@contrast/assess 1.41.0 → 1.42.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (162) hide show
  1. package/lib/crypto-analysis/install/crypto.js +4 -5
  2. package/lib/crypto-analysis/install/crypto.test.js +1 -1
  3. package/lib/crypto-analysis/install/math.js +2 -4
  4. package/lib/dataflow/propagation/install/JSON/parse.js +2 -3
  5. package/lib/dataflow/propagation/install/JSON/stringify.js +3 -4
  6. package/lib/dataflow/propagation/install/array-prototype-join.js +2 -3
  7. package/lib/dataflow/propagation/install/buffer.js +3 -4
  8. package/lib/dataflow/propagation/install/contrast-methods/add.js +2 -3
  9. package/lib/dataflow/propagation/install/contrast-methods/number.js +2 -3
  10. package/lib/dataflow/propagation/install/contrast-methods/string.js +2 -3
  11. package/lib/dataflow/propagation/install/contrast-methods/tag.js +2 -3
  12. package/lib/dataflow/propagation/install/decode-uri-component.js +2 -3
  13. package/lib/dataflow/propagation/install/ejs/escape-xml.js +3 -4
  14. package/lib/dataflow/propagation/install/ejs/template.js +3 -4
  15. package/lib/dataflow/propagation/install/ejs/template.test.js +1 -1
  16. package/lib/dataflow/propagation/install/encode-uri.js +2 -3
  17. package/lib/dataflow/propagation/install/escape-html.js +3 -4
  18. package/lib/dataflow/propagation/install/escape.js +2 -3
  19. package/lib/dataflow/propagation/install/fastify-send.js +3 -3
  20. package/lib/dataflow/propagation/install/fastify-send.test.js +1 -3
  21. package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js +3 -4
  22. package/lib/dataflow/propagation/install/isnumeric-0.js +1 -1
  23. package/lib/dataflow/propagation/install/joi/any.js +1 -1
  24. package/lib/dataflow/propagation/install/joi/any.test.js +1 -1
  25. package/lib/dataflow/propagation/install/joi/array.test.js +5 -5
  26. package/lib/dataflow/propagation/install/joi/boolean.js +3 -3
  27. package/lib/dataflow/propagation/install/joi/boolean.test.js +1 -1
  28. package/lib/dataflow/propagation/install/joi/expression.js +3 -3
  29. package/lib/dataflow/propagation/install/joi/expression.test.js +1 -1
  30. package/lib/dataflow/propagation/install/joi/index.js +3 -3
  31. package/lib/dataflow/propagation/install/joi/keys.js +3 -3
  32. package/lib/dataflow/propagation/install/joi/number.js +3 -3
  33. package/lib/dataflow/propagation/install/joi/number.test.js +1 -1
  34. package/lib/dataflow/propagation/install/joi/object.js +1 -1
  35. package/lib/dataflow/propagation/install/joi/object.test.js +1 -1
  36. package/lib/dataflow/propagation/install/joi/ref.test.js +4 -4
  37. package/lib/dataflow/propagation/install/joi/string-schema.js +4 -4
  38. package/lib/dataflow/propagation/install/joi/string-schema.test.js +4 -4
  39. package/lib/dataflow/propagation/install/joi/values.js +3 -3
  40. package/lib/dataflow/propagation/install/mongoose/schema-map.js +4 -4
  41. package/lib/dataflow/propagation/install/mongoose/schema-mixed.js +4 -4
  42. package/lib/dataflow/propagation/install/mongoose/schema-string.js +4 -4
  43. package/lib/dataflow/propagation/install/mustache-escape.js +3 -4
  44. package/lib/dataflow/propagation/install/mustache-escape.test.js +1 -1
  45. package/lib/dataflow/propagation/install/mysql-connection-escape.js +22 -14
  46. package/lib/dataflow/propagation/install/mysql-connection-escape.test.js +1 -1
  47. package/lib/dataflow/propagation/install/parse-int.js +2 -3
  48. package/lib/dataflow/propagation/install/path/basename.js +3 -4
  49. package/lib/dataflow/propagation/install/path/dirname.js +3 -4
  50. package/lib/dataflow/propagation/install/path/extname.js +3 -4
  51. package/lib/dataflow/propagation/install/path/format.js +3 -4
  52. package/lib/dataflow/propagation/install/path/join-and-resolve.js +3 -4
  53. package/lib/dataflow/propagation/install/path/normalize.js +4 -5
  54. package/lib/dataflow/propagation/install/path/parse.js +3 -4
  55. package/lib/dataflow/propagation/install/path/relative.js +4 -5
  56. package/lib/dataflow/propagation/install/path/toNamespacedPath.js +3 -4
  57. package/lib/dataflow/propagation/install/pug/index.js +3 -4
  58. package/lib/dataflow/propagation/install/pug-runtime-escape.js +3 -4
  59. package/lib/dataflow/propagation/install/querystring/escape.js +3 -4
  60. package/lib/dataflow/propagation/install/querystring/escape.test.js +1 -1
  61. package/lib/dataflow/propagation/install/querystring/parse.js +3 -4
  62. package/lib/dataflow/propagation/install/querystring/parse.test.js +1 -1
  63. package/lib/dataflow/propagation/install/querystring/stringify.js +3 -4
  64. package/lib/dataflow/propagation/install/querystring/stringify.test.js +1 -1
  65. package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js +2 -3
  66. package/lib/dataflow/propagation/install/send.js +3 -3
  67. package/lib/dataflow/propagation/install/sequelize/query-generator.js +3 -3
  68. package/lib/dataflow/propagation/install/sequelize/query-generator.test.js +2 -1
  69. package/lib/dataflow/propagation/install/sequelize/sql-string.js +5 -5
  70. package/lib/dataflow/propagation/install/sql-template-strings.js +3 -3
  71. package/lib/dataflow/propagation/install/string/concat.js +2 -3
  72. package/lib/dataflow/propagation/install/string/format-methods.js +2 -3
  73. package/lib/dataflow/propagation/install/string/html-methods.js +3 -4
  74. package/lib/dataflow/propagation/install/string/match-all.js +2 -3
  75. package/lib/dataflow/propagation/install/string/match.js +2 -3
  76. package/lib/dataflow/propagation/install/string/replace.js +2 -3
  77. package/lib/dataflow/propagation/install/string/slice.js +2 -3
