@contrast/assess 1.37.0 → 1.38.0

package/lib/dataflow/propagation/install/string/match-all.js

@@ -75,7 +75,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'matchAll', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         around(origFn, data) {
           const { args, obj, hooked, orig } = data;
 

package/lib/dataflow/propagation/install/string/match.js

@@ -79,7 +79,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'match', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         around(origFn, data) {
           const { args, obj } = data;
           if (

package/lib/dataflow/propagation/install/string/replace.js

@@ -150,7 +150,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'replace', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         pre(data) {
           if (!getSourceContext(PROPAGATOR)) return;
 

package/lib/dataflow/propagation/install/string/slice.js

@@ -54,7 +54,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'slice', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/split.js

@@ -37,7 +37,7 @@ module.exports = function(core) {
       patcher.patch(String.prototype, 'split', {
         name,
         patchType,
-        usePerf: true,
+        usePerf: 'sync',
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (

package/lib/dataflow/propagation/install/string/substring.js

@@ -62,7 +62,7 @@ module.exports = function(core) {
         patcher.patch(String.prototype, method, {
           name: `String.prototype.${method}`,
           patchType,
-          usePerf: true,
+          usePerf: 'sync',
           post(data) {
             const { obj, args: origArgs, result, name, hooked, orig } = data;
             if (!result || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/string/trim.js

@@ -92,21 +92,21 @@ module.exports = function(core) {
         name: 'String.prototype.trim',
         patchType,
         post: createPostHook('trim'),
-        usePerf: true,
+        usePerf: 'sync',
       });
 
       patcher.patch(String.prototype, 'trimStart', {
         name: 'String.prototype.trimStart',
         patchType,
         post: createPostHook('trimStart'),
-        usePerf: true,
+        usePerf: 'sync',
       });
 
       patcher.patch(String.prototype, 'trimEnd', {
         name: 'String.prototype.trimEnd',
         patchType,
         post: createPostHook('trimEnd', 0),
-        usePerf: true,
+        usePerf: 'sync',
       });
     },
     uninstall() {

package/lib/dataflow/propagation/install/unescape.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       patcher.patch(global, 'unescape', {
         name,
         patchType,
+        usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
           if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
           patcher.patch(url, method, {
             name,
             patchType,
+            usePerf: 'sync',
             post(data) {
               const { args, result, hooked, orig } = data;
               if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/url/parse.js

@@ -24,7 +24,7 @@ module.exports = function(core) {
     depHooks,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -87,6 +87,7 @@ module.exports = function(core) {
         patcher.patch(url, 'parse', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -25,7 +25,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
@@ -66,6 +66,7 @@ module.exports = function(core) {
         patcher.patch(url, 'URLSearchParams', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, obj, result } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
@@ -120,6 +121,7 @@ module.exports = function(core) {
             patcher.patch(obj.prototype, 'toString', {
               name: 'url.URLSearchParams.toString',
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const { obj: params } = data;
 

package/lib/dataflow/propagation/install/url/url.js

@@ -26,7 +26,7 @@ module.exports = function(core) {
     depHooks,
     assess: {
       getSourceContext,
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -92,6 +92,7 @@ module.exports = function(core) {
         patcher.patch(url, 'URL', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result } = data;
             if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/util-format.js

@@ -39,6 +39,7 @@ module.exports = function(core) {
         return patcher.patch(util, 'format', {
           name,
           patchType,
+          usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
             if (!result || !args[0] || !isString(args[0]) || !getSourceContext(PROPAGATOR)) return;

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -70,6 +70,7 @@ module.exports = function (core) {
             return patcher.patch(...getPatcherArgs(index), {
               name,
               patchType,
+              usePerf: 'sync',
               post(data) {
                 const matches = validator === 'matches';
                 if (
@@ -105,6 +106,7 @@ module.exports = function (core) {
           (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${untracker}`,
             patchType,
+            usePerf: 'sync',
             post(data) {
               if (data.result && getSourceContext()) {
                 const trackingData = tracker.getData(data.args[0]);

package/lib/dataflow/sinks/install/child-process.js

@@ -34,7 +34,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -64,7 +64,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/fs-original.js

