@contrast/assess 1.39.0 → 1.41.0

package/lib/dataflow/propagation/install/path/index.test.js

@@ -4,7 +4,7 @@ const sinon = require('sinon');
 const { expect } = require('chai');
 const { initAssessFixture } = require('@contrast/test/fixtures');
 
-describe('assess dataflow propagation string', function () {
+describe('assess dataflow propagation path', function () {
   let core, instr;
 
   beforeEach(function () {

package/lib/dataflow/sinks/install/express/reflected-xss.js

@@ -72,7 +72,7 @@ module.exports = function(core) {
   ];
 
   reflectedXss.install = function() {
-    depHooks.resolve({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/response' }, (Response) => {
+    depHooks.resolve({ name: 'express', version: '>=4 <6', file: 'lib/response' }, (Response) => {
       const name = 'Express.Response.send';
       patcher.patch(Response, 'send', {
         name,

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -67,7 +67,7 @@ module.exports = function(core) {
   ];
 
   unvalidatedRedirect.install = function() {
-    depHooks.resolve({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/response' }, (Response) => {
+    depHooks.resolve({ name: 'express', version: '>=4 <6', file: 'lib/response' }, (Response) => {
       const name = 'Express.Response.location';
       patcher.patch(Response, 'location', {
         name: 'Express.Response.location',

package/lib/dataflow/sources/install/body-parser1.js

@@ -42,7 +42,6 @@ module.exports = function init(core) {
       const sourceContext = getSourceContext(SOURCE);
 
       if (!sourceContext) {
-        logger.error({ funcKey: data.funcKey }, 'unable to handle source. Missing `sourceContext`');
         return next(...args);
       }
 

package/lib/dataflow/sources/install/body-parser1.test.js

@@ -112,10 +112,8 @@ describe('assess dataflow sources body-parser v1', function () {
         middleware(req, res, next);
 
         expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        expect(core.logger.error).to.have.been.calledWith(
-          { funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
-          'unable to handle source. Missing `sourceContext`'
-        );
+        expect(core.logger.trace.callCount).greaterThan(0);
+        expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
       }, { assess: { policy: null } });
     });
 
@@ -210,10 +208,8 @@ describe('assess dataflow sources body-parser v1', function () {
           middleware(req, res, next);
 
           expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-          expect(core.logger.error).to.have.been.calledWith(
-            { funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
-            'unable to handle source. Missing `sourceContext`',
-          );
+          expect(core.logger.trace.callCount).greaterThan(0);
+          expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
         }, { assess: { policy: null } });
       });
 

package/lib/dataflow/sources/install/cookie-parser1.js

@@ -43,7 +43,6 @@ module.exports = function init(core) {
                     const sourceContext = assess.getSourceContext(SOURCE);
 
                     if (!sourceContext) {
-                      logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                       return next(...args);
                     }
 

package/lib/dataflow/sources/install/cookie-parser1.test.js

@@ -74,10 +74,8 @@ describe('assess dataflow sources cookie-parser v1', function () {
       middleware(req, res, next);
 
       expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.error).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
-        'unable to handle source. Missing `sourceContext`',
-      );
+      expect(core.logger.trace.callCount).greaterThan(0);
+      expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
     }, { assess: { policy: null } });
   });
 

package/lib/dataflow/sources/install/express/params.js

@@ -24,55 +24,74 @@ module.exports = function init(core) {
     logger,
     patcher,
     depHooks,
-    assess: { getSourceContext },
+    assess: {
+      getSourceContext,
+      dataflow: { sources }
+    },
   } = core;
 