  78. package/lib/dataflow/propagation/install/string/split.js +2 -3
  79. package/lib/dataflow/propagation/install/string/substring.js +2 -3
  80. package/lib/dataflow/propagation/install/string/trim.js +2 -3
  81. package/lib/dataflow/propagation/install/unescape.js +2 -3
  82. package/lib/dataflow/propagation/install/url/domain-parsers.js +3 -4
  83. package/lib/dataflow/propagation/install/url/parse.js +3 -4
  84. package/lib/dataflow/propagation/install/url/parse.test.js +2 -2
  85. package/lib/dataflow/propagation/install/url/searchParams.js +3 -4
  86. package/lib/dataflow/propagation/install/url/url.js +3 -4
  87. package/lib/dataflow/propagation/install/util-format.js +3 -4
  88. package/lib/dataflow/propagation/install/validator/hooks.js +9 -9
  89. package/lib/dataflow/sinks/install/child-process.js +5 -6
  90. package/lib/dataflow/sinks/install/eval.js +2 -3
  91. package/lib/dataflow/sinks/install/express/reflected-xss.js +2 -3
  92. package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +2 -3
  93. package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +3 -4
  94. package/lib/dataflow/sinks/install/fs.js +4 -5
  95. package/lib/dataflow/sinks/install/fs.test.js +2 -2
  96. package/lib/dataflow/sinks/install/function.js +2 -3
  97. package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.js +3 -4
  98. package/lib/dataflow/sinks/install/http/request.js +3 -4
  99. package/lib/dataflow/sinks/install/http/request.test.js +2 -2
  100. package/lib/dataflow/sinks/install/http/server-response.js +5 -6
  101. package/lib/dataflow/sinks/install/http/server-response.test.js +3 -3
  102. package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +3 -4
  103. package/lib/dataflow/sinks/install/libxmljs.js +4 -5
  104. package/lib/dataflow/sinks/install/libxmljs.test.js +2 -2
  105. package/lib/dataflow/sinks/install/marsdb.js +3 -4
  106. package/lib/dataflow/sinks/install/marsdb.test.js +3 -3
  107. package/lib/dataflow/sinks/install/mongodb.js +3 -4
  108. package/lib/dataflow/sinks/install/mongodb.test.js +2 -6
  109. package/lib/dataflow/sinks/install/mssql.js +4 -5
  110. package/lib/dataflow/sinks/install/mssql.test.js +2 -2
  111. package/lib/dataflow/sinks/install/mysql.js +4 -5
  112. package/lib/dataflow/sinks/install/mysql.test.js +2 -11
  113. package/lib/dataflow/sinks/install/node-serialize.js +3 -4
  114. package/lib/dataflow/sinks/install/node-serialize.test.js +1 -3
  115. package/lib/dataflow/sinks/install/postgres.js +5 -6
  116. package/lib/dataflow/sinks/install/postgres.test.js +3 -9
  117. package/lib/dataflow/sinks/install/restify.js +3 -4
  118. package/lib/dataflow/sinks/install/restify.test.js +3 -5
  119. package/lib/dataflow/sinks/install/sequelize.js +3 -4
  120. package/lib/dataflow/sinks/install/sqlite3.js +3 -4
  121. package/lib/dataflow/sinks/install/vm.js +3 -4
  122. package/lib/dataflow/sources/install/body-parser1.js +2 -3
  123. package/lib/dataflow/sources/install/busboy.js +3 -4
  124. package/lib/dataflow/sources/install/busboy.test.js +2 -2
  125. package/lib/dataflow/sources/install/cookie-parser1.js +2 -3
  126. package/lib/dataflow/sources/install/express/params.js +1 -2
  127. package/lib/dataflow/sources/install/express/parsedUrl.js +1 -2
  128. package/lib/dataflow/sources/install/express/parsedUrl.test.js +9 -8
  129. package/lib/dataflow/sources/install/fastify/fastify.js +2 -3
  130. package/lib/dataflow/sources/install/fastify/fastify.test.js +3 -6
  131. package/lib/dataflow/sources/install/formidable1.js +2 -3
  132. package/lib/dataflow/sources/install/hapi/hapi.js +1 -2
  133. package/lib/dataflow/sources/install/http.js +2 -3
  134. package/lib/dataflow/sources/install/http.test.js +2 -2
  135. package/lib/dataflow/sources/install/koa/koa-bodyparsers.js +3 -5
  136. package/lib/dataflow/sources/install/koa/koa-multer.js +3 -4
  137. package/lib/dataflow/sources/install/koa/koa-multer.test.js +1 -1
  138. package/lib/dataflow/sources/install/koa/koa-routers.js +3 -4
  139. package/lib/dataflow/sources/install/koa/koa2.js +2 -4
  140. package/lib/dataflow/sources/install/multer1.js +2 -3
  141. package/lib/dataflow/sources/install/multer1.test.js +1 -3
  142. package/lib/dataflow/sources/install/qs6.js +2 -3
  143. package/lib/dataflow/sources/install/querystring.js +2 -3
  144. package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.js +2 -3
  145. package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.test.js +1 -1
  146. package/lib/dataflow/sources/install/restify/jsonBodyParser.js +2 -3
  147. package/lib/dataflow/sources/install/restify/jsonBodyParser.test.js +1 -1
  148. package/lib/dataflow/sources/install/restify/router.js +2 -3
  149. package/lib/dataflow/sources/install/restify/router.test.js +1 -1
  150. package/lib/get-source-context.js +58 -39
  151. package/lib/get-source-context.test.js +103 -78
  152. package/lib/index.d.ts +3 -9
  153. package/lib/response-scanning/install/http.js +3 -3
  154. package/lib/response-scanning/install/http.test.js +2 -2
  155. package/lib/session-configuration/install/express-session.js +1 -1
  156. package/lib/session-configuration/install/express-session.test.js +1 -3
  157. package/lib/session-configuration/install/fastify-cookie.js +1 -1
  158. package/lib/session-configuration/install/fastify-cookie.test.js +1 -3
  159. package/lib/session-configuration/install/koa.js +1 -1
  160. package/lib/session-configuration/install/koa.test.js +1 -1
  161. package/package.json +11 -11
  162. package/lib/constants.js +0 -26
@@ -16,7 +16,6 @@
16
16
  'use strict';
17
17
 
