@contrast/assess 1.40.0 → 1.42.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/crypto-analysis/install/crypto.js +4 -5
- package/lib/crypto-analysis/install/crypto.test.js +1 -1
- package/lib/crypto-analysis/install/math.js +2 -4
- package/lib/dataflow/propagation/install/JSON/parse.js +2 -3
- package/lib/dataflow/propagation/install/JSON/stringify.js +3 -4
- package/lib/dataflow/propagation/install/array-prototype-join.js +2 -3
- package/lib/dataflow/propagation/install/buffer.js +3 -4
- package/lib/dataflow/propagation/install/contrast-methods/add.js +2 -3
- package/lib/dataflow/propagation/install/contrast-methods/number.js +2 -3
- package/lib/dataflow/propagation/install/contrast-methods/string.js +2 -3
- package/lib/dataflow/propagation/install/contrast-methods/tag.js +2 -3
- package/lib/dataflow/propagation/install/decode-uri-component.js +2 -3
- package/lib/dataflow/propagation/install/ejs/escape-xml.js +3 -4
- package/lib/dataflow/propagation/install/ejs/template.js +3 -4
- package/lib/dataflow/propagation/install/ejs/template.test.js +1 -1
- package/lib/dataflow/propagation/install/encode-uri.js +2 -3
- package/lib/dataflow/propagation/install/escape-html.js +3 -4
- package/lib/dataflow/propagation/install/escape.js +2 -3
- package/lib/dataflow/propagation/install/fastify-send.js +3 -3
- package/lib/dataflow/propagation/install/fastify-send.test.js +1 -3
- package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js +3 -4
- package/lib/dataflow/propagation/install/isnumeric-0.js +1 -1
- package/lib/dataflow/propagation/install/joi/any.js +1 -1
- package/lib/dataflow/propagation/install/joi/any.test.js +1 -1
- package/lib/dataflow/propagation/install/joi/array.test.js +5 -5
- package/lib/dataflow/propagation/install/joi/boolean.js +3 -3
- package/lib/dataflow/propagation/install/joi/boolean.test.js +1 -1
- package/lib/dataflow/propagation/install/joi/expression.js +3 -3
- package/lib/dataflow/propagation/install/joi/expression.test.js +1 -1
- package/lib/dataflow/propagation/install/joi/index.js +3 -3
- package/lib/dataflow/propagation/install/joi/keys.js +3 -3
- package/lib/dataflow/propagation/install/joi/number.js +3 -3
- package/lib/dataflow/propagation/install/joi/number.test.js +1 -1
- package/lib/dataflow/propagation/install/joi/object.js +1 -1
- package/lib/dataflow/propagation/install/joi/object.test.js +1 -1
- package/lib/dataflow/propagation/install/joi/ref.test.js +4 -4
- package/lib/dataflow/propagation/install/joi/string-schema.js +4 -4
- package/lib/dataflow/propagation/install/joi/string-schema.test.js +4 -4
- package/lib/dataflow/propagation/install/joi/values.js +3 -3
- package/lib/dataflow/propagation/install/mongoose/schema-map.js +4 -4
- package/lib/dataflow/propagation/install/mongoose/schema-mixed.js +4 -4
- package/lib/dataflow/propagation/install/mongoose/schema-string.js +4 -4
- package/lib/dataflow/propagation/install/mustache-escape.js +3 -4
- package/lib/dataflow/propagation/install/mustache-escape.test.js +1 -1
- package/lib/dataflow/propagation/install/mysql-connection-escape.js +22 -14
- package/lib/dataflow/propagation/install/mysql-connection-escape.test.js +1 -1
- package/lib/dataflow/propagation/install/parse-int.js +2 -3
- package/lib/dataflow/propagation/install/path/basename.js +3 -4
- package/lib/dataflow/propagation/install/path/dirname.js +3 -4
- package/lib/dataflow/propagation/install/path/extname.js +3 -4
- package/lib/dataflow/propagation/install/path/format.js +3 -4
- package/lib/dataflow/propagation/install/path/index.test.js +1 -1
- package/lib/dataflow/propagation/install/path/join-and-resolve.js +3 -4
- package/lib/dataflow/propagation/install/path/normalize.js +4 -5
- package/lib/dataflow/propagation/install/path/parse.js +3 -4
- package/lib/dataflow/propagation/install/path/relative.js +4 -5
- package/lib/dataflow/propagation/install/path/toNamespacedPath.js +3 -4
- package/lib/dataflow/propagation/install/pug/index.js +3 -4
- package/lib/dataflow/propagation/install/pug-runtime-escape.js +3 -4
- package/lib/dataflow/propagation/install/querystring/escape.js +3 -4
- package/lib/dataflow/propagation/install/querystring/escape.test.js +1 -1
- package/lib/dataflow/propagation/install/querystring/parse.js +3 -4
- package/lib/dataflow/propagation/install/querystring/parse.test.js +1 -1
- package/lib/dataflow/propagation/install/querystring/stringify.js +3 -4
- package/lib/dataflow/propagation/install/querystring/stringify.test.js +1 -1
- package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js +2 -3
- package/lib/dataflow/propagation/install/send.js +3 -3
- package/lib/dataflow/propagation/install/sequelize/query-generator.js +3 -3
- package/lib/dataflow/propagation/install/sequelize/query-generator.test.js +2 -1
- package/lib/dataflow/propagation/install/sequelize/sql-string.js +5 -5
- package/lib/dataflow/propagation/install/sql-template-strings.js +3 -3
- package/lib/dataflow/propagation/install/string/concat.js +2 -3
- package/lib/dataflow/propagation/install/string/format-methods.js +2 -3
- package/lib/dataflow/propagation/install/string/html-methods.js +3 -4