@@ -0,0 +1,170 @@
+/*
+ * Copyright: 2024 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+'use strict';
+const { patchType } = require('../common');
+
+const {
+  DataflowTag: {
+    URL_ENCODED,
+    LIMITED_CHARS,
+    ALPHANUM_SPACE_HYPHEN,
+    SAFE_PATH,
+    UNTRUSTED,
+  },
+  FS_METHODS,
+  Rule: { PATH_TRAVERSAL: ruleId },
+  isString,
+  ArrayPrototypeJoin,
+} = require('@contrast/common');
+const { InstrumentationType: { RULE } } = require('../../../constants');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    assess: {
+      inspect, // TODO NODE-3455: remove
+      getSourceContext,
+      eventFactory: { createSinkEvent },
+      dataflow: {
+        tracker,
+        sinks: { isVulnerable, reportFindings },
+      },
+    },
+  } = core;
+
+  const safeTags = [
+    `excluded:${ruleId}`,
+    URL_ENCODED,
+    LIMITED_CHARS,
+    ALPHANUM_SPACE_HYPHEN,
+    SAFE_PATH,
+  ];
+
+  function getValues(indices, args) {
+    return indices.reduce((acc, idx) => {
+      const value = args[idx];
+      if (value && isString(value)) acc.push(value);
+      return acc;
+    }, []);
+  }
+
+  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
+    const { name: methodName, indices } = method;
+    if (!getSourceContext(RULE, ruleId)) return;
+
+    const values = getValues(indices, data.args);
+    if (!values.length) return;
+
+    const args = values.map((v) => {
+      const strInfo = tracker.getData(v);
+      return {
+        value: strInfo ? strInfo.value : v,
+        tracked: !!strInfo,
+        strInfo
+      };
+    });
+    for (let i = 0; i < values.length; i++) {
+      const { strInfo } = args[i];
+
+      if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
+        continue;
+      }
+
+      const event = createSinkEvent({
+        name,
+        moduleName,
+        methodName: fullMethodName || methodName,
+        context: `${name}(${ArrayPrototypeJoin.call(
+          args.map((a) => inspect(a.value)),
+          ', '
+        )})`,
+        history: [strInfo],
+        object: {
+          value: 'fs',
+          tracked: false,
+        },
+        args: args.map(({ value, tracked }) => ({ value, tracked })),
+        tags: strInfo.tags,
+        source: `P${i}`,
+        stacktraceOpts: {
+          contructorOpt: data.hooked,
+          prependFrames: [data.orig],
+        },
+      });
+
+      if (event) {
+        reportFindings({
+          ruleId,
+          sinkEvent: event,
+        });
+      }
+    }
+  };
+
+  core.assess.dataflow.sinks.pathTraversal = {
+    install() {
+      depHooks.resolve({ name: 'fs' }, (fs) => {
+        for (const method of FS_METHODS) {
+          // not all methods are available on every OS or Node version.
+          if (fs[method.name]) {
+            const name = `fs.${method.name}`;
+            patcher.patch(fs, method.name, {
+              name,
+              patchType,
+              pre: pre(name, method),
+            });
+          }
+
+          if (method.sync) {
+            const syncName = `${method.name}Sync`;
+            if (fs[syncName]) {
+              const name = `fs.${syncName}`;
+              patcher.patch(fs, syncName, {
+                name,
+                patchType,
+                pre: pre(name, method, 'fs', syncName),
+              });
+            }
+          }
+
+          if (method.promises && fs.promises && fs.promises[method.name]) {
+            const name = `fs.promises.${method.name}`;
+            patcher.patch(fs.promises, method.name, {
+              name,
+              patchType,
+              pre: pre(name, method, 'fs.promises'),
+            });
+          }
+        }
+      });
+
+      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
+        for (const method of FS_METHODS) {
+          if (method.promises && fsPromises[method.name]) {
+            const name = `fsPromises.${method.name}`;
+            patcher.patch(fsPromises, method.name, {
+              name,
+              patchType,
+              pre: pre(name, method, 'fsPromises'),
+            });
+          }
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.sinks.pathTraversal;
+};

package/lib/dataflow/sinks/install/fs.js

@@ -35,7 +35,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/function.js

@@ -46,7 +46,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.js

@@ -45,7 +45,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/http/request.js

@@ -46,7 +46,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -46,7 +46,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/libxmljs.js

@@ -47,7 +47,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/marsdb.js

@@ -50,7 +50,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/mongodb.js

@@ -82,7 +82,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/mysql.js

@@ -53,7 +53,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/postgres.js

@@ -42,7 +42,7 @@ module.exports = function(core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/sequelize.js

@@ -41,7 +41,7 @@ module.exports = function (core) {
     patcher,
     config,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/dataflow/sinks/install/vm.js

