core) {
         patcher.patch(global, methodName, {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/escape-html.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         return patcher.patch(escapeHtml, {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/escape.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(global, 'escape', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
           if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/fastify-send.js

@@ -30,6 +30,7 @@ module.exports = function (core) {
         patcher.patch(_SendStream.prototype, 'sendFile', {
           name: '@fastify/send/lib/SendStream.js',
           patchType,
+          usePerf: 'sync',
           pre(data) {
             const { args } = data;
 

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         patcher.patch(handlebars.Utils, 'escapeExpression', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/isnumeric-0.js

@@ -38,6 +38,7 @@ module.exports = function (core) {
         return patcher.patch(_export, {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args: [value], result } = data;
             if (

package/lib/dataflow/propagation/install/joi/boolean.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -45,6 +45,7 @@ module.exports = function(core) {
     patcher.patch(def.coerce, 'method', {
       name: 'joi.boolean.coerce',
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (
           !data.result?.value ||

package/lib/dataflow/propagation/install/joi/expression.js

@@ -24,7 +24,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -38,6 +38,7 @@ module.exports = function(core) {
     return patcher.patch(joi, method, {
       name: `joi.${method}`,
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (!data.result || !getSourceContext()) return;
 

package/lib/dataflow/propagation/install/joi/index.js

@@ -29,7 +29,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -46,6 +46,7 @@ module.exports = function(core) {
       patcher.patch(parentObj, 'validateAsync', {
         name: `Joi.${parentObjType}.validateAsync`,
         patchType,
+        usePerf: 'tbd',
         post(data) {
           const childNodes = data.obj?.$_terms.items?.length
             ? data.obj.$_terms.items
@@ -96,6 +97,7 @@ module.exports = function(core) {
       patcher.patch(parentObj.rules.custom, 'validate', {
         name: `joi.${objName}.custom.valdiate`,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const {
             args: [input, schema],

package/lib/dataflow/propagation/install/joi/keys.js

@@ -131,6 +131,7 @@ module.exports = function(core) {
           patcher.patch(Object.getPrototypeOf(joi), 'keys', {
             name: 'joi.keys',
             patchType,
+            usePerf: 'sync',
             pre(data) {
               const [value] = data.args;
               const joi = data.obj.$_root;

package/lib/dataflow/propagation/install/joi/number.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -43,6 +43,7 @@ module.exports = function(core) {
     patcher.patch(def.coerce, 'method', {
       name: 'joi.number.coerce',
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (
           !data.result?.value ||

package/lib/dataflow/propagation/install/joi/string-schema.js

@@ -42,7 +42,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: {
         tracker, propagation: {
@@ -105,6 +105,7 @@ module.exports = function(core) {
     patcher.patch(validatorObj, 'validate', {
       name: patchName,
       patchType,
+      usePerf: 'sync',
       post(data) {
         const [input, schema] = data.args;
 
@@ -137,6 +138,7 @@ module.exports = function(core) {
     patcher.patch(coerce, 'method', {
       name: 'joi.string._definition.coerce',
       patchType,
+      usePerf: 'sync',
       post(data) {
         const { args, result } = data;
 

package/lib/dataflow/propagation/install/joi/values.js

@@ -27,7 +27,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -37,6 +37,7 @@ module.exports = function(core) {
     patcher.patch(values.prototype, 'get', {
       name: 'joi.values',
       patchType,
+      usePerf: 'sync',
       post(data) {
         const {
           args: [value, state, prefs],

package/lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -107,6 +107,7 @@ module.exports = function (core) {
         patcher.patch(SchemaMap.prototype, 'doValidateSync', {
           name: doValidateSyncName,
           patchType,
+          usePerf: 'sync',
           post: (data) => {
             if (!assess.trust_custom_validators || data.result || !getSourceContext()) return;
 
