@contrast/assess 1.40.0 → 1.41.0

package/lib/dataflow/propagation/install/path/index.test.js

@@ -4,7 +4,7 @@ const sinon = require('sinon');
 const { expect } = require('chai');
 const { initAssessFixture } = require('@contrast/test/fixtures');
 
-describe('assess dataflow propagation string', function () {
+describe('assess dataflow propagation path', function () {
   let core, instr;
 
   beforeEach(function () {

package/lib/dataflow/sinks/install/express/reflected-xss.js

@@ -72,7 +72,7 @@ module.exports = function(core) {
   ];
 
   reflectedXss.install = function() {
-    depHooks.resolve({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/response' }, (Response) => {
+    depHooks.resolve({ name: 'express', version: '>=4 <6', file: 'lib/response' }, (Response) => {
       const name = 'Express.Response.send';
       patcher.patch(Response, 'send', {
         name,

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -67,7 +67,7 @@ module.exports = function(core) {
   ];
 
   unvalidatedRedirect.install = function() {
-    depHooks.resolve({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/response' }, (Response) => {
+    depHooks.resolve({ name: 'express', version: '>=4 <6', file: 'lib/response' }, (Response) => {
       const name = 'Express.Response.location';
       patcher.patch(Response, 'location', {
         name: 'Express.Response.location',

package/lib/dataflow/sources/install/body-parser1.js

@@ -42,7 +42,6 @@ module.exports = function init(core) {
       const sourceContext = getSourceContext(SOURCE);
 
       if (!sourceContext) {
-        logger.error({ funcKey: data.funcKey }, 'unable to handle source. Missing `sourceContext`');
         return next(...args);
       }
 

package/lib/dataflow/sources/install/body-parser1.test.js

@@ -112,10 +112,8 @@ describe('assess dataflow sources body-parser v1', function () {
         middleware(req, res, next);
 
         expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        expect(core.logger.error).to.have.been.calledWith(
-          { funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
-          'unable to handle source. Missing `sourceContext`'
-        );
+        expect(core.logger.trace.callCount).greaterThan(0);
+        expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
       }, { assess: { policy: null } });
     });
 
@@ -210,10 +208,8 @@ describe('assess dataflow sources body-parser v1', function () {
           middleware(req, res, next);
 
           expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-          expect(core.logger.error).to.have.been.calledWith(
-            { funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
-            'unable to handle source. Missing `sourceContext`',
-          );
+          expect(core.logger.trace.callCount).greaterThan(0);
+          expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
         }, { assess: { policy: null } });
       });
 

package/lib/dataflow/sources/install/cookie-parser1.js

@@ -43,7 +43,6 @@ module.exports = function init(core) {
                     const sourceContext = assess.getSourceContext(SOURCE);
 
                     if (!sourceContext) {
-                      logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                       return next(...args);
                     }
 

package/lib/dataflow/sources/install/cookie-parser1.test.js

@@ -74,10 +74,8 @@ describe('assess dataflow sources cookie-parser v1', function () {
       middleware(req, res, next);
 
       expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.error).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
-        'unable to handle source. Missing `sourceContext`',
-      );
+      expect(core.logger.trace.callCount).greaterThan(0);
+      expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
     }, { assess: { policy: null } });
   });
 

package/lib/dataflow/sources/install/express/params.js

@@ -24,55 +24,74 @@ module.exports = function init(core) {
     logger,
     patcher,
     depHooks,
-    assess: { getSourceContext },
+    assess: {
+      getSourceContext,
+      dataflow: { sources }
+    },
   } = core;
 