@@ -57,7 +57,7 @@ module.exports = function (core) {
     depHooks,
     patcher,
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSinkEvent },
       dataflow: {

package/lib/sampler.js

@@ -71,9 +71,9 @@ module.exports = function assess(core) {
         assess.sampler = SamplerFactory[strategy](opts);
       }
     } else {
+      if (assess.sampler) logger.info('assess sampling disabled');
       // disable sampling by setting sampler to null
       assess.sampler = null;
-      logger.info('assess sampling disabled');
     }
   }
 

package/lib/sampler.test.js

@@ -4,6 +4,7 @@ const { EventEmitter } = require('events');
 const { expect } = require('chai');
 const { Event } = require('@contrast/common');
 const mocks = require('@contrast/test/mocks');
+const { devNull } = require('node:os');
 
 const TRIALS = 1000;
 const ZSCORE = 3.891; // 99.99% confidence
@@ -135,7 +136,11 @@ describe('assess sampler', function() {
 
   it('sampler behavior adjusts to series of TS updates', function() {
     // setup
+    const cfgPath = process.env.CONTRAST_CONFIG_PATH;
+    process.env.CONTRAST_CONFIG_PATH = devNull;
     const core = initMockCore();
+    process.env.CONTRAST_CONFIG_PATH = cfgPath;
+
     core.config.setValue('assess.enable', true, 'CONTRAST_UI');
     core.config.setValue('assess.probabilistic_sampling.enable', false, 'DEFAULT_VALUE');
     core.config.setValue('assess.probabilistic_sampling.base_probability', 0.50, 'CONTRAST_UI');
@@ -193,8 +198,6 @@ describe('assess sampler', function() {
 
     // test logging throughout init/updates
     expect(core.logger.info.getCalls().map(c => c.args)).to.deep.equal([
-      // when initialized
-      ['assess sampling disabled'],
       // update 1: env=PRODUCTION enables sampling
       [
         { strategy: 'probabilistic', opts: { base_probability: 0.5 } },
@@ -218,11 +221,11 @@ describe('assess sampler', function() {
 
 function initMockCore() {
   const { CONTRAST_CONFIG_PATH } = process.env;
+  process.env.CONTRAST_CONFIG_PATH = devNull;
+
   let core;
 
   try {
-    // ensure default config if devs use this
-    process.env.CONTRAST_CONFIG_PATH = '';
     core = {
       // sampler needs this namespace to exist
       assess: {},
@@ -235,12 +238,14 @@ function initMockCore() {
     require('@contrast/config')(core);
     core.config.setValue('assess.enable', true, 'CONTRAST_UI');
   } catch (err) {
+    process.env.CONTRAST_CONFIG_PATH = CONTRAST_CONFIG_PATH;
+
     console.dir(err);
     throw err;
   }
 
   // reset to orig value
-  if (CONTRAST_CONFIG_PATH) process.env.CONTRAST_CONFIG_PATH = CONTRAST_CONFIG_PATH;
+  process.env.CONTRAST_CONFIG_PATH = CONTRAST_CONFIG_PATH;
 
   return core;
 }

package/lib/session-configuration/install/express-session.js

@@ -26,7 +26,7 @@ const { patchType } = require('../common');
 module.exports = function (core) {
   const {
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSessionEvent },
       sessionConfiguration: {

package/lib/session-configuration/install/fastify-cookie.js

@@ -26,7 +26,7 @@ const { patchType } = require('../common');
 module.exports = function (core) {
   const {
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSessionEvent },
       sessionConfiguration: {

package/lib/session-configuration/install/hapi.js

@@ -19,7 +19,7 @@ const { patchType } = require('../common');
 module.exports = function (core) {
   const {
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       eventFactory: { createSessionEvent },
       sessionConfiguration: {
         handleHttpOnly,

package/lib/session-configuration/install/koa.js

@@ -25,7 +25,7 @@ const { patchType } = require('../common');
 module.exports = function (core) {
   const {
     assess: {
-      inspect, // todo: remove
+      inspect, // TODO NODE-3455: remove
       getSourceContext,
       eventFactory: { createSessionEvent },
       sessionConfiguration: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -18,15 +18,15 @@
   },
   "dependencies": {
     "@contrast/common": "1.26.0",
-    "@contrast/config": "1.34.0",
-    "@contrast/core": "1.39.0",
-    "@contrast/dep-hooks": "1.7.0",
+    "@contrast/config": "1.35.0",
+    "@contrast/core": "1.40.0",
+    "@contrast/dep-hooks": "1.8.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.17.0",
-    "@contrast/logger": "1.12.0",
-    "@contrast/patcher": "1.11.0",
-    "@contrast/rewriter": "1.15.0",
-    "@contrast/scopes": "1.8.0",
+    "@contrast/instrumentation": "1.18.0",
+    "@contrast/logger": "1.13.0",
+    "@contrast/patcher": "1.12.0",
+    "@contrast/rewriter": "1.16.0",
+    "@contrast/scopes": "1.9.0",
     "semver": "^7.6.0"
   }
 }