18
18
  const { isString, primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
19
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
20
19
  const { createMergedTags } = require('../../../tag-utils');
21
20
  const { patchType } = require('../../common');
22
21
  const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
@@ -26,7 +25,7 @@ module.exports = function(core) {
26
25
  depHooks,
27
26
  patcher,
28
27
  assess: {
29
- getSourceContext,
28
+ getPropagatorContext,
30
29
  eventFactory: { createPropagationEvent },
31
30
  dataflow: { tracker },
32
31
  },
@@ -34,7 +33,7 @@ module.exports = function(core) {
34
33
 
35
34
  core.assess.dataflow.propagation.pathInstrumentation.joinAndResolve = {
36
35
  install() {
37
- depHooks.resolve({ name: 'path' }, (path) => {
36
+ depHooks.resolve({ name: 'path', version: '*' }, (path) => {
38
37
  for (const method of ['join', 'resolve']) {
39
38
  for (const os of ['posix', 'win32']) {
40
39
  const name = `path.${os}.${method}`;
@@ -47,7 +46,7 @@ module.exports = function(core) {
47
46
  post(data) {
48
47
  const { args: origArgs, result, hooked, orig } = data;
49
48
 
50
- if (!result || !getSourceContext(PROPAGATOR)) return;
49
+ if (!result || !getPropagatorContext()) return;
51
50
 
52
51
  const pathSegments = [...origArgs].reverse();
53
52
  const args = [];
@@ -15,16 +15,15 @@
15
15
 
16
16
  'use strict';
17
17
  const { isString } = require('@contrast/common');
18
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
19
18
  const { patchType } = require('../../common');
20
- const { createArgTagsInResult, excludeExtensionDotFromTags, } = require('./common');
19
+ const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
21
20
 
22
21
  module.exports = function(core) {
23
22
  const {
24
23
  depHooks,
25
24
  patcher,
26
25
  assess: {
27
- getSourceContext,
26
+ getPropagatorContext,
28
27
  eventFactory: { createPropagationEvent },
29
28
  dataflow: { tracker },
30
29
  },
@@ -32,7 +31,7 @@ module.exports = function(core) {
32
31
 
33
32
  core.assess.dataflow.propagation.pathInstrumentation.normalize = {
34
33
  install() {
35
- depHooks.resolve({ name: 'path' }, (path) => {
34
+ depHooks.resolve({ name: 'path', version: '*' }, (path) => {
36
35
  for (const os of ['posix', 'win32']) {
37
36
  const isWin32 = os === 'win32';
38
37
 