- package/lib/dataflow/propagation/install/string/match-all.js +2 -3
- package/lib/dataflow/propagation/install/string/match.js +2 -3
- package/lib/dataflow/propagation/install/string/replace.js +2 -3
- package/lib/dataflow/propagation/install/string/slice.js +2 -3
- package/lib/dataflow/propagation/install/string/split.js +2 -3
- package/lib/dataflow/propagation/install/string/substring.js +2 -3
- package/lib/dataflow/propagation/install/string/trim.js +2 -3
- package/lib/dataflow/propagation/install/unescape.js +2 -3
- package/lib/dataflow/propagation/install/url/domain-parsers.js +3 -4
- package/lib/dataflow/propagation/install/url/parse.js +3 -4
- package/lib/dataflow/propagation/install/url/parse.test.js +2 -2
- package/lib/dataflow/propagation/install/url/searchParams.js +3 -4
- package/lib/dataflow/propagation/install/url/url.js +3 -4
- package/lib/dataflow/propagation/install/util-format.js +3 -4
- package/lib/dataflow/propagation/install/validator/hooks.js +9 -9
- package/lib/dataflow/sinks/install/child-process.js +5 -6
- package/lib/dataflow/sinks/install/eval.js +2 -3
- package/lib/dataflow/sinks/install/express/reflected-xss.js +3 -4
- package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +3 -4
- package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +3 -4
- package/lib/dataflow/sinks/install/fs.js +4 -5
- package/lib/dataflow/sinks/install/fs.test.js +2 -2
- package/lib/dataflow/sinks/install/function.js +2 -3
- package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.js +3 -4
- package/lib/dataflow/sinks/install/http/request.js +3 -4
- package/lib/dataflow/sinks/install/http/request.test.js +2 -2
- package/lib/dataflow/sinks/install/http/server-response.js +5 -6
- package/lib/dataflow/sinks/install/http/server-response.test.js +3 -3
- package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +3 -4
- package/lib/dataflow/sinks/install/libxmljs.js +4 -5
- package/lib/dataflow/sinks/install/libxmljs.test.js +2 -2
- package/lib/dataflow/sinks/install/marsdb.js +3 -4
- package/lib/dataflow/sinks/install/marsdb.test.js +3 -3
- package/lib/dataflow/sinks/install/mongodb.js +3 -4
- package/lib/dataflow/sinks/install/mongodb.test.js +2 -6
- package/lib/dataflow/sinks/install/mssql.js +4 -5
- package/lib/dataflow/sinks/install/mssql.test.js +2 -2
- package/lib/dataflow/sinks/install/mysql.js +4 -5
- package/lib/dataflow/sinks/install/mysql.test.js +2 -11
- package/lib/dataflow/sinks/install/node-serialize.js +3 -4
- package/lib/dataflow/sinks/install/node-serialize.test.js +1 -3
- package/lib/dataflow/sinks/install/postgres.js +5 -6
- package/lib/dataflow/sinks/install/postgres.test.js +3 -9
- package/lib/dataflow/sinks/install/restify.js +3 -4
- package/lib/dataflow/sinks/install/restify.test.js +3 -5
- package/lib/dataflow/sinks/install/sequelize.js +3 -4
- package/lib/dataflow/sinks/install/sqlite3.js +3 -4
- package/lib/dataflow/sinks/install/vm.js +3 -4
- package/lib/dataflow/sources/install/body-parser1.js +2 -4
- package/lib/dataflow/sources/install/body-parser1.test.js +4 -8
- package/lib/dataflow/sources/install/busboy.js +3 -4
- package/lib/dataflow/sources/install/busboy.test.js +2 -2
- package/lib/dataflow/sources/install/cookie-parser1.js +2 -4
- package/lib/dataflow/sources/install/cookie-parser1.test.js +2 -4
- package/lib/dataflow/sources/install/express/params.js +56 -38
- package/lib/dataflow/sources/install/express/params.test.js +80 -73
- package/lib/dataflow/sources/install/express/parsedUrl.js +45 -29
- package/lib/dataflow/sources/install/express/parsedUrl.test.js +71 -29
- package/lib/dataflow/sources/install/fastify/fastify.js +2 -3
- package/lib/dataflow/sources/install/fastify/fastify.test.js +3 -6
- package/lib/dataflow/sources/install/formidable1.js +2 -3
- package/lib/dataflow/sources/install/hapi/hapi.js +1 -2
- package/lib/dataflow/sources/install/http.js +2 -3
- package/lib/dataflow/sources/install/http.test.js +2 -2
- package/lib/dataflow/sources/install/koa/koa-bodyparsers.js +3 -5
- package/lib/dataflow/sources/install/koa/koa-multer.js +3 -4
- package/lib/dataflow/sources/install/koa/koa-multer.test.js +1 -1
- package/lib/dataflow/sources/install/koa/koa-routers.js +3 -4
- package/lib/dataflow/sources/install/koa/koa2.js +2 -4
- package/lib/dataflow/sources/install/multer1.js +2 -3
- package/lib/dataflow/sources/install/multer1.test.js +1 -3
- package/lib/dataflow/sources/install/qs6.js +2 -4
- package/lib/dataflow/sources/install/querystring.js +2 -3
- package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.js +2 -3
- package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.test.js +1 -1
- package/lib/dataflow/sources/install/restify/jsonBodyParser.js +2 -3
- package/lib/dataflow/sources/install/restify/jsonBodyParser.test.js +1 -1
- package/lib/dataflow/sources/install/restify/router.js +2 -4
- package/lib/dataflow/sources/install/restify/router.test.js +4 -6
- package/lib/get-source-context.js +77 -37
- package/lib/get-source-context.test.js +106 -53
- package/lib/index.d.ts +3 -9
- package/lib/response-scanning/install/http.js +3 -3
- package/lib/response-scanning/install/http.test.js +2 -2