+  function postHook(name) {
+    return function({ obj: layer, result, orig, hooked, funcKey }) {
+      // we can exit early if
+      //  the layer doesn't match the request or
+      //  the layer doesn't recognize any parameters
+      if (
+        !result ||
+        !layer.keys ||
+        layer.keys.length === 0
+      ) return;
+
+      const sourceContext = getSourceContext(SOURCE);
+      if (!sourceContext) return;
+
+      if (sourceContext.parsedParams) {
+        logger.trace({ funcKey }, 'values already tracked');
+        return;
+      }
+
+      try {
+        sources.handle({
+          context: 'req.params',
+          name,
+          inputType: InputType.PARAMETER_VALUE,
+          stacktraceOpts: {
+            constructorOpt: hooked,
+            prependFrames: [orig]
+          },
+          data: layer.params,
+          sourceContext
+        });
+        sourceContext.parsedParams = true;
+      } catch (err) {
+        logger.error({ err, funcKey }, 'unable to handle source');
+      }
+    };
+  }
+
   core.assess.dataflow.sources.expressInstrumentation.params = {
     install() {
       const name = 'Layer.prototype.match';
       depHooks.resolve(
-        { name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/router/layer.js' },
+        { name: 'express', version: '>=4 <5', file: 'lib/router/layer.js' },
         (Layer) => {
           patcher.patch(Layer.prototype, 'match', {
             name,
             patchType,
-            post({ obj: layer, result, orig, hooked, funcKey }) {
-              // we can exit early if
-              //  the layer doesn't match the request or
-              //  the layer doesn't recognize any parameters
-              if (
-                !result ||
-                !layer.keys ||
-                layer.keys.length === 0
-              ) return;
-
-              const sourceContext = getSourceContext(SOURCE);
-              if (!sourceContext) return;
-
-              if (sourceContext.parsedParams) {
-                logger.trace({ funcKey }, 'values already tracked');
-                return;
-              }
-
-              try {
-                core.assess.dataflow.sources.handle({
-                  context: 'req.params',
-                  name,
-                  inputType: InputType.PARAMETER_VALUE,
-                  stacktraceOpts: {
-                    constructorOpt: hooked,
-                    prependFrames: [orig]
-                  },
-                  data: layer.params,
-                  sourceContext
-                });
-                sourceContext.parsedParams = true;
-              } catch (err) {
-                logger.error({ err, funcKey }, 'unable to handle source');
-              }
-            }
+            post: postHook(name)
           });
+          return Layer;
+        }
+      );
 
+      // Used by Express 5
+      depHooks.resolve(
+        { name: 'router', version: '>=2 <3', file: 'lib/layer.js' },
+        (Layer) => {
+          patcher.patch(Layer.prototype, 'match', {
+            name,
+            patchType,
+            post: postHook(name)
+          });
           return Layer;
         }
       );

package/lib/dataflow/sources/install/express/params.test.js

@@ -8,96 +8,103 @@ const { InputType } = require('@contrast/common');
 describe('assess dataflow sources express params', function () {
   let core, simulateRequestScope, Layer, layer;
 
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    const LayerMock = sinon.stub();
-    LayerMock.prototype.match = sinon.stub().returns(true);
-
-    require('./params')(core).install();
-    Layer = core.depHooks.resolve.yield(LayerMock)[0];
-    layer = { keys: ['foo'], params: { foo: 'bar' } };
-  });
+  [
+    { name: 'express', version: '>=4 <5', file: 'lib/router/layer.js' },
+    { name: 'router', version: '>=2 <3', file: 'lib/layer.js' }
+  ].forEach((args) => {
+    describe(`Express${args.name === 'express' ? '4' : '5'}`, function() {
+      beforeEach(function () {
+        ({ core, simulateRequestScope } = initAssessFixture());
+
+        sinon.stub(core.assess.dataflow.sources, 'handle');
+
+        const LayerMock = sinon.stub();
+        LayerMock.prototype.match = sinon.stub().returns(true);
+
+        require('./params')(core).install();
+        [Layer] = core.depHooks.resolve.withArgs(args).yield(LayerMock);
+        layer = { keys: ['foo'], params: { foo: 'bar' } };
+      });
 
-  it('calls `.handle` when `match` adds params (and keys) to the Layer instance', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
-        context: 'req.params',
-        name: 'Layer.prototype.match',
-        inputType: InputType.PARAMETER_VALUE,
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-          prependFrames: sinon.match.array,
-        },
-        data: layer.params,
-        sourceContext: core.scopes.sources.getStore().assess
+      it('calls `.handle` when `match` adds params (and keys) to the Layer instance', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+
+          expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
+            context: 'req.params',
+            name: 'Layer.prototype.match',
+            inputType: InputType.PARAMETER_VALUE,
+            stacktraceOpts: {
+              constructorOpt: sinon.match.func,
+              prependFrames: sinon.match.array,
+            },
+            data: layer.params,
+            sourceContext: core.scopes.sources.getStore().assess
+          });
+        });
       });
-    });
-  });
 