@@ -42,7 +41,7 @@ module.exports = function(core) {
42
41
  usePerf: 'sync',
43
42
  post(data) {
44
43
  const { args, result, name, hooked, orig } = data;
45
- if (!result || !getSourceContext(PROPAGATOR)) return;
44
+ if (!result || !getPropagatorContext()) return;
46
45
 
47
46
  const pathStr = args[0];
48
47
 
@@ -15,7 +15,6 @@
15
15
 
16
16
  'use strict';
17
17
  const { isString } = require('@contrast/common');
18
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
19
18
  const { createSubsetTags } = require('../../../tag-utils');
20
19
  const { patchType } = require('../../common');
21
20
  const { excludeExtensionDotFromTags } = require('./common');
@@ -25,7 +24,7 @@ module.exports = function(core) {
25
24
  depHooks,
26
25
  patcher,
27
26
  assess: {
28
- getSourceContext,
27
+ getPropagatorContext,
29
28
  inspect, // TODO NODE-3455: remove
30
29
  eventFactory: { createPropagationEvent },
31
30
  dataflow: { tracker },
@@ -34,7 +33,7 @@ module.exports = function(core) {
34
33
 
35
34
  core.assess.dataflow.propagation.pathInstrumentation.parse = {
36
35
  install() {
37
- depHooks.resolve({ name: 'path' }, (path) => {
36
+ depHooks.resolve({ name: 'path', version: '*' }, (path) => {
38
37
  for (const os of ['posix', 'win32']) {
39
38
  const isWin32 = os === 'win32';
40
39
 
@@ -44,7 +43,7 @@ module.exports = function(core) {
44
43
  usePerf: 'sync',
45
44
  post(data) {
46
45
  const { args, result, name: patchName, hooked, orig } = data;
47
- if (!result || !getSourceContext(PROPAGATOR)) return;
46
+ if (!result || !getPropagatorContext()) return;
48
47
 
49
48
  const [path] = args;
50
49
  if (!path || !isString(path)) return;
@@ -16,16 +16,15 @@
16
16
  'use strict';
17
17
 
18
18
  const { isString } = require('@contrast/common');
19
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
20
19
  const { patchType } = require('../../common');
21
- const { createArgTagsInResult, excludeExtensionDotFromTags, } = require('./common');
20
+ const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
22
21
 
23
22
  module.exports = function(core) {
24
23
  const {
25
24
  depHooks,
26
25
  patcher,
27
26
  assess: {
28
- getSourceContext,
27
+ getPropagatorContext,
29
28
  eventFactory: { createPropagationEvent },
30
29
  dataflow: { tracker },
31
30
  },
@@ -33,7 +32,7 @@ module.exports = function(core) {
33
32
 
34
33
  core.assess.dataflow.propagation.pathInstrumentation.relative = {
35
34
  install() {
36
- depHooks.resolve({ name: 'path' }, (path) => {
35
+ depHooks.resolve({ name: 'path', version: '*' }, (path) => {
37
36
  for (const os of ['posix', 'win32']) {
38
37
  const isWin32 = os === 'win32';
39
38
 
@@ -43,7 +42,7 @@ module.exports = function(core) {
43
42
  usePerf: 'sync',
44
43
  post(data) {
45
44
  const { args, result, name, hooked, orig } = data;
46
- if (!result || !getSourceContext(PROPAGATOR)) return;
45
+ if (!result || !getPropagatorContext()) return;
47
46
 
48
47
  const [fromStr, toStr] = args;
49
48
 
@@ -16,7 +16,6 @@
16
16
  'use strict';
17
17
 
18
18
  const { isString } = require('@contrast/common');
19
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
20
19
  const { patchType } = require('../../common');
21
20
  const { createArgTagsInResult, excludeExtensionDotFromTags } = require('./common');
22
21
 
@@ -25,7 +24,7 @@ module.exports = function(core) {
25
24
  depHooks,
26
25
  patcher,
27
26
  assess: {
28
- getSourceContext,
27
+ getPropagatorContext,
29
28
  eventFactory: { createPropagationEvent },
30
29
  dataflow: { tracker },
31
30
  },
@@ -33,7 +32,7 @@ module.exports = function(core) {
33
32
 
34
33
  core.assess.dataflow.propagation.pathInstrumentation.toNamespacedPath = {
35
34
  install() {
36
- depHooks.resolve({ name: 'path' }, (path) => {
35
+ depHooks.resolve({ name: 'path', version: '*' }, (path) => {
37
36
  for (const os of ['posix', 'win32']) {
38
37
 
39
38
  patcher.patch(path[os], 'toNamespacedPath', {
@@ -42,7 +41,7 @@ module.exports = function(core) {
42
41
  usePerf: 'sync',
43
42
  post(data) {
44
43
  const { args, result, name, hooked, orig } = data;
45
- if (!result || !getSourceContext(PROPAGATOR)) return;
44
+ if (!result || !getPropagatorContext()) return;
46
45
 
47
46
  const pathStr = args[0];
48
47
 
@@ -14,7 +14,6 @@
14
14
  */
15
15
  'use strict';
16
16
 
17
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
18
17
  const { patchType } = require('../../common');
19
18
 