- package/lib/session-configuration/install/express-session.js +1 -1
- package/lib/session-configuration/install/express-session.test.js +1 -3
- package/lib/session-configuration/install/fastify-cookie.js +1 -1
- package/lib/session-configuration/install/fastify-cookie.test.js +1 -3
- package/lib/session-configuration/install/koa.js +1 -1
- package/lib/session-configuration/install/koa.test.js +1 -1
- package/package.json +11 -11
- package/lib/constants.js +0 -26
- package/lib/dataflow/sinks/install/fs-original.js +0 -170
|
@@ -4,7 +4,7 @@ const sinon = require('sinon');
|
|
|
4
4
|
const { expect } = require('chai');
|
|
5
5
|
const { initAssessFixture } = require('@contrast/test/fixtures');
|
|
6
6
|
|
|
7
|
-
describe('assess dataflow propagation
|
|
7
|
+
describe('assess dataflow propagation path', function () {
|
|
8
8
|
let core, instr;
|
|
9
9
|
|
|
10
10
|
beforeEach(function () {
|
|
@@ -16,7 +16,6 @@
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
18
|
const { isString, primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
|
|
19
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
20
19
|
const { createMergedTags } = require('../../../tag-utils');
|
|
21
20
|
const { patchType } = require('../../common');
|
|
22
21
|
const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
|
|
@@ -26,7 +25,7 @@ module.exports = function(core) {
|
|
|
26
25
|
depHooks,
|
|
27
26
|
patcher,
|
|
28
27
|
assess: {
|
|
29
|
-
|
|
28
|
+
getPropagatorContext,
|
|
30
29
|
eventFactory: { createPropagationEvent },
|
|
31
30
|
dataflow: { tracker },
|
|
32
31
|
},
|
|
@@ -34,7 +33,7 @@ module.exports = function(core) {
|
|
|
34
33
|
|
|
35
34
|
core.assess.dataflow.propagation.pathInstrumentation.joinAndResolve = {
|
|
36
35
|
install() {
|
|
37
|
-
depHooks.resolve({ name: 'path' }, (path) => {
|
|
36
|
+
depHooks.resolve({ name: 'path', version: '*' }, (path) => {
|
|
38
37
|
for (const method of ['join', 'resolve']) {
|
|
39
38
|
for (const os of ['posix', 'win32']) {
|
|
40
39
|
const name = `path.${os}.${method}`;
|
|
@@ -47,7 +46,7 @@ module.exports = function(core) {
|
|
|
47
46
|
post(data) {
|
|
48
47
|
const { args: origArgs, result, hooked, orig } = data;
|
|
49
48
|
|
|
50
|
-
if (!result || !
|
|
49
|
+
if (!result || !getPropagatorContext()) return;
|
|
51
50
|
|
|
52
51
|
const pathSegments = [...origArgs].reverse();
|
|
53
52
|
const args = [];
|
|
@@ -15,16 +15,15 @@
|
|
|
15
15
|
|
|
16
16
|
'use strict';
|
|
17
17
|
const { isString } = require('@contrast/common');
|
|
18
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
19
18
|
const { patchType } = require('../../common');
|
|
20
|
-
const { createArgTagsInResult, excludeExtensionDotFromTags
|
|
19
|
+
const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
|
|
21
20
|
|
|
22
21
|
module.exports = function(core) {
|
|
23
22
|
const {
|
|
24
23
|
depHooks,
|
|
25
24
|
patcher,
|
|
26
25
|
assess: {
|
|
27
|
-
|
|
26
|
+
getPropagatorContext,
|
|
28
27
|
eventFactory: { createPropagationEvent },
|
|
29
28
|
dataflow: { tracker },
|
|
30
29
|
},
|
|
@@ -32,7 +31,7 @@ module.exports = function(core) {
|
|
|
32
31
|
|
|
33
32
|
core.assess.dataflow.propagation.pathInstrumentation.normalize = {
|
|
34
33
|
install() {
|
|
35
|
-
depHooks.resolve({ name: 'path' }, (path) => {
|
|
34
|
+
depHooks.resolve({ name: 'path', version: '*' }, (path) => {
|
|
36
35
|
for (const os of ['posix', 'win32']) {
|
|
37
36
|
const isWin32 = os === 'win32';
|
|
38
37
|
|
|
@@ -42,7 +41,7 @@ module.exports = function(core) {
|
|
|
42
41
|
usePerf: 'sync',
|
|
43
42
|
post(data) {
|
|
44
43
|
const { args, result, name, hooked, orig } = data;
|
|
45
|
-
if (!result || !
|
|
44
|
+
if (!result || !getPropagatorContext()) return;
|
|
46
45
|
|
|
47
46
|
const pathStr = args[0];
|
|
48
47
|
|
|
@@ -15,7 +15,6 @@
|
|
|
15
15
|
|
|
16
16
|
'use strict';
|
|
17
17
|
const { isString } = require('@contrast/common');
|
|
18
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
19
18
|
const { createSubsetTags } = require('../../../tag-utils');
|
|
20
19
|
const { patchType } = require('../../common');
|
|
21
20
|
const { excludeExtensionDotFromTags } = require('./common');
|
|
@@ -25,7 +24,7 @@ module.exports = function(core) {
|
|
|
25
24
|
depHooks,
|
|
26
25
|
patcher,
|
|
27
26
|
assess: {
|
|
28
|
-
|
|
27
|
+
getPropagatorContext,
|
|
29
28
|
inspect, // TODO NODE-3455: remove
|
|
30
29
|
eventFactory: { createPropagationEvent },
|
|
31
30
|
dataflow: { tracker },
|
|
@@ -34,7 +33,7 @@ module.exports = function(core) {
|
|
|
34
33
|
|
|
35
34
|
core.assess.dataflow.propagation.pathInstrumentation.parse = {
|
|
36
35
|
install() {
|
|
37
|
-
depHooks.resolve({ name: 'path' }, (path) => {
|
|
36
|
+
depHooks.resolve({ name: 'path', version: '*' }, (path) => {
|
|
38
37
|
for (const os of ['posix', 'win32']) {
|
|
39
38
|
const isWin32 = os === 'win32';
|
|
40
39
|
|
|
@@ -44,7 +43,7 @@ module.exports = function(core) {
|
|
|
44
43
|
usePerf: 'sync',
|
|
45
44
|
post(data) {
|
|
46
45
|
const { args, result, name: patchName, hooked, orig } = data;
|
|
47
|
-
if (!result || !