-  it('does not call `.handle` when `match` returns false', function () {
-    Layer.prototype.match.returns(false);
+      it('does not call `.handle` when `match` returns false', function () {
+        Layer.prototype.match.returns(false);
 
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
 
-  it('does not call `.handle` when the layer is missing the expected properties', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, {}, ['/bar']);
+      it('does not call `.handle` when the layer is missing the expected properties', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, {}, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
 
-  it('does not call `.handle` when `match` adds no params or keys', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, { keys: [], params: {} }, ['/bar']);
+      it('does not call `.handle` when `match` adds no params or keys', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, { keys: [], params: {} }, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        });
+      });
 
-  it('does not handle when there is no assess policy in request context', function () {
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+      it('does not handle when there is no assess policy in request context', function () {
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    }, { assess: { policy: null } });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+        }, { assess: { policy: null } });
+      });
 
-  it('does not call `.handle` when the values are already tracked', function () {
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedParams = true;
+      it('does not call `.handle` when the values are already tracked', function () {
+        simulateRequestScope(() => {
+          core.scopes.sources.getStore().assess.parsedParams = true;
 
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
-        'values already tracked'
-      );
-    });
-  });
+          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
+          expect(core.logger.trace).to.have.been.calledWith(
+            { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+            'values already tracked'
+          );
+        });
+      });
 
-  it('handles a case with an error in the `.handle` method', function () {
-    const err = new Error('test');
-    core.assess.dataflow.sources.handle.throws(err);
+      it('handles a case with an error in the `.handle` method', function () {
+        const err = new Error('test');
+        core.assess.dataflow.sources.handle.throws(err);
 
-    simulateRequestScope(() => {
-      Reflect.apply(Layer.prototype.match, layer, ['/bar']);
+        simulateRequestScope(() => {
+          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
 
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:Layer.prototype.match' },
-        'unable to handle source'
-      );
+          expect(core.logger.error).to.have.been.calledWith(
+            { err, funcKey: 'assess-dataflow-source:Layer.prototype.match' },
+            'unable to handle source'
+          );
+        });
+      });
     });
   });
 });

package/lib/dataflow/sources/install/express/parsedUrl.js

@@ -29,10 +29,41 @@ module.exports = function init(core) {
     patcher,
   } = core;
 
+  function preHook(name, args) {
+    return function(data) {
+      const [req] = args || data.args;
+
+      const sourceContext = getSourceContext(SOURCE);
+      if (!sourceContext) return;
+
+      const sourceInfo = {
+        context: 'req._parsedUrl',
+        data: req._parsedUrl,
+        name,
+        sourceContext,
+        stacktraceOpts: {
+          constructorOpt: data.hooked
+        }
+      };
+
+      sources.handle({
+        ...sourceInfo,
+        inputType: InputType.URI,
+        keys: ['href', 'path', 'pathname'],
+      });
+
+      sources.handle({
+        ...sourceInfo,
+        inputType: InputType.QUERYSTRING,
+        keys: ['query', 'search'],
+      });
+    };
+  }
+
   core.assess.dataflow.sources.expressInstrumentation.parsedUrl = {
     install() {
       depHooks.resolve(
-        { name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/middleware/init.js' },
+        { name: 'express', version: '>=4 <5', file: 'lib/middleware/init.js' },
         /** @param {import('express/lib/middleware/init')} mw */
         (mw) => {
           const name = 'express.middleware.init';
@@ -44,36 +75,10 @@ module.exports = function init(core) {
                 name: 'express.middleware.init.expressInit',
                 patchType,
                 pre(data) {
-                  const { args: [req] } = data;
                   patcher.patch(data.args, '2', {
                     name: 'express.middleware.init.expressInit.next',
                     patchType,
-                    pre(data) {
-                      const sourceContext = getSourceContext(SOURCE);
-                      if (!sourceContext) return;
-
-                      const sourceInfo = {
-                        context: 'req._parsedUrl',
-                        data: req._parsedUrl,
-                        name,
-                        sourceContext,
-                        stacktraceOpts: {
-                          constructorOpt: data.hooked
-                        }
-                      };
-
-                      sources.handle({
-                        ...sourceInfo,
-                        inputType: InputType.URI,
-                        keys: ['href', 'path', 'pathname'],
-                      });
-
-                      sources.handle({
-                        ...sourceInfo,
-                        inputType: InputType.QUERYSTRING,
-                        keys: ['query', 'search'],
-                      });
-                    }
+                    pre: preHook(name, data.args)
                   });
                 }
               });
@@ -81,6 +86,18 @@ module.exports = function init(core) {
           });
         }
       );
+
+      // Used by Express 5
+      depHooks.resolve(
+        { name: 'router', version: '>=2 <3', file: 'lib/layer.js' },
+        (Layer) => {
+          patcher.patch(Layer.prototype, 'handleRequest', {
+            name: 'Layer.prototype.handleRequest',
+            patchType,
+            pre: preHook('Layer.prototype.handleRequest')
+          });
+        }
+      );
     }
   };
 