+  function postHook(name) {
+    return function({ obj: layer, result, orig, hooked, funcKey }) {
+      // we can exit early if
+      //  the layer doesn't match the request or
+      //  the layer doesn't recognize any parameters
+      if (
+        !result ||
+        !layer.keys ||
+        layer.keys.length === 0
+      ) return;
+
+      const sourceContext = getSourceContext(SOURCE);
+      if (!sourceContext) return;
+
+      if (sourceContext.parsedParams) {
+        logger.trace({ funcKey }, 'values already tracked');
+        return;
+      }
+
+      try {
+        sources.handle({
+          context: 'req.params',
+          name,
+          inputType: InputType.PARAMETER_VALUE,
+          stacktraceOpts: {
+            constructorOpt: hooked,
+            prependFrames: [orig]
+          },
+          data: layer.params,
+          sourceContext
+        });
+        sourceContext.parsedParams = true;
+      } catch (err) {
+        logger.error({ err, funcKey }, 'unable to handle source');
+      }
+    };
+  }
+
   core.assess.dataflow.sources.expressInstrumentation.params = {
     install() {
       const name = 'Layer.prototype.match';
       depHooks.resolve(
-        { name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/router/layer.js' },
+        { name: 'express', version: '>=4 <5', file: 'lib/router/layer.js' },
         (Layer) => {
           patcher.patch(Layer.prototype, 'match', {
             name,
             patchType,
-            post({ obj: layer, result, orig, hooked, funcKey }) {
-              // we can exit early if
-              //  the layer doesn't match the request or
-              //  the layer doesn't recognize any parameters
-              if (
-                !result ||
-                !layer.keys ||
-                layer.keys.length === 0
-              ) return;
-
-              const sourceContext = getSourceContext(SOURCE);
-              if (!sourceContext) return;
-
-              if (sourceContext.parsedParams) {
-                logger.trace({ funcKey }, 'values already tracked');
-                return;
-              }
-
-              try {
-                core.assess.dataflow.sources.handle({
-                  context: 'req.params',
-                  name,
-                  inputType: InputType.PARAMETER_VALUE,
-                  stacktraceOpts: {
-                    constructorOpt: hooked,
-                    prependFrames: [orig]
-                  },
-                  data: layer.params,
-                  sourceContext
-                });
-                sourceContext.parsedParams = true;
-              } catch (err) {
-                logger.error({ err, funcKey }, 'unable to handle source');
-              }
-            }
+            post: postHook(name)
           });
+          return Layer;
+        }
+      );
 
+      // Used by Express 5
+      depHooks.resolve(
+        { name: 'router', version: '>=2 <3', file: 'lib/layer.js' },
+        (Layer) => {
+          patcher.patch(Layer.prototype, 'match', {
+            name,
+            patchType,
+            post: postHook(name)
+          });
           return Layer;
         }
       );

package/lib/dataflow/sources/install/express/params.test.js

@@ -8,96 +8,103 @@ const { InputType } = require('@contrast/common');
 describe('assess dataflow sources express params', function () {
   let core, simulateRequestScope, Layer, layer;
 
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    const LayerMock = sinon.stub();
-    LayerMock.prototype.match = sinon.stub().returns(true);
-
-    require('./params')(core).install();
-    Layer = core.depHooks.resolve.yield(LayerMock)[0];
-    layer = { keys: ['foo'], params: { foo: 'bar' } };
-  });
+  [
+    { name: 'express', version: '>=4 <5', file: 'lib/router/layer.js' },
+    { name: 'router', version: '>=2 <3', file: 'lib/layer.js' }
+  ].forEach((args) => {
+    describe(`Express${args.name === 'express' ? '4' : '5'}`, function() {
+      beforeEach(function () {
+        ({ core, simulateRequestScope } = initAssessFixture());
+
+        sinon.stub(core.assess.dataflow.sources, 'handle');
+
+        const LayerMock = sinon.stub();
+        LayerMock.prototype.match = sinon.stub().returns(true);
+
+        require('./params')(core).install();
+        [Layer] = core.depHooks.resolve.withArgs(args).yield(LayerMock);
+        layer = { keys: ['foo'], params: { foo: 'bar' } };
+      });
 
-  it('calls `.handle` when `match` adds params (and keys) to the Layer instance', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
-        context: 'req.params',
-        name: 'Layer.prototype.match',
-        inputType: InputType.PARAMETER_VALUE,
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-          prependFrames: sinon.match.array,
-        },
-        data: layer.params,
-        sourceContext: core.scopes.sources.getStore().assess
+      it('calls `.handle` when `match` adds params (and keys) to the Layer instance', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
+            context: 'req.params',
+            name: 'Layer.prototype.match',
+            inputType: InputType.PARAMETER_VALUE,
+            stacktraceOpts: {
+              constructorOpt: sinon.match.func,
+              prependFrames: sinon.match.array,
+            },
+            data: layer.params,
+            sourceContext: core.scopes.sources.getStore().assess
+          });
+        });
       });
-    });
-  });
 
-  it('does not call `.handle` when `match` returns false', function () {
-    Layer.prototype.match.returns(false);
+      it('does not call `.handle` when `match` returns false', function () {
+        Layer.prototype.match.returns(false);
 
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
 
-  it('does not call `.handle` when the layer is missing the expected properties', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, {}, ['/bar']);
+      it('does not call `.handle` when the layer is missing the expected properties', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, {}, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
 