|
|
46
|
+
if (!result || !getPropagatorContext()) return;
|
|
48
47
|
|
|
49
48
|
const [path] = args;
|
|
50
49
|
if (!path || !isString(path)) return;
|
|
@@ -16,16 +16,15 @@
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
18
|
const { isString } = require('@contrast/common');
|
|
19
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
20
19
|
const { patchType } = require('../../common');
|
|
21
|
-
const { createArgTagsInResult, excludeExtensionDotFromTags
|
|
20
|
+
const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
|
|
22
21
|
|
|
23
22
|
module.exports = function(core) {
|
|
24
23
|
const {
|
|
25
24
|
depHooks,
|
|
26
25
|
patcher,
|
|
27
26
|
assess: {
|
|
28
|
-
|
|
27
|
+
getPropagatorContext,
|
|
29
28
|
eventFactory: { createPropagationEvent },
|
|
30
29
|
dataflow: { tracker },
|
|
31
30
|
},
|
|
@@ -33,7 +32,7 @@ module.exports = function(core) {
|
|
|
33
32
|
|
|
34
33
|
core.assess.dataflow.propagation.pathInstrumentation.relative = {
|
|
35
34
|
install() {
|
|
36
|
-
depHooks.resolve({ name: 'path' }, (path) => {
|
|
35
|
+
depHooks.resolve({ name: 'path', version: '*' }, (path) => {
|
|
37
36
|
for (const os of ['posix', 'win32']) {
|
|
38
37
|
const isWin32 = os === 'win32';
|
|
39
38
|
|
|
@@ -43,7 +42,7 @@ module.exports = function(core) {
|
|
|
43
42
|
usePerf: 'sync',
|
|
44
43
|
post(data) {
|
|
45
44
|
const { args, result, name, hooked, orig } = data;
|
|
46
|
-
if (!result || !
|
|
45
|
+
if (!result || !getPropagatorContext()) return;
|
|
47
46
|
|
|
48
47
|
const [fromStr, toStr] = args;
|
|
49
48
|
|
|
@@ -16,7 +16,6 @@
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
18
|
const { isString } = require('@contrast/common');
|
|
19
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
20
19
|
const { patchType } = require('../../common');
|
|
21
20
|
const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
|
|
22
21
|
|
|
@@ -25,7 +24,7 @@ module.exports = function(core) {
|
|
|
25
24
|
depHooks,
|
|
26
25
|
patcher,
|
|
27
26
|
assess: {
|
|
28
|
-
|
|
27
|
+
getPropagatorContext,
|
|
29
28
|
eventFactory: { createPropagationEvent },
|
|
30
29
|
dataflow: { tracker },
|
|
31
30
|
},
|
|
@@ -33,7 +32,7 @@ module.exports = function(core) {
|
|
|
33
32
|
|
|
34
33
|
core.assess.dataflow.propagation.pathInstrumentation.toNamespacedPath = {
|
|
35
34
|
install() {
|
|
36
|
-
depHooks.resolve({ name: 'path' }, (path) => {
|
|
35
|
+
depHooks.resolve({ name: 'path', version: '*' }, (path) => {
|
|
37
36
|
for (const os of ['posix', 'win32']) {
|
|
38
37
|
|
|
39
38
|
patcher.patch(path[os], 'toNamespacedPath', {
|
|
@@ -42,7 +41,7 @@ module.exports = function(core) {
|
|
|
42
41
|
usePerf: 'sync',
|
|
43
42
|
post(data) {
|
|
44
43
|
const { args, result, name, hooked, orig } = data;
|
|
45
|
-
if (!result || !
|
|
44
|
+
if (!result || !getPropagatorContext()) return;
|
|
46
45
|
|
|
47
46
|
const pathStr = args[0];
|
|
48
47
|
|
|
@@ -14,7 +14,6 @@
|
|
|
14
14
|
*/
|
|
15
15
|
'use strict';
|
|
16
16
|
|
|
17
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
18
17
|
const { patchType } = require('../../common');
|
|
19
18
|
|
|
20
19
|
/** @type {import('@contrast/rewriter').RewriteOpts} */
|
|
@@ -28,19 +27,19 @@ module.exports = function (core) {
|
|
|
28
27
|
rewriter,
|
|
29
28
|
depHooks,
|
|
30
29
|
scopes: { instrumentation },
|
|
31
|
-
assess: {
|
|
30
|
+
assess: { getPropagatorContext },
|
|
32
31
|
} = core;
|
|
33
32
|
|
|
34
33
|
const pugInstrumentation = {
|
|
35
34
|
install() {
|
|
36
35
|
depHooks.resolve(
|
|
37
|
-
{ name: 'pug' },
|
|
36
|
+
{ name: 'pug', version: '<4' },
|
|
38
37
|
(pug) => patcher.patch(pug, 'compile', {
|
|
39
38
|
name: 'pug.compile',
|
|
40
39
|
patchType,
|
|
41
40
|
usePerf: 'tbd',
|
|
42
41
|
pre(data) {
|
|
43
|
-
if (!