package/lib/dataflow/sources/install/express/parsedUrl.test.js

@@ -13,38 +13,83 @@ describe('assess dataflow sources express parsedUrl', function () {
     instrumentation = core.assess.dataflow.sources.expressInstrumentation.parsedUrl;
     tracker = core.assess.dataflow.tracker;
     patcher = core.patcher;
+  });
 
-    req = {};
-    res = {};
-    middleware = {
-      init() {
-        return function (req, res, next) {
-          req._parsedUrl = {
-            href: '/some/path?asdf=jkl',
-            path: '/some/path?asdf=jkl',
-            pathname: '/some/path',
-            query: 'asdf=jkl',
-            search: '?asdf=jkl;',
+  describe('express4', function() {
+    beforeEach(function() {
+      req = {};
+      res = {};
+      middleware = {
+        init() {
+          return function (req, res, next) {
+            req._parsedUrl = {
+              href: '/some/path?asdf=jkl',
+              path: '/some/path?asdf=jkl',
+              pathname: '/some/path',
+              query: 'asdf=jkl',
+              search: '?asdf=jkl;',
+            };
+            next();
           };
-          next();
-        };
-      }
-    };
+        }
+      };
+
+      core.depHooks
+        .resolve
+        .withArgs({ name: 'express', version: '>=4 <5', file: 'lib/middleware/init.js' })
+        .yields(middleware);
+    });
+
+    it('hooks init next in order to track req._parsedUrl values', function () {
+      instrumentation.install();
+      expect(patcher.isContrastHooked(middleware.init)).to.be.true;
+
+      const middlewareFn = middleware.init('text');
+
+      simulateRequestScope(() => {
+        const cb = sinon.spy(function () {
+          [
+            'href',
+            'path',
+            'pathname',
+            'query',
+            'search',
+          ].forEach((prop) => {
+            const strInfo = tracker.getData(req._parsedUrl[prop]);
+            expect(strInfo).to.be.ok;
+          });
+        });
 
-    core.depHooks
-      .resolve
-      .withArgs({ name: 'express', version: '>=4.0.0 <5.0.0', file: 'lib/middleware/init.js' })
-      .yields(middleware);
+        middlewareFn(req, res, cb);
+
+        expect(cb).to.have.been.called;
+      });
+    });
   });
 
-  it('hooks init next in order to track req._parsedUrl values', function () {
-    instrumentation.install();
-    expect(patcher.isContrastHooked(middleware.init)).to.be.true;
+  describe('express5', function() {
+    let LayerMock;
+    beforeEach(function() {
+      req = {
+        _parsedUrl: {
+          href: '/some/path?asdf=jkl',
+          path: '/some/path?asdf=jkl',
+          pathname: '/some/path',
+          query: 'asdf=jkl',
+          search: '?asdf=jkl;',
+        }
+      };
 
-    const middlewareFn = middleware.init('text');
+      LayerMock = sinon.stub();
+      LayerMock.prototype.handleRequest = sinon.stub();
 