20
19
  /** @type {import('@contrast/rewriter').RewriteOpts} */
@@ -28,19 +27,19 @@ module.exports = function (core) {
28
27
  rewriter,
29
28
  depHooks,
30
29
  scopes: { instrumentation },
31
- assess: { getSourceContext },
30
+ assess: { getPropagatorContext },
32
31
  } = core;
33
32
 
34
33
  const pugInstrumentation = {
35
34
  install() {
36
35
  depHooks.resolve(
37
- { name: 'pug' },
36
+ { name: 'pug', version: '<4' },
38
37
  (pug) => patcher.patch(pug, 'compile', {
39
38
  name: 'pug.compile',
40
39
  patchType,
41
40
  usePerf: 'tbd',
42
41
  pre(data) {
43
- if (!getSourceContext(PROPAGATOR)) return;
42
+ if (!getPropagatorContext()) return;
44
43
 
45
44
  const opts = data.args[1] || {};
46
45
  const plugins = opts.plugins || [];
@@ -16,7 +16,6 @@
16
16
  'use strict';
17
17
 
18
18
  const { DataflowTag: { WEAK_URL_ENCODED } } = require('@contrast/common');
19
- const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
20
19
  const { createFullLengthCopyTags } = require('../../tag-utils');
21
20
  const { patchType, createModuleLabel } = require('../common');
22
21
 
@@ -25,7 +24,7 @@ module.exports = function(core) {
25
24
  patcher,
26
25
  depHooks,
27
26
  assess: {
28
- getSourceContext,
27
+ getPropagatorContext,
29
28
  eventFactory: { createPropagationEvent },
30
29
  dataflow: { tracker }
31
30
  }
@@ -33,7 +32,7 @@ module.exports = function(core) {
33
32
 
34
33
  return core.assess.dataflow.propagation.pugRuntimeEscape = {
35
34
  install() {
36
- depHooks.resolve({ name: 'pug-runtime' }, (pugRuntime, version) => {
35
+ depHooks.resolve({ name: 'pug-runtime', version: '<4' }, (pugRuntime, version) => {
37
36
  const name = 'pug-runtime.escape';
38
37
 
39
38
  patcher.patch(pugRuntime, 'escape', {
@@ -42,7 +41,7 @@ module.exports = function(core) {
42
41
  usePerf: 'sync',
43
42
  post(data) {
44
43
  const { args, result, hooked, orig } = data;
45
- if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
44
+ if (!result || !args[0] || !getPropagatorContext()) return;
46
45
 
47
46
  const argInfo = tracker.getData(args[0]);
48
47
 
@@ -15,14 +15,13 @@
15
15
  'use strict';
16
16
 
17
17
  const { DataflowTag: { URL_ENCODED } } = require('@contrast/common');
18
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
19
18
  const { createFullLengthCopyTags } = require('../../../tag-utils');
20
19
  const { patchType } = require('../../common');
21
20
 
22
21
  module.exports = function(core) {
23
22
  const {
24
23
  assess: {
25
- getSourceContext,
24
+ getPropagatorContext,
26
25
  inspect, // TODO NODE-3455: remove
27
26
  eventFactory: { createPropagationEvent },
28
27
  dataflow: { tracker }
@@ -33,7 +32,7 @@ module.exports = function(core) {
33
32
 
34
33
  return core.assess.dataflow.propagation.querystringInstrumentation.escape = {
35
34
  install() {
36
- depHooks.resolve({ name: 'querystring' }, (_export) => {
35
+ depHooks.resolve({ name: 'querystring', version: '<1' }, (_export) => {
37
36
  patcher.patch(_export, 'escape', {
38
37
  name: 'querystring.escape',
39
38
  patchType,
@@ -45,7 +44,7 @@ module.exports = function(core) {
45
44
  const strInfo = tracker.getData(value);
46
45
  if (!strInfo) return;
47
46
 
48
- if (!getSourceContext(PROPAGATOR)) return;
47
+ if (!getPropagatorContext()) return;
49
48
 
50
49
  let tags;
51
50
  if (value !== data.result) {
@@ -20,7 +20,7 @@ describe('assess dataflow propagation querystring escape', function () {
20
20
  tracker = core.assess.dataflow.tracker;
21
21
 
22
22
  querystring = require('querystring');
23
- core.depHooks.resolve.withArgs({ name: 'querystring' }).yields(querystring);
23
+ core.depHooks.resolve.yields(querystring);
24
24
 
25
25
  core.assess.dataflow.propagation.querystringInstrumentation.escape.install();
26
26
  });
@@ -20,7 +20,6 @@ const {
20
20
  DataflowTag: { URL_ENCODED },
21
21
  primordials: { ArrayPrototypeJoin },
22
22
  } = require('@contrast/common');
23
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
24
23
  const { createSubsetTags, createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
25
24
  const { patchType } = require('../../common');
26
25
 
