@contrast/assess 1.40.0 → 1.42.0

package/lib/dataflow/sinks/install/fs-original.js

@@ -1,170 +0,0 @@
-/*
- * Copyright: 2024 Contrast Security, Inc
- * Contact: support@contrastsecurity.com
- * License: Commercial
-
- * NOTICE: This Software and the patented inventions embodied within may only be
- * used as part of Contrast Security’s commercial offerings. Even though it is
- * made available through public repositories, use of this Software is subject to
- * the applicable End User Licensing Agreement found at
- * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
- * between Contrast Security and the End User. The Software may not be reverse
- * engineered, modified, repackaged, sold, redistributed or otherwise used in a
- * way not consistent with the End User License Agreement.
- */
-'use strict';
-const { patchType } = require('../common');
-
-const {
-  DataflowTag: {
-    URL_ENCODED,
-    LIMITED_CHARS,
-    ALPHANUM_SPACE_HYPHEN,
-    SAFE_PATH,
-    UNTRUSTED,
-  },
-  FS_METHODS,
-  Rule: { PATH_TRAVERSAL: ruleId },
-  isString,
-  ArrayPrototypeJoin,
-} = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../constants');
-
-module.exports = function(core) {
-  const {
-    depHooks,
-    patcher,
-    assess: {
-      inspect, // TODO NODE-3455: remove
-      getSourceContext,
-      eventFactory: { createSinkEvent },
-      dataflow: {
-        tracker,
-        sinks: { isVulnerable, reportFindings },
-      },
-    },
-  } = core;
-
-  const safeTags = [
-    `excluded:${ruleId}`,
-    URL_ENCODED,
-    LIMITED_CHARS,
-    ALPHANUM_SPACE_HYPHEN,
-    SAFE_PATH,
-  ];
-
-  function getValues(indices, args) {
-    return indices.reduce((acc, idx) => {
-      const value = args[idx];
-      if (value && isString(value)) acc.push(value);
-      return acc;
-    }, []);
-  }
-
-  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
-    const { name: methodName, indices } = method;
-    if (!getSourceContext(RULE, ruleId)) return;
-
-    const values = getValues(indices, data.args);
-    if (!values.length) return;
-
-    const args = values.map((v) => {
-      const strInfo = tracker.getData(v);
-      return {
-        value: strInfo ? strInfo.value : v,
-        tracked: !!strInfo,
-        strInfo
-      };
-    });
-    for (let i = 0; i < values.length; i++) {
-      const { strInfo } = args[i];
-
-      if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
-        continue;
-      }
-
-      const event = createSinkEvent({
-        name,
-        moduleName,
-        methodName: fullMethodName || methodName,
-        context: `${name}(${ArrayPrototypeJoin.call(
-          args.map((a) => inspect(a.value)),
-          ', '
-        )})`,
-        history: [strInfo],
-        object: {
-          value: 'fs',
-          tracked: false,
-        },
-        args: args.map(({ value, tracked }) => ({ value, tracked })),
-        tags: strInfo.tags,
-        source: `P${i}`,
-        stacktraceOpts: {
-          contructorOpt: data.hooked,
-          prependFrames: [data.orig],
-        },
-      });
-
-      if (event) {
-        reportFindings({
-          ruleId,
-          sinkEvent: event,
-        });
-      }
-    }
-  };
-
-  core.assess.dataflow.sinks.pathTraversal = {
-    install() {
-      depHooks.resolve({ name: 'fs' }, (fs) => {
-        for (const method of FS_METHODS) {
-          // not all methods are available on every OS or Node version.
-          if (fs[method.name]) {
-            const name = `fs.${method.name}`;
-            patcher.patch(fs, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method),
-            });
-          }
-
-          if (method.sync) {
-            const syncName = `${method.name}Sync`;
-            if (fs[syncName]) {
-              const name = `fs.${syncName}`;
-              patcher.patch(fs, syncName, {
-                name,
-                patchType,
-                pre: pre(name, method, 'fs', syncName),
-              });
-            }
-          }
-
-          if (method.promises && fs.promises && fs.promises[method.name]) {
-            const name = `fs.promises.${method.name}`;
-            patcher.patch(fs.promises, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method, 'fs.promises'),
-            });
-          }
-        }
-      });
-
-      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
-        for (const method of FS_METHODS) {
-          if (method.promises && fsPromises[method.name]) {
-            const name = `fsPromises.${method.name}`;
-            patcher.patch(fsPromises, method.name, {
-              name,
-              patchType,
-              pre: pre(name, method, 'fsPromises'),
-            });
-          }
-        }
-      });
-    },
-  };
-
-  return core.assess.dataflow.sinks.pathTraversal;
-};