|
|
42
|
+
if (!getPropagatorContext()) return;
|
|
44
43
|
|
|
45
44
|
const opts = data.args[1] || {};
|
|
46
45
|
const plugins = opts.plugins || [];
|
|
@@ -16,7 +16,6 @@
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
18
|
const { DataflowTag: { WEAK_URL_ENCODED } } = require('@contrast/common');
|
|
19
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
|
|
20
19
|
const { createFullLengthCopyTags } = require('../../tag-utils');
|
|
21
20
|
const { patchType, createModuleLabel } = require('../common');
|
|
22
21
|
|
|
@@ -25,7 +24,7 @@ module.exports = function(core) {
|
|
|
25
24
|
patcher,
|
|
26
25
|
depHooks,
|
|
27
26
|
assess: {
|
|
28
|
-
|
|
27
|
+
getPropagatorContext,
|
|
29
28
|
eventFactory: { createPropagationEvent },
|
|
30
29
|
dataflow: { tracker }
|
|
31
30
|
}
|
|
@@ -33,7 +32,7 @@ module.exports = function(core) {
|
|
|
33
32
|
|
|
34
33
|
return core.assess.dataflow.propagation.pugRuntimeEscape = {
|
|
35
34
|
install() {
|
|
36
|
-
depHooks.resolve({ name: 'pug-runtime' }, (pugRuntime, version) => {
|
|
35
|
+
depHooks.resolve({ name: 'pug-runtime', version: '<4' }, (pugRuntime, version) => {
|
|
37
36
|
const name = 'pug-runtime.escape';
|
|
38
37
|
|
|
39
38
|
patcher.patch(pugRuntime, 'escape', {
|
|
@@ -42,7 +41,7 @@ module.exports = function(core) {
|
|
|
42
41
|
usePerf: 'sync',
|
|
43
42
|
post(data) {
|
|
44
43
|
const { args, result, hooked, orig } = data;
|
|
45
|
-
if (!result || !args[0] || !
|
|
44
|
+
if (!result || !args[0] || !getPropagatorContext()) return;
|
|
46
45
|
|
|
47
46
|
const argInfo = tracker.getData(args[0]);
|
|
48
47
|
|
|
@@ -15,14 +15,13 @@
|
|
|
15
15
|
'use strict';
|
|
16
16
|
|
|
17
17
|
const { DataflowTag: { URL_ENCODED } } = require('@contrast/common');
|
|
18
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
19
18
|
const { createFullLengthCopyTags } = require('../../../tag-utils');
|
|
20
19
|
const { patchType } = require('../../common');
|
|
21
20
|
|
|
22
21
|
module.exports = function(core) {
|
|
23
22
|
const {
|
|
24
23
|
assess: {
|
|
25
|
-
|
|
24
|
+
getPropagatorContext,
|
|
26
25
|
inspect, // TODO NODE-3455: remove
|
|
27
26
|
eventFactory: { createPropagationEvent },
|
|
28
27
|
dataflow: { tracker }
|
|
@@ -33,7 +32,7 @@ module.exports = function(core) {
|
|
|
33
32
|
|
|
34
33
|
return core.assess.dataflow.propagation.querystringInstrumentation.escape = {
|
|
35
34
|
install() {
|
|
36
|
-
depHooks.resolve({ name: 'querystring' }, (_export) => {
|
|
35
|
+
depHooks.resolve({ name: 'querystring', version: '<1' }, (_export) => {
|
|
37
36
|
patcher.patch(_export, 'escape', {
|
|
38
37
|
name: 'querystring.escape',
|
|
39
38
|
patchType,
|
|
@@ -45,7 +44,7 @@ module.exports = function(core) {
|
|
|
45
44
|
const strInfo = tracker.getData(value);
|
|
46
45
|
if (!strInfo) return;
|
|
47
46
|
|
|
48
|
-
if (!
|
|
47
|
+
if (!getPropagatorContext()) return;
|
|
49
48
|
|
|
50
49
|
let tags;
|
|
51
50
|
if (value !== data.result) {
|
|
@@ -20,7 +20,7 @@ describe('assess dataflow propagation querystring escape', function () {
|
|
|
20
20
|
tracker = core.assess.dataflow.tracker;
|
|
21
21
|
|
|
22
22
|
querystring = require('querystring');
|
|
23
|
-
core.depHooks.resolve.
|
|
23
|
+
core.depHooks.resolve.yields(querystring);
|
|
24
24
|
|
|
25
25
|
core.assess.dataflow.propagation.querystringInstrumentation.escape.install();
|
|
26
26
|
});
|
|
@@ -20,7 +20,6 @@ const {
|
|
|
20
20
|
DataflowTag: { URL_ENCODED },
|
|
21
21
|
primordials: { ArrayPrototypeJoin },
|
|
22
22
|
} = require('@contrast/common');
|
|
23
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
24
23
|
const { createSubsetTags, createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
|
|
25
24
|
const { patchType } = require('../../common');
|
|
26
25
|
|
|
@@ -29,7 +28,7 @@ module.exports = function(core) {
|
|
|
29
28
|
patcher,
|
|
30
29
|
depHooks,
|
|
31
30
|
assess: {
|
|
32
|
-
|
|
31
|
+
getPropagatorContext,
|
|
33
32
|
eventFactory: { createPropagationEvent },
|
|
34
33
|
dataflow: { tracker }
|
|
35
34
|
}
|
|
@@ -100,14 +99,14 @@ module.exports = function(core) {
|
|
|
100
99
|
|
|
101
100
|
return core.assess.dataflow.propagation.querystringInstrumentation.parse = {
|
|
102
101
|
install() {
|
|
103
|
-
depHooks.resolve({ name: 'querystring' }, (module) => {
|
|
102
|
+
depHooks.resolve({ name: 'querystring', version: '<1' }, (module) => {
|
|
104
103
|
['parse', 'decode'].forEach((method) => {
|
|
105
104
|
patcher.patch(module, method, {
|
|
106
105
|
name: `querystring.${method}`,
|
|
107
106
|
patchType,
|
|
108
107
|
usePerf: 'sync',
|
|
109
108
|
pre(data) {
|
|
110
|
-
if (!data.args[0] || !