-    simulateRequestScope(() => {
-      const cb = sinon.spy(function () {
+      core.depHooks.resolve.withArgs({ name: 'router', version: '>=2 <3', file: 'lib/layer.js' }).yields(LayerMock);
+    });
+
+    it('hooks handleRequest in order to track req._parsedUrl values', function () {
+      instrumentation.install();
+      simulateRequestScope(() => {
+        LayerMock.prototype.handleRequest(req);
         [
           'href',
           'path',
@@ -56,10 +101,6 @@ describe('assess dataflow sources express parsedUrl', function () {
           expect(strInfo).to.be.ok;
         });
       });
-
-      middlewareFn(req, res, cb);
-
-      expect(cb).to.have.been.called;
     });
   });
 });

package/lib/dataflow/sources/install/qs6.js

@@ -41,7 +41,6 @@ module.exports = (core) => {
           const sourceContext = getSourceContext(SOURCE);
 
           if (!sourceContext) {
-            logger.error({ inputType, funcKey }, 'unable to handle source. Missing `sourceContext`');
             return;
           }
 

package/lib/dataflow/sources/install/restify/router.js

@@ -42,7 +42,6 @@ module.exports = function init(core) {
               const sourceContext = getSourceContext(SOURCE);
 
               if (!sourceContext) {
-                logger.error({ funcKey }, 'unable to handle source. Missing `sourceContext`');
                 return;
               }
 

package/lib/dataflow/sources/install/restify/router.test.js

@@ -27,11 +27,9 @@ describe('assess dataflow sources restify router', function () {
     simulateRequestScope(() => {
       Router.prototype.lookup(req);
 
-      expect(handle).not.to.have.been.called;
-      expect(core.logger.error).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:restify.Router.prototype.lookup' },
-        'unable to handle source. Missing `sourceContext`'
-      );
+      expect(handle).not.called;
+      expect(core.logger.trace.callCount).greaterThan(0);
+      expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
     }, { assess: { policy: null } });
   });
 

package/lib/get-source-context.js

@@ -32,23 +32,44 @@ module.exports = function(core) {
   } = core;
 
   /**
+   * getSourceContext must be used by all instrumentation to make sure that the
+   * - assess store is available
+   * - assess is enabled for this request
+   * - instrumentation is not locked
+   *
+   * Any code that does not use this function and directly accesses the assess
+   * source context will recurse until the stack is blown if the following
+   * checks are not correctly made.
+   *
    * @param {import('./constants.js').InstrumentationType} type
    * @returns {import('@contrast/assess').SourceContext|null} the assess store
    */
   return core.assess.getSourceContext = function getSourceContext(type, ...rest) {
     const ctx = sources.getStore()?.assess;
-    // <unsafe>
-    // This method is expected to be called by all Assess instrumentation components prior to doing work.
-    // Until we check policy, and whether instrumentation is locked, any instrumentation that is called before
-    // the </unsafe> section below will result in infinite recursion.
-    //
-    // E.g. Uncommenting any line below will cause a stack overflow:
-    // 'asdf'.concat()
-    // console.log() // even though this is deadzoned, we haven't checked whether instrumentation is locked yet
-    //
-    // policy will not exist if assess is altogether disabled for the active request e.g. url exclusion
-    if (!ctx?.policy || instrumentation.isLocked()) return null;
-    // </unsafe> but still be careful
+
+    // the following logging used to be done by the caller, but has been moved
+    // here as opposed to overloading `ctx.policy` with a special value so the
+    // caller could determine whether no source context was available or the
+    // request is being intentionally excluded. A negative of this is that the
+    // function name is not available to be included in the log.
+    if (!ctx) {
+      if (type === InstrumentationType.SOURCE) {
+        // because this is a real error, and we don't have the function name
+        // that the caller previously logged, we generate a stack trace to
+        // capture that information.
+        const err = new Error('No source context found');
+        core.logger.warn({ err }, 'assess running outside of request scope');
+      }
+      return null;
+    }
+    // there is a context, but if policy is null then assess is intentionally
+    // disabled (i.e., url exclusion or the request is not sampled).
+    if (!ctx.policy) {
+      core.logger.trace('Assess intentionally disabled for this request');
+      return null;
+    } else if (instrumentation.isLocked()) {
+      return null;
+    }
 