-  it('does not call `.handle` when `match` adds no params or keys', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, { keys: [], params: {} }, ['/bar']);
+      it('does not call `.handle` when `match` adds no params or keys', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, { keys: [], params: {} }, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
 
-  it('does not handle when there is no assess policy in request context', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+      it('does not handle when there is no assess policy in request context', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    }, { assess: { policy: null } });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        }, { assess: { policy: null } });
+      });
 
-  it('does not call `.handle` when the values are already tracked', function () {
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedParams = true;
+      it('does not call `.handle` when the values are already tracked', function () {
+        simulateRequestScope(() => {
+          core.scopes.sources.getStore().assess.parsedParams = true;
 
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
-        'values already tracked'
-      );
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+          expect(core.logger.trace).to.have.been.calledWith(
+            { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+            'values already tracked'
+          );
+        });
+      });
 
-  it('handles a case with an error in the `.handle` method', function () {
-    const err = new Error('test');
-    core.assess.dataflow.sources.handle.throws(err);
+      it('handles a case with an error in the `.handle` method', function () {
+        const err = new Error('test');
+        core.assess.dataflow.sources.handle.throws(err);
 
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:Layer.prototype.match' },
-        'unable to handle source'
-      );
+          expect(core.logger.error).to.have.been.calledWith(
+            { err, funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+            'unable to handle source'
+          );
+        });
+      });
     });
   });
 });

package/lib/dataflow/sources/install/express/parsedUrl.js

@@ -29,10 +29,41 @@ module.exports = function init(core) {
     patcher,
   } = core;
 
+  function preHook(name, args) {
+    return function(data) {
+      const [req] = args || data.args;
+
+      const sourceContext = getSourceContext(SOURCE);
+      if (!sourceContext) return;
+
+      const sourceInfo = {
+        context: 'req._parsedUrl',
+        data: req._parsedUrl,
+        name,
+        sourceContext,
+        stacktraceOpts: {
+          constructorOpt: data.hooked
+        }
+      };
+
+      sources.handle({
+        ...sourceInfo,
+        inputType: InputType.URI,
+        keys: ['href', 'path', 'pathname'],
+      });
+
+      sources.handle({
+        ...sourceInfo,
+        inputType: InputType.QUERYSTRING,
+        keys: ['query', 'search'],
+      });
+    };
+  }
+
   core.assess.dataflow.sources.expressInstrumentation.parsedUrl = {
     install() {
       depHooks.resolve(
-        { name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/middleware/init.js' },
+        { name: 'express', version: '>=4 <5', file: 'lib/middleware/init.js' },
         /** @param {import('express/lib/middleware/init')} mw */
         (mw) => {
           const name = 'express.middleware.init';
@@ -44,36 +75,10 @@ module.exports = function init(core) {
                 name: 'express.middleware.init.expressInit',
                 patchType,
                 pre(data) {
-                  const { args: [req] } = data;
                   patcher.patch(data.args, '2', {
                     name: 'express.middleware.init.expressInit.next',
                     patchType,
-                    pre(data) {
-                      const sourceContext = getSourceContext(SOURCE);
-                      if (!sourceContext) return;
-
-                      const sourceInfo = {
-                        context: 'req._parsedUrl',
-                        data: req._parsedUrl,
-                        name,
-                        sourceContext,
-                        stacktraceOpts: {
-                          constructorOpt: data.hooked
-                        }
-                      };
-
-                      sources.handle({
-                        ...sourceInfo,
-                        inputType: InputType.URI,
-                        keys: ['href', 'path', 'pathname'],
-                      });
-
-                      sources.handle({
-                        ...sourceInfo,
-                        inputType: InputType.QUERYSTRING,
-                        keys: ['query', 'search'],
-                      });
-                    }
+                    pre: preHook(name, data.args)
                   });
                 }
               });
@@ -81,6 +86,18 @@ module.exports = function init(core) {
           });
         }
       );
+
+      // Used by Express 5
+      depHooks.resolve(
+        { name: 'router', version: '>=2 <3', file: 'lib/layer.js' },
+        (Layer) => {
+          patcher.patch(Layer.prototype, 'handleRequest', {
+            name: 'Layer.prototype.handleRequest',
+            patchType,
+            pre: preHook('Layer.prototype.handleRequest')
+          });
+        }
+      );
     }
   };
 

package/lib/dataflow/sources/install/express/parsedUrl.test.js

@@ -13,38 +13,83 @@ describe('assess dataflow sources express parsedUrl', function () {
     instrumentation = core.assess.dataflow.sources.expressInstrumentation.parsedUrl;
     tracker = core.assess.dataflow.tracker;
     patcher = core.patcher;
+  });
 