@@ -29,7 +28,7 @@ module.exports = function(core) {
29
28
  patcher,
30
29
  depHooks,
31
30
  assess: {
32
- getSourceContext,
31
+ getPropagatorContext,
33
32
  eventFactory: { createPropagationEvent },
34
33
  dataflow: { tracker }
35
34
  }
@@ -100,14 +99,14 @@ module.exports = function(core) {
100
99
 
101
100
  return core.assess.dataflow.propagation.querystringInstrumentation.parse = {
102
101
  install() {
103
- depHooks.resolve({ name: 'querystring' }, (module) => {
102
+ depHooks.resolve({ name: 'querystring', version: '<1' }, (module) => {
104
103
  ['parse', 'decode'].forEach((method) => {
105
104
  patcher.patch(module, method, {
106
105
  name: `querystring.${method}`,
107
106
  patchType,
108
107
  usePerf: 'sync',
109
108
  pre(data) {
110
- if (!data.args[0] || !getSourceContext(PROPAGATOR)) return;
109
+ if (!data.args[0] || !getPropagatorContext()) return;
111
110
 
112
111
  const trackingData = tracker.getData(data.args[0]);
113
112
  if (!trackingData) return;
@@ -21,7 +21,7 @@ describe('assess dataflow propagation querystring parse', function () {
21
21
  querystring = require('querystring');
22
22
  core.assess.dataflow.propagation.querystringInstrumentation.parse.install();
23
23
  core.assess.dataflow.propagation.stringInstrumentation.concat.install();
24
- core.depHooks.resolve.withArgs({ name: 'querystring' }).yield(querystring);
24
+ core.depHooks.resolve.yield(querystring);
25
25
  });
26
26
 
27
27
  afterEach(function () {
@@ -16,7 +16,6 @@
16
16
 
17
17
  const querystring = require('querystring');
18
18
  const { isString } = require('@contrast/common');
19
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
20
19
  const utils = require('../../../tag-utils');
21
20
  const { patchType } = require('../../common');
22
21
 
@@ -25,7 +24,7 @@ const moduleName = 'querystring';
25
24
  module.exports = function(core) {
26
25
  const {
27
26
  assess: {
28
- getSourceContext,
27
+ getPropagatorContext,
29
28
  inspect, // TODO NODE-3455: remove
30
29
  dataflow: { tracker },
31
30
  eventFactory: { createPropagationEvent },
@@ -38,7 +37,7 @@ module.exports = function(core) {
38
37
  * Adds custom encoding function to capture key/value tags and history during stringification
39
38
  */
40
39
  function pre(data) {
41
- if (!getSourceContext(PROPAGATOR)) return;
40
+ if (!getPropagatorContext()) return;
42
41
 
43
42
  const [input] = data.args;
44
43
  const escape = typeof data.args[3]?.encodeURIComponent === 'function'
@@ -142,7 +141,7 @@ module.exports = function(core) {
142
141
 
143
142
  return core.assess.dataflow.propagation.querystringInstrumentation.stringify = {
144
143
  install() {
145
- depHooks.resolve({ name: moduleName }, (_export) => {
144
+ depHooks.resolve({ name: moduleName, version: '<1' }, (_export) => {
146
145
  for (const methodName of ['encode', 'stringify']) {
147
146
  patcher.patch(_export, methodName, {
148
147
  name: `querystring.${methodName}`,
@@ -14,7 +14,7 @@ describe('assess dataflow propagation querystring stringify', function () {
14
14
  tracker = core.assess.dataflow.tracker;
15
15
 
16
16
  querystring = require('querystring');
17
- core.depHooks.resolve.withArgs({ name: 'querystring' }).yields(querystring);
17
+ core.depHooks.resolve.yields(querystring);
18
18
 
19
19
  core.assess.dataflow.propagation.stringInstrumentation.concat.install();
20
20
  core.assess.dataflow.propagation.querystringInstrumentation.escape.install();
@@ -15,7 +15,6 @@
15
15
 
16
16
  'use strict';
17
17
 
18
- const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
19
18
  const { createSubsetTags, getAdjustedUntrackedValue } = require('../../tag-utils');
20
19
  const { patchType } = require('../common');
21
20
 
@@ -23,7 +22,7 @@ module.exports = function(core) {
23
22
  const {
24
23
  patcher,
25
24
  assess: {
26
- getSourceContext,
25
+ getPropagatorContext,
27
26
  eventFactory: { createPropagationEvent },
28
27
  dataflow: { tracker },
29
28
  },
@@ -86,7 +85,7 @@ module.exports = function(core) {
86
85
  !obj ||
87
86
  !args[0] ||
88
87
  !result?.length ||
89
- !getSourceContext(PROPAGATOR)
88
+ !getPropagatorContext()
90
89
  )
91
90
  return;
92
91
 
@@ -21,7 +21,7 @@ module.exports = function (core) {
21
21
  const {
22
22
  depHooks,
23
23
  patcher,
24
- assess: { getSourceContext }
24
+ assess: { getPropagatorContext }
25
25
  } = core;
26
26
 