|
|
109
|
+
if (!data.args[0] || !getPropagatorContext()) return;
|
|
111
110
|
|
|
112
111
|
const trackingData = tracker.getData(data.args[0]);
|
|
113
112
|
if (!trackingData) return;
|
|
@@ -21,7 +21,7 @@ describe('assess dataflow propagation querystring parse', function () {
|
|
|
21
21
|
querystring = require('querystring');
|
|
22
22
|
core.assess.dataflow.propagation.querystringInstrumentation.parse.install();
|
|
23
23
|
core.assess.dataflow.propagation.stringInstrumentation.concat.install();
|
|
24
|
-
core.depHooks.resolve.
|
|
24
|
+
core.depHooks.resolve.yield(querystring);
|
|
25
25
|
});
|
|
26
26
|
|
|
27
27
|
afterEach(function () {
|
|
@@ -16,7 +16,6 @@
|
|
|
16
16
|
|
|
17
17
|
const querystring = require('querystring');
|
|
18
18
|
const { isString } = require('@contrast/common');
|
|
19
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
20
19
|
const utils = require('../../../tag-utils');
|
|
21
20
|
const { patchType } = require('../../common');
|
|
22
21
|
|
|
@@ -25,7 +24,7 @@ const moduleName = 'querystring';
|
|
|
25
24
|
module.exports = function(core) {
|
|
26
25
|
const {
|
|
27
26
|
assess: {
|
|
28
|
-
|
|
27
|
+
getPropagatorContext,
|
|
29
28
|
inspect, // TODO NODE-3455: remove
|
|
30
29
|
dataflow: { tracker },
|
|
31
30
|
eventFactory: { createPropagationEvent },
|
|
@@ -38,7 +37,7 @@ module.exports = function(core) {
|
|
|
38
37
|
* Adds custom encoding function to capture key/value tags and history during stringification
|
|
39
38
|
*/
|
|
40
39
|
function pre(data) {
|
|
41
|
-
if (!
|
|
40
|
+
if (!getPropagatorContext()) return;
|
|
42
41
|
|
|
43
42
|
const [input] = data.args;
|
|
44
43
|
const escape = typeof data.args[3]?.encodeURIComponent === 'function'
|
|
@@ -142,7 +141,7 @@ module.exports = function(core) {
|
|
|
142
141
|
|
|
143
142
|
return core.assess.dataflow.propagation.querystringInstrumentation.stringify = {
|
|
144
143
|
install() {
|
|
145
|
-
depHooks.resolve({ name: moduleName }, (_export) => {
|
|
144
|
+
depHooks.resolve({ name: moduleName, version: '<1' }, (_export) => {
|
|
146
145
|
for (const methodName of ['encode', 'stringify']) {
|
|
147
146
|
patcher.patch(_export, methodName, {
|
|
148
147
|
name: `querystring.${methodName}`,
|
|
@@ -14,7 +14,7 @@ describe('assess dataflow propagation querystring stringify', function () {
|
|
|
14
14
|
tracker = core.assess.dataflow.tracker;
|
|
15
15
|
|
|
16
16
|
querystring = require('querystring');
|
|
17
|
-
core.depHooks.resolve.
|
|
17
|
+
core.depHooks.resolve.yields(querystring);
|
|
18
18
|
|
|
19
19
|
core.assess.dataflow.propagation.stringInstrumentation.concat.install();
|
|
20
20
|
core.assess.dataflow.propagation.querystringInstrumentation.escape.install();
|
|
@@ -15,7 +15,6 @@
|
|
|
15
15
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
|
|
19
18
|
const { createSubsetTags, getAdjustedUntrackedValue } = require('../../tag-utils');
|
|
20
19
|
const { patchType } = require('../common');
|
|
21
20
|
|
|
@@ -23,7 +22,7 @@ module.exports = function(core) {
|
|
|
23
22
|
const {
|
|
24
23
|
patcher,
|
|
25
24
|
assess: {
|
|
26
|
-
|
|
25
|
+
getPropagatorContext,
|
|
27
26
|
eventFactory: { createPropagationEvent },
|
|
28
27
|
dataflow: { tracker },
|
|
29
28
|
},
|
|
@@ -86,7 +85,7 @@ module.exports = function(core) {
|
|
|
86
85
|
!obj ||
|
|
87
86
|
!args[0] ||
|
|
88
87
|
!result?.length ||
|
|
89
|
-
!
|
|
88
|
+
!getPropagatorContext()
|
|
90
89
|
)
|
|
91
90
|
return;
|
|
92
91
|
|
|
@@ -21,7 +21,7 @@ module.exports = function (core) {
|
|
|
21
21
|
const {
|
|
22
22
|
depHooks,
|
|
23
23
|
patcher,
|
|
24
|
-
assess: {
|
|
24
|
+
assess: { getPropagatorContext }
|
|
25
25
|
} = core;
|
|
26
26
|
|
|
27
27
|
const send = {};
|
|
@@ -38,7 +38,7 @@ module.exports = function (core) {
|
|
|
38
38
|
patchType,
|
|
39
39
|
pre(data) {
|
|
40
40
|
const { args } = data;
|
|
41
|
-
if (!