@@ -119,6 +120,7 @@ module.exports = function (core) {
         patcher.patch(SchemaMap.prototype, 'doValidate', {
           name: doValidateName,
           patchType,
+          usePerf: 'tbd',
           pre: (data) => {
             if (!assess.trust_custom_validators) return;
 

package/lib/dataflow/propagation/install/mongoose/schema-mixed.js

@@ -134,6 +134,7 @@ module.exports = function (core) {
         patcher.patch(SchemaMixed.prototype, 'doValidate', {
           name: doValidateName,
           patchType,
+          usePerf: 'tbd',
           pre: (data) => {
             if (!assess.trust_custom_validators || !getSourceContext()) {
               return;
@@ -147,6 +148,7 @@ module.exports = function (core) {
             data.args[1] = patcher.patch(cb, {
               name: doValidateName,
               patchType,
+              usePerf: 'tbd',
               pre({ args: [err] }) {
                 if (err) return;
 

package/lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -132,6 +132,7 @@ module.exports = function (core) {
     patcher.patch(SchemaString.prototype, 'enum', {
       name: 'mongoose.SchemaString.prototype.enum',
       patchType,
+      usePerf: 'sync',
       post(data) {
         if (!data.result) return;
 
@@ -144,6 +145,7 @@ module.exports = function (core) {
         patcher.patch(enumValidator, 'validator', {
           name: 'mongoose.SchemaString.prototype.enum.validator',
           patchType,
+          usePerf: 'sync',
           post(data) {
             const sourceContext = sources.getStore()?.assess;
             if (!sourceContext) return;
@@ -163,6 +165,7 @@ module.exports = function (core) {
     patcher.patch(SchemaString.prototype, 'doValidate', {
       name,
       patchType,
+      usePerf: 'tbd',
       pre(data) {
         const [value, cb] = data.args;
         if (!value || typeof cb !== 'function' || !getSourceContext()) return;
@@ -174,6 +177,7 @@ module.exports = function (core) {
         data.args[1] = patcher.patch(cb, {
           name,
           patchType,
+          usePerf: 'tbd',
           pre(data) {
             const {
               args: [err],
@@ -203,6 +207,7 @@ module.exports = function (core) {
     patcher.patch(SchemaString.prototype, 'doValidateSync', {
       name,
       patchType,
+      usePerf: 'sync',
       post(data) {
         const {
           args: [value],

package/lib/dataflow/propagation/install/mustache-escape.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         return patcher.patch(mustache, 'escape', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -92,6 +92,7 @@ module.exports = function(core) {
           patcher.patch(mysql, 'escape', {
             name: `${lib}.escape`,
             patchType,
+            usePerf: 'sync',
             post: createPostHook(`${lib}.escape`, `${createModuleLabel(lib, version)}`)
           });
         });
@@ -101,6 +102,7 @@ module.exports = function(core) {
         patcher.patch(mysqlConnection.prototype, 'escape', {
           name: 'mysql.Connection.prototype.escape',
           patchType,
+          usePerf: 'sync',
           post: createPostHook('mysql/lib/Connection.escape', `[${createModuleLabel('mysql', version)}].Connection`)
         });
       });
@@ -109,6 +111,7 @@ module.exports = function(core) {
         patcher.patch(mysqlConnection.prototype, 'escape', {
           name: 'mysql.Connection.prototype.escape',
           patchType,
+          usePerf: 'sync',
           post: createPostHook('mysql2/lib/connection.Connection.escape', `[${createModuleLabel('mysql2', version)}].Connection`)
         });
       });

package/lib/dataflow/propagation/install/parse-int.js

@@ -36,6 +36,7 @@ module.exports = function (core) {
       patcher.patch(global, 'parseInt', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args: [value], result } = data;
           if (

package/lib/dataflow/propagation/install/path/basename.js

@@ -40,6 +40,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'basename', {
             name: `path.${os}.basename`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args: origArgs, result, name, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/path/dirname.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'dirname', {
             name: `path.${os}.dirname`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/path/extname.js