27
27
  const send = {};
@@ -38,7 +38,7 @@ module.exports = function (core) {
38
38
  patchType,
39
39
  pre(data) {
40
40
  const { args } = data;
41
- if (!getSourceContext()) return;
41
+ if (!getPropagatorContext()) return;
42
42
 
43
43
  const untrackedPath = StringPrototypeSlice.call(` ${args[0]}`, 1);
44
44
  args[0] = untrackedPath;
@@ -49,7 +49,7 @@ module.exports = function (core) {
49
49
  }
50
50
 
51
51
  send.install = function () {
52
- depHooks.resolve({ name: 'send' }, patchSendModule);
52
+ depHooks.resolve({ name: 'send', version: '<2' }, patchSendModule);
53
53
  };
54
54
 
55
55
  return send;
@@ -31,7 +31,7 @@ const DIALECTS = [
31
31
  module.exports = function(core) {
32
32
  const {
33
33
  assess: {
34
- getSourceContext,
34
+ getPropagatorContext,
35
35
  eventFactory: { createPropagationEvent },
36
36
  dataflow: { tracker }
37
37
  },
@@ -43,7 +43,7 @@ module.exports = function(core) {
43
43
  install() {
44
44
  for (const dialect of DIALECTS) {
45
45
  depHooks.resolve(
46
- { name: 'sequelize', file: `lib/dialects/${dialect}/query-generator.js` },
46
+ { name: 'sequelize', version: '<7', file: `lib/dialects/${dialect}/query-generator.js` },
47
47
  (_export) => {
48
48
  const constructor = _export.name;
49
49
 
@@ -53,7 +53,7 @@ module.exports = function(core) {
53
53
  usePerf: 'sync',
54
54
  post(data) {
55
55
  const strInfo = tracker.getData(data.result);
56
- if (!strInfo || !getSourceContext()) return;
56
+ if (!strInfo || !getPropagatorContext()) return;
57
57
 
58
58
  const { value } = strInfo;
59
59
  const event = createPropagationEvent({
@@ -1,6 +1,7 @@
1
1
  'use strict';
2
2
 
3
3
  const { expect } = require('chai');
4
+ const sinon = require('sinon');
4
5
  const {
5
6
  DataflowTag: { UNTRUSTED, SQL_ENCODED }
6
7
  } = require('@contrast/common');
@@ -45,7 +46,7 @@ describe('assess dataflow propagation sequelize QueryGenerators', function() {
45
46
  },
46
47
  ].forEach(({ Ctor, file }) => {
47
48
  it(`${Ctor.name}.prototype.quoteIdentifier adds sql-encoded tag`, function() {
48
- core.depHooks.resolve.withArgs({ name: 'sequelize', file }).yields(Ctor);
49
+ core.depHooks.resolve.withArgs(sinon.match({ name: 'sequelize', file })).yields(Ctor);
49
50
  component.install();
50
51
 
51
52
  simulateRequestScope(() => {
@@ -27,7 +27,7 @@ module.exports = function(core) {
27
27
  patcher,
28
28
  depHooks,
29
29
  assess: {
30
- getSourceContext,
30
+ getPropagatorContext,
31
31
  eventFactory: { createPropagationEvent },
32
32
  dataflow: { tracker },
33
33
  },
@@ -54,7 +54,7 @@ module.exports = function(core) {
54
54
  return core.assess.dataflow.propagation.sequelizeInstrumentation.sqlString = {
55
55
  install() {
56
56
  depHooks.resolve(
57
- { name: 'sequelize', file: 'lib/sql-string.js' },
57
+ { name: 'sequelize', version: '<7', file: 'lib/sql-string.js' },
58
58
  (sqlString, version) => {
59
59
  const origEscape = sqlString.escape;
60
60
  const name = 'sequelize.escape';
@@ -70,7 +70,7 @@ module.exports = function(core) {
70
70
  !result ||
71
71
  !args[0] ||
72
72
  !isString(args[0]) ||
73
- !getSourceContext()
73
+ !getPropagatorContext()
74
74
  ) return;
75
75
 
76
76
  const argInfo = tracker.getData(args[0]);
@@ -124,7 +124,7 @@ module.exports = function(core) {
124
124
  !result ||
125
125
  !args[0] ||
126
126
  !isString(args[0]) ||
127
- !getSourceContext()
127
+ !getPropagatorContext()
128
128
  ) return;
129
129
 
130
130
  const resultInfo = tracker.getData(result);
@@ -216,7 +216,7 @@ module.exports = function(core) {
216
216
  !result ||
217
217
  !args[0] ||
218
218
  !isString(args[0]) ||
219
- !getSourceContext()
219
+ !getPropagatorContext()
220
220
  ) return;
221
221
 
222
222
  const resultInfo = tracker.getData(result);
@@ -23,7 +23,7 @@ module.exports = function(core) {
23
23
  patcher,
24
24
  depHooks,
25
25
  assess: {
26
- getSourceContext,
26
+ getPropagatorContext,
27
27
  eventFactory: { createPropagationEvent },
28
28
  dataflow: { tracker }
29
29
  }
@@ -31,7 +31,7 @@ module.exports = function(core) {
31
31
 