     switch (type) {
       case InstrumentationType.PROPAGATOR: {

package/lib/get-source-context.test.js

@@ -3,6 +3,7 @@
 const { expect } = require('chai');
 const { Event } = require('@contrast/common');
 const { initAssessFixture } = require('@contrast/test/fixtures');
+const sinon = require('sinon');
 const {
   InstrumentationType: { SOURCE, PROPAGATOR, RULE }
 } = require('./constants');
@@ -36,8 +37,35 @@ describe('assess getSourceContext', function () {
     expect(assessStore.policy.enabledRules).to.have.length.greaterThan(5);
   }
 
-  it('returns `null` when not in request scope', function() {
+  it('return null when not in request scope', function() {
     expect(core.assess.getSourceContext()).to.be.null;
+    expect(core.logger.warn.callCount).equal(0);
+  });
+
+  it('return null and log when getSourceContext(SOURCE) not in request scope', function() {
+    expect(core.assess.getSourceContext(SOURCE)).to.be.null;
+    expect(core.logger.warn.callCount).equal(1);
+    expect(core.logger.warn.args[0][1]).to.include('outside of request scope');
+  });
+
+  it('return null and log when intentionally disabled (policy === null)', function() {
+    simulateRequestScope(() => {
+      core.scopes.sources.getStore().assess.policy = null;
+      expect(core.assess.getSourceContext()).null;
+      // lots of code writes trace logs
+      const last = core.logger.trace.lastCall;
+      expect(last.args[0]).to.include('Assess intentionally disabled');
+    });
+  });
+
+  it('return null and do not log when instrumentation is locked', function() {
+    simulateRequestScope(() => {
+      core.scopes.instrumentation.isLocked = sinon.stub().returns(true);
+      expect(core.assess.getSourceContext()).null;
+      if (core.logger.trace.called) {
+        expect(core.logger.trace.lastCall.args[0]).not.include('Assess intentionally disabled');
+      }
+    });
   });
 
   describe('getSourceContext()', function() {
@@ -48,7 +76,7 @@ describe('assess getSourceContext', function () {
     });
   });
 
-  describe('.getSourceContext(SOURCE?)', function() {
+  describe('.getSourceContext(SOURCE)', function() {
     it('returns assess store when max source event threshold is not met', function() {
       simulateRequestScope(() => {
         execStoreAssertions(core.assess.getSourceContext(SOURCE));
@@ -64,10 +92,10 @@ describe('assess getSourceContext', function () {
     });
   });
 
-  describe('.getSourceContext(PROPAGATOR?)', function() {
+  describe('.getSourceContext(PROPAGATOR)', function() {
     it('returns assess store when max propagation event threshold is not met', function() {
       simulateRequestScope(() => {
-        execStoreAssertions(core.assess.getSourceContext(SOURCE));
+        execStoreAssertions(core.assess.getSourceContext(PROPAGATOR));
       });
     });
 
@@ -80,7 +108,7 @@ describe('assess getSourceContext', function () {
     });
   });
 
-  describe('.getSourceContext(SINK?, ruleId?)', function() {
+  describe('.getSourceContext(RULE, ruleId?)', function() {
     it('returns assess store when ruleId is not passed', function() {
       simulateRequestScope(() => {
         execStoreAssertions(core.assess.getSourceContext(RULE));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -19,15 +19,15 @@
   "dependencies": {
     "@contrast/common": "1.26.0",
     "@contrast/config": "1.36.0",
-    "@contrast/core": "1.41.0",
-    "@contrast/dep-hooks": "1.9.0",
+    "@contrast/core": "1.41.1",
+    "@contrast/dep-hooks": "1.10.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.19.0",
+    "@contrast/instrumentation": "1.20.0",
     "@contrast/logger": "1.14.0",
     "@contrast/patcher": "1.13.0",
-    "@contrast/rewriter": "1.17.0",
-    "@contrast/route-coverage": "1.30.0",
-    "@contrast/scopes": "1.10.0",
+    "@contrast/rewriter": "1.17.1",
+    "@contrast/route-coverage": "1.31.0",
+    "@contrast/scopes": "1.11.0",
     "semver": "^7.6.0"
   }
 }