|
|
41
|
+
if (!getPropagatorContext()) return;
|
|
42
42
|
|
|
43
43
|
const untrackedPath = StringPrototypeSlice.call(` ${args[0]}`, 1);
|
|
44
44
|
args[0] = untrackedPath;
|
|
@@ -49,7 +49,7 @@ module.exports = function (core) {
|
|
|
49
49
|
}
|
|
50
50
|
|
|
51
51
|
send.install = function () {
|
|
52
|
-
depHooks.resolve({ name: 'send' }, patchSendModule);
|
|
52
|
+
depHooks.resolve({ name: 'send', version: '<2' }, patchSendModule);
|
|
53
53
|
};
|
|
54
54
|
|
|
55
55
|
return send;
|
|
@@ -31,7 +31,7 @@ const DIALECTS = [
|
|
|
31
31
|
module.exports = function(core) {
|
|
32
32
|
const {
|
|
33
33
|
assess: {
|
|
34
|
-
|
|
34
|
+
getPropagatorContext,
|
|
35
35
|
eventFactory: { createPropagationEvent },
|
|
36
36
|
dataflow: { tracker }
|
|
37
37
|
},
|
|
@@ -43,7 +43,7 @@ module.exports = function(core) {
|
|
|
43
43
|
install() {
|
|
44
44
|
for (const dialect of DIALECTS) {
|
|
45
45
|
depHooks.resolve(
|
|
46
|
-
{ name: 'sequelize', file: `lib/dialects/${dialect}/query-generator.js` },
|
|
46
|
+
{ name: 'sequelize', version: '<7', file: `lib/dialects/${dialect}/query-generator.js` },
|
|
47
47
|
(_export) => {
|
|
48
48
|
const constructor = _export.name;
|
|
49
49
|
|
|
@@ -53,7 +53,7 @@ module.exports = function(core) {
|
|
|
53
53
|
usePerf: 'sync',
|
|
54
54
|
post(data) {
|
|
55
55
|
const strInfo = tracker.getData(data.result);
|
|
56
|
-
if (!strInfo || !
|
|
56
|
+
if (!strInfo || !getPropagatorContext()) return;
|
|
57
57
|
|
|
58
58
|
const { value } = strInfo;
|
|
59
59
|
const event = createPropagationEvent({
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
3
|
const { expect } = require('chai');
|
|
4
|
+
const sinon = require('sinon');
|
|
4
5
|
const {
|
|
5
6
|
DataflowTag: { UNTRUSTED, SQL_ENCODED }
|
|
6
7
|
} = require('@contrast/common');
|
|
@@ -45,7 +46,7 @@ describe('assess dataflow propagation sequelize QueryGenerators', function() {
|
|
|
45
46
|
},
|
|
46
47
|
].forEach(({ Ctor, file }) => {
|
|
47
48
|
it(`${Ctor.name}.prototype.quoteIdentifier adds sql-encoded tag`, function() {
|
|
48
|
-
core.depHooks.resolve.withArgs({ name: 'sequelize', file }).yields(Ctor);
|
|
49
|
+
core.depHooks.resolve.withArgs(sinon.match({ name: 'sequelize', file })).yields(Ctor);
|
|
49
50
|
component.install();
|
|
50
51
|
|
|
51
52
|
simulateRequestScope(() => {
|
|
@@ -27,7 +27,7 @@ module.exports = function(core) {
|
|
|
27
27
|
patcher,
|
|
28
28
|
depHooks,
|
|
29
29
|
assess: {
|
|
30
|
-
|
|
30
|
+
getPropagatorContext,
|
|
31
31
|
eventFactory: { createPropagationEvent },
|
|
32
32
|
dataflow: { tracker },
|
|
33
33
|
},
|
|
@@ -54,7 +54,7 @@ module.exports = function(core) {
|
|
|
54
54
|
return core.assess.dataflow.propagation.sequelizeInstrumentation.sqlString = {
|
|
55
55
|
install() {
|
|
56
56
|
depHooks.resolve(
|
|
57
|
-
{ name: 'sequelize', file: 'lib/sql-string.js' },
|
|
57
|
+
{ name: 'sequelize', version: '<7', file: 'lib/sql-string.js' },
|
|
58
58
|
(sqlString, version) => {
|
|
59
59
|
const origEscape = sqlString.escape;
|
|
60
60
|
const name = 'sequelize.escape';
|
|
@@ -70,7 +70,7 @@ module.exports = function(core) {
|
|
|
70
70
|
!result ||
|
|
71
71
|
!args[0] ||
|
|
72
72
|
!isString(args[0]) ||
|
|
73
|
-
!
|
|
73
|
+
!getPropagatorContext()
|
|
74
74
|
) return;
|
|
75
75
|
|
|
76
76
|
const argInfo = tracker.getData(args[0]);
|
|
@@ -124,7 +124,7 @@ module.exports = function(core) {
|
|
|
124
124
|
!result ||
|
|
125
125
|
!args[0] ||
|
|
126
126
|
!isString(args[0]) ||
|
|
127
|
-
!
|
|
127
|
+
!getPropagatorContext()
|
|
128
128
|
) return;
|
|
129
129
|
|
|
130
130
|
const resultInfo = tracker.getData(result);
|
|
@@ -216,7 +216,7 @@ module.exports = function(core) {
|
|
|
216
216
|
!result ||
|
|
217
217
|
!args[0] ||
|
|
218
218
|
!isString(args[0]) ||
|
|
219
|
-
!