32
32
  return core.assess.dataflow.propagation.sqlTemplateStrings = {
33
33
  install() {
34
- depHooks.resolve({ name: 'sql-template-strings' }, (sqlTemplateStrings, version) => {
34
+ depHooks.resolve({ name: 'sql-template-strings', version: '<3' }, (sqlTemplateStrings, version) => {
35
35
  const name = 'sql-template-strings.SQL';
36
36
 
37
37
  patcher.patch(sqlTemplateStrings, 'SQL', {
@@ -40,7 +40,7 @@ module.exports = function(core) {
40
40
  usePerf: 'sync',
41
41
  post(data) {
42
42
  const { args, result, hooked, orig } = data;
43
- if (!result || !args[0] || !getSourceContext()) return;
43
+ if (!result || !args[0] || !getPropagatorContext()) return;
44
44
 
45
45
  const argInfo = tracker.getData(args[0]);
46
46
 
@@ -16,7 +16,6 @@
16
16
  'use strict';
17
17
 
18
18
  const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
19
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
20
19
  const { createAppendTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
21
20
  const { patchType } = require('../../common');
22
21
 
@@ -24,7 +23,7 @@ module.exports = function(core) {
24
23
  const {
25
24
  patcher,
26
25
  assess: {
27
- getSourceContext,
26
+ getPropagatorContext,
28
27
  eventFactory: { createPropagationEvent },
29
28
  dataflow: { tracker }
30
29
  }
@@ -40,7 +39,7 @@ module.exports = function(core) {
40
39
  usePerf: 'sync',
41
40
  post(data) {
42
41
  const { obj, result, hooked, orig } = data;
43
- if (!result || !getSourceContext(PROPAGATOR)) return;
42
+ if (!result || !getPropagatorContext()) return;
44
43
 
45
44
  const rInfo = tracker.getData(result);
46
45
  if (rInfo) {
@@ -15,14 +15,13 @@
15
15
 
16
16
  'use strict';
17
17
 
18
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
19
18
  const { patchType } = require('../../common');
20
19
 
21
20
  module.exports = function(core) {
22
21
  const {
23
22
  patcher,
24
23
  assess: {
25
- getSourceContext,
24
+ getPropagatorContext,
26
25
  eventFactory: { createPropagationEvent },
27
26
  dataflow: { tracker }
28
27
  }
@@ -39,7 +38,7 @@ module.exports = function(core) {
39
38
  usePerf: 'sync',
40
39
  post(data) {
41
40
  const { obj, result, hooked, orig } = data;
42
- if (!result || !getSourceContext(PROPAGATOR)) return;
41
+ if (!result || !getPropagatorContext()) return;
43
42
 
44
43
  const objInfo = tracker.getData(obj);
45
44
 
@@ -14,7 +14,6 @@
14
14
  */
15
15
 
16
16
  'use strict';
17
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
18
17
  const { createAppendTags } = require('../../../tag-utils');
19
18
  const { patchType } = require('../../common');
20
19
  const htmlTagsLengths = {
@@ -33,7 +32,7 @@ module.exports = function(core) {
33
32
  patcher,
34
33
  assess: {
35
34
  inspect, // TODO NODE-3455: remove
36
- getSourceContext,
35
+ getPropagatorContext,
37
36
  eventFactory: { createPropagationEvent },
38
37
  dataflow: { tracker }
39
38
  }
@@ -64,7 +63,7 @@ module.exports = function(core) {
64
63
  usePost: true,
65
64
  post(data) {
66
65
  const { args, obj, result, hooked, orig } = data;
67
- if (!result || !getSourceContext(PROPAGATOR)) return;
66
+ if (!result || !getPropagatorContext()) return;
68
67
 
69
68
  const objInfo = tracker.getData(obj);
70
69
  const history = objInfo ? new Set([objInfo]) : new Set();
@@ -121,7 +120,7 @@ module.exports = function(core) {
121
120
  patchType,
122
121
  post(data) {
123
122
  const { obj, result, hooked, orig } = data;
124
- if (!result || !getSourceContext(PROPAGATOR)) return;
123
+ if (!result || !getPropagatorContext()) return;
125
124
 
126
125
  const objInfo = tracker.getData(obj);
127
126
 
@@ -14,7 +14,6 @@
14
14
  */
15
15
 
16
16
  'use strict';
17
- const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
18
17
  const { createSubsetTags } = require('../../../tag-utils');
19
18
  const { patchType } = require('../../common');
20
19
 
@@ -22,7 +21,7 @@ module.exports = function(core) {
22
21
  const {
23
22
  patcher,
24
23
  assess: {
25
- getSourceContext,
24
+ getPropagatorContext,
26
25
  eventFactory: { createPropagationEvent },
27
26
  dataflow: {
28
27
  tracker,
@@ -83,7 +82,7 @@ module.exports = function(core) {
83
82
  !obj ||
84
83
  !args[0] ||
85
84
  typeof obj !== 'string' ||
86
- !getSourceContext(PROPAGATOR)
85
+ !getPropagatorContext()
87
86
  )
88
87
  return origFn();
89
88