package/lib/dataflow/sinks/install/fs-original.js

@@ -1,170 +0,0 @@
-/*
- * Copyright: 2024 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-'use strict';
-const { patchType } = require('../common');
-
-const {
-  DataflowTag: {
-    URL_ENCODED,
-    LIMITED_CHARS,
-    ALPHANUM_SPACE_HYPHEN,
-    SAFE_PATH,
-    UNTRUSTED,
-  },
-  FS_METHODS,
-  Rule: { PATH_TRAVERSAL: ruleId },
-  isString,
-  ArrayPrototypeJoin,
-} = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../constants');
-
-module.exports = function(core) {
-  const {
-    depHooks,
-    patcher,
-    assess: {
-      inspect, // TODO NODE-3455: remove
-      getSourceContext,
-      eventFactory: { createSinkEvent },
-      dataflow: {
-        tracker,
-        sinks: { isVulnerable, reportFindings },
-      },
-    },
-  } = core;
-
-  const safeTags = [
-    `excluded:${ruleId}`,
-    URL_ENCODED,
-    LIMITED_CHARS,
-    ALPHANUM_SPACE_HYPHEN,
-    SAFE_PATH,
-  ];
-
-  function getValues(indices, args) {
-    return indices.reduce((acc, idx) => {
-      const value = args[idx];
-      if (value && isString(value)) acc.push(value);
-      return acc;
-    }, []);
-  }
-
-  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
-    const { name: methodName, indices } = method;
-    if (!getSourceContext(RULE, ruleId)) return;
-
-    const values = getValues(indices, data.args);
-    if (!values.length) return;
-
-    const args = values.map((v) => {
-      const strInfo = tracker.getData(v);
-      return {
-        value: strInfo ? strInfo.value : v,
-        tracked: !!strInfo,
-        strInfo
-      };
-    });
-    for (let i = 0; i < values.length; i++) {
-      const { strInfo } = args[i];
-
-      if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
-        continue;
-      }
-
-      const event = createSinkEvent({
-        name,
-        moduleName,
-        methodName: fullMethodName || methodName,
-        context: `${name}(${ArrayPrototypeJoin.call(
-          args.map((a) => inspect(a.value)),
-          ', '
-        )})`,
-        history: [strInfo],
-        object: {
-          value: 'fs',
-          tracked: false,
-        },
-        args: args.map(({ value, tracked }) => ({ value, tracked })),
-        tags: strInfo.tags,
-        source: `P${i}`,
-        stacktraceOpts: {
-          contructorOpt: data.hooked,
-          prependFrames: [data.orig],
-        },
-      });
-
-      if (event) {
-        reportFindings({
-          ruleId,
-          sinkEvent: event,
-        });
-      }
-    }
-  };
-
-  core.assess.dataflow.sinks.pathTraversal = {
-    install() {
-      depHooks.resolve({ name: 'fs' }, (fs) => {
-        for (const method of FS_METHODS) {
-          // not all methods are available on every OS or Node version.
-          if (fs[method.name]) {
-            const name = `fs.${method.name}`;
-            patcher.patch(fs, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method),
-            });
-          }
-
-          if (method.sync) {
-            const syncName = `${method.name}Sync`;
-            if (fs[syncName]) {
-              const name = `fs.${syncName}`;
-              patcher.patch(fs, syncName, {
-                name,
-                patchType,
-                pre: pre(name, method, 'fs', syncName),
-              });
-            }
-          }
-
-          if (method.promises && fs.promises && fs.promises[method.name]) {
-            const name = `fs.promises.${method.name}`;
-            patcher.patch(fs.promises, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method, 'fs.promises'),
-            });
-          }
-        }
-      });
-
-      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
-        for (const method of FS_METHODS) {
-          if (method.promises && fsPromises[method.name]) {
-            const name = `fsPromises.${method.name}`;
-            patcher.patch(fsPromises, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method, 'fsPromises'),
-            });
-          }
-        }
-      });
-    },
-  };
-
-  return core.assess.dataflow.sinks.pathTraversal;
-};