|
|
219
|
+
!getPropagatorContext()
|
|
220
220
|
) return;
|
|
221
221
|
|
|
222
222
|
const resultInfo = tracker.getData(result);
|
|
@@ -23,7 +23,7 @@ module.exports = function(core) {
|
|
|
23
23
|
patcher,
|
|
24
24
|
depHooks,
|
|
25
25
|
assess: {
|
|
26
|
-
|
|
26
|
+
getPropagatorContext,
|
|
27
27
|
eventFactory: { createPropagationEvent },
|
|
28
28
|
dataflow: { tracker }
|
|
29
29
|
}
|
|
@@ -31,7 +31,7 @@ module.exports = function(core) {
|
|
|
31
31
|
|
|
32
32
|
return core.assess.dataflow.propagation.sqlTemplateStrings = {
|
|
33
33
|
install() {
|
|
34
|
-
depHooks.resolve({ name: 'sql-template-strings' }, (sqlTemplateStrings, version) => {
|
|
34
|
+
depHooks.resolve({ name: 'sql-template-strings', version: '<3' }, (sqlTemplateStrings, version) => {
|
|
35
35
|
const name = 'sql-template-strings.SQL';
|
|
36
36
|
|
|
37
37
|
patcher.patch(sqlTemplateStrings, 'SQL', {
|
|
@@ -40,7 +40,7 @@ module.exports = function(core) {
|
|
|
40
40
|
usePerf: 'sync',
|
|
41
41
|
post(data) {
|
|
42
42
|
const { args, result, hooked, orig } = data;
|
|
43
|
-
if (!result || !args[0] || !
|
|
43
|
+
if (!result || !args[0] || !getPropagatorContext()) return;
|
|
44
44
|
|
|
45
45
|
const argInfo = tracker.getData(args[0]);
|
|
46
46
|
|
|
@@ -16,7 +16,6 @@
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
18
|
const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
|
|
19
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
20
19
|
const { createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
|
|
21
20
|
const { patchType } = require('../../common');
|
|
22
21
|
|
|
@@ -24,7 +23,7 @@ module.exports = function(core) {
|
|
|
24
23
|
const {
|
|
25
24
|
patcher,
|
|
26
25
|
assess: {
|
|
27
|
-
|
|
26
|
+
getPropagatorContext,
|
|
28
27
|
eventFactory: { createPropagationEvent },
|
|
29
28
|
dataflow: { tracker }
|
|
30
29
|
}
|
|
@@ -40,7 +39,7 @@ module.exports = function(core) {
|
|
|
40
39
|
usePerf: 'sync',
|
|
41
40
|
post(data) {
|
|
42
41
|
const { obj, result, hooked, orig } = data;
|
|
43
|
-
if (!result || !
|
|
42
|
+
if (!result || !getPropagatorContext()) return;
|
|
44
43
|
|
|
45
44
|
const rInfo = tracker.getData(result);
|
|
46
45
|
if (rInfo) {
|
|
@@ -15,14 +15,13 @@
|
|
|
15
15
|
|
|
16
16
|
'use strict';
|
|
17
17
|
|
|
18
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
19
18
|
const { patchType } = require('../../common');
|
|
20
19
|
|
|
21
20
|
module.exports = function(core) {
|
|
22
21
|
const {
|
|
23
22
|
patcher,
|
|
24
23
|
assess: {
|
|
25
|
-
|
|
24
|
+
getPropagatorContext,
|
|
26
25
|
eventFactory: { createPropagationEvent },
|
|
27
26
|
dataflow: { tracker }
|
|
28
27
|
}
|
|
@@ -39,7 +38,7 @@ module.exports = function(core) {
|
|
|
39
38
|
usePerf: 'sync',
|
|
40
39
|
post(data) {
|
|
41
40
|
const { obj, result, hooked, orig } = data;
|
|
42
|
-
if (!result || !
|
|
41
|
+
if (!result || !getPropagatorContext()) return;
|
|
43
42
|
|
|
44
43
|
const objInfo = tracker.getData(obj);
|
|
45
44
|
|
|
@@ -14,7 +14,6 @@
|
|
|
14
14
|
*/
|
|
15
15
|
|
|
16
16
|
'use strict';
|
|
17
|
-
const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
|
|
18
17
|
const { createAppendTags } = require('../../../tag-utils');
|
|
19
18
|
const { patchType } = require('../../common');
|
|
20
19
|
const htmlTagsLengths = {
|
|
@@ -33,7 +32,7 @@ module.exports = function(core) {
|
|
|
33
32
|
patcher,
|
|
34
33
|
assess: {
|
|
35
34
|
inspect, // TODO NODE-3455: remove
|
|
36
|
-
|
|
35
|
+
getPropagatorContext,
|
|
37
36
|
eventFactory: { createPropagationEvent },
|
|
38
37
|
dataflow: { tracker }
|
|
39
38
|
}
|
|
@@ -64,7 +63,7 @@ module.exports = function(core) {
|
|
|
64
63
|
usePost: true,
|
|
65
64
|
post(data) {
|
|
66
65
|
const { args, obj, result, hooked, orig } = data;
|
|
67
|
-
if (!result || !
|
|
66
|
+
if (!result || !getPropagatorContext()) return;
|
|
68
67
|
|
|
69
68
|
const objInfo = tracker.getData(obj);
|
|
70
69
|
const history = objInfo ? new Set([objInfo]) : new Set();
|
|
@@ -121,7 +120,7 @@ module.exports = function(core) {
|
|
|
121
120
|
patchType,
|
|
122
121
|
post(data) {
|
|
123
122
|
const { obj, result, hooked, orig } = data;
|
|
124
|
-
if (!result || !
|
|
123
|
+
if (!result || !getPropagatorContext()) return;
|
|
125
124
|
|
|
126
125
|
const objInfo = tracker.getData(obj);
|
|
127
126
|
|