@@ -41,6 +41,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'extname', {
             name: `path.${os}.extname`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/format.js

@@ -41,6 +41,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'format', {
             name: `path.${os}.format`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name: patchName, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -43,6 +43,7 @@ module.exports = function(core) {
             patcher.patch(path[os], method, {
               name,
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const { args: origArgs, result, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/path/normalize.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'normalize', {
             name: `path.${os}.normalize`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/parse.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker },
     },
@@ -41,6 +41,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'parse', {
             name: `path.${os}.parse`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name: patchName, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/relative.js

@@ -40,6 +40,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'relative', {
             name: `path.${os}.relative`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/path/toNamespacedPath.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(path[os], 'toNamespacedPath', {
             name: `path.${os}.toNamespacedPath`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, name, hooked, orig } = data;
               if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/pug/index.js

@@ -38,6 +38,7 @@ module.exports = function (core) {
         (pug) => patcher.patch(pug, 'compile', {
           name: 'pug.compile',
           patchType,
+          usePerf: 'tbd',
           pre(data) {
             if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         patcher.patch(pugRuntime, 'escape', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/querystring/escape.js

@@ -23,7 +23,7 @@ module.exports = function(core) {
   const {
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     },
@@ -37,6 +37,7 @@ module.exports = function(core) {
         patcher.patch(_export, 'escape', {
           name: 'querystring.escape',
           patchType,
+          usePerf: 'sync',
           post(data) {
             const [value] = data.args;
             if (!value?.length || !data.result?.length) return value;

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -105,6 +105,7 @@ module.exports = function(core) {
           patcher.patch(module, method, {
             name: `querystring.${method}`,
             patchType,
+            usePerf: 'sync',
             pre(data) {
               if (!data.args[0] || !getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/querystring/stringify.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
   const {
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       dataflow: { tracker },
       eventFactory: { createPropagationEvent },
     },
@@ -147,6 +147,7 @@ module.exports = function(core) {
           patcher.patch(_export, methodName, {
             name: `querystring.${methodName}`,
             patchType,
+            usePerf: 'sync',
             pre,
             post
           });

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -78,6 +78,7 @@ module.exports = function(core) {
       patcher.patch(RegExp.prototype, 'exec', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, obj, result, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/send.js

@@ -31,6 +31,7 @@ module.exports = function (core) {
     return patcher.patch(sendModuleExport, {
       name: 'send',
       patchType,
+      usePerf: 'sync',
       post(data) {
         patcher.patch(data.result, 'sendFile', {
           name: 'send.sendFile',

package/lib/dataflow/propagation/install/sequelize/query-generator.js

@@ -50,6 +50,7 @@ module.exports = function(core) {
             patcher.patch(_export.prototype, 'quoteIdentifier', {
               name: `sequelize.${constructor}.prototype.quoteIdentifier`,
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const strInfo = tracker.getData(data.result);
                 if (!strInfo || !getSourceContext()) return;

package/lib/dataflow/propagation/install/sequelize/sql-string.js

@@ -62,6 +62,7 @@ module.exports = function(core) {
           patcher.patch(sqlString, 'escape', {
             name,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
         patcher.patch(sqlTemplateStrings, 'SQL', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext()) return;

package/lib/dataflow/propagation/install/string/concat.js

@@ -37,7 +37,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'concat', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         post(data) {
           const { obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -36,7 +36,7 @@ module.exports = function(core) {
         patcher.patch(String.prototype, method, {
           name,
           patchType,
-          usePerf: true,
+          usePerf: 'sync',
           post(data) {
             const { obj, result, hooked, orig } = data;
             if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -32,7 +32,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }

package/lib/dataflow/propagation/install/string/index.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
     return patcher.patch(matcherFn, {
       name,
       patchType,
-      usePerf: true,
+      usePerf: 'sync',
       pre(data) {
         const { args: origArgs, hooked, orig } = data;
         if (