-    req = {};
-    res = {};
-    middleware = {
-      init() {
-        return function (req, res, next) {
-          req._parsedUrl = {
-            href: '/some/path?asdf=jkl',
-            path: '/some/path?asdf=jkl',
-            pathname: '/some/path',
-            query: 'asdf=jkl',
-            search: '?asdf=jkl;',
+  describe('express4', function() {
+    beforeEach(function() {
+      req = {};
+      res = {};
+      middleware = {
+        init() {
+          return function (req, res, next) {
+            req._parsedUrl = {
+              href: '/some/path?asdf=jkl',
+              path: '/some/path?asdf=jkl',
+              pathname: '/some/path',
+              query: 'asdf=jkl',
+              search: '?asdf=jkl;',
+            };
+            next();
           };
-          next();
-        };
-      }
-    };
+        }
+      };
+
+      core.depHooks
+        .resolve
+        .withArgs({ name: 'express', version: '>=4 <5', file: 'lib/middleware/init.js' })
+        .yields(middleware);
+    });
+
+    it('hooks init next in order to track req._parsedUrl values', function () {
+      instrumentation.install();
+      expect(patcher.isContrastHooked(middleware.init)).to.be.true;
+
+      const middlewareFn = middleware.init('text');
+
+      simulateRequestScope(() => {
+        const cb = sinon.spy(function () {
+          [
+            'href',
+            'path',
+            'pathname',
+            'query',
+            'search',
+          ].forEach((prop) => {
+            const strInfo = tracker.getData(req._parsedUrl[prop]);
+            expect(strInfo).to.be.ok;
+          });
+        });
 
-    core.depHooks
-      .resolve
-      .withArgs({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/middleware/init.js' })
-      .yields(middleware);
+        middlewareFn(req, res, cb);
+
+        expect(cb).to.have.been.called;
+      });
+    });
   });
 
-  it('hooks init next in order to track req._parsedUrl values', function () {
-    instrumentation.install();
-    expect(patcher.isContrastHooked(middleware.init)).to.be.true;
+  describe('express5', function() {
+    let LayerMock;
+    beforeEach(function() {
+      req = {
+        _parsedUrl: {
+          href: '/some/path?asdf=jkl',
+          path: '/some/path?asdf=jkl',
+          pathname: '/some/path',
+          query: 'asdf=jkl',
+          search: '?asdf=jkl;',
+        }
+      };
 
-    const middlewareFn = middleware.init('text');
+      LayerMock = sinon.stub();
+      LayerMock.prototype.handleRequest = sinon.stub();
 
-    simulateRequestScope(() => {
-      const cb = sinon.spy(function () {
+      core.depHooks.resolve.withArgs({ name: 'router', version: '>=2 <3', file: 'lib/layer.js' }).yields(LayerMock);
+    });
+
+    it('hooks handleRequest in order to track req._parsedUrl values', function () {
+      instrumentation.install();
+      simulateRequestScope(() => {
+        LayerMock.prototype.handleRequest(req);
         [
           'href',
           'path',
@@ -56,10 +101,6 @@ describe('assess dataflow sources express parsedUrl', function () {
           expect(strInfo).to.be.ok;
         });
       });
-
-      middlewareFn(req, res, cb);
-
-      expect(cb).to.have.been.called;
     });
   });
 });

package/lib/dataflow/sources/install/qs6.js

@@ -41,7 +41,6 @@ module.exports = (core) => {
           const sourceContext = getSourceContext(SOURCE);
 
           if (!sourceContext) {
-            logger.error({ inputType, funcKey }, 'unable to handle source. Missing `sourceContext`');
             return;
           }
 

package/lib/dataflow/sources/install/restify/router.js

@@ -42,7 +42,6 @@ module.exports = function init(core) {
               const sourceContext = getSourceContext(SOURCE);
 
               if (!sourceContext) {
-                logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                 return;
               }
 

package/lib/dataflow/sources/install/restify/router.test.js

@@ -27,11 +27,9 @@ describe('assess dataflow sources restify router', function () {
     simulateRequestScope(() => {
       Router.prototype.lookup(req);
 
-      expect(handle).not.to.have.been.called;
-      expect(core.logger.error).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:restify.Router.prototype.lookup' },
-        'unable to handle source. Missing `sourceContext`'
-      );
+      expect(handle).not.called;
+      expect(core.logger.trace.callCount).greaterThan(0);
+      expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
     }, { assess: { policy: null } });
   });