@contrast/assess 1.41.0 → 1.42.0

package/lib/dataflow/propagation/install/string/match.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -25,7 +24,7 @@ module.exports = function(core) {
     scopes,
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
@@ -87,7 +86,7 @@ module.exports = function(core) {
             !args.length ||
             typeof obj !== 'string' ||
             (args.length === 1 && !args[0]) ||
-            !getSourceContext(PROPAGATOR)
+            !getPropagatorContext()
           ) return origFn();
           const objInfo = tracker.getData(obj);
 

package/lib/dataflow/propagation/install/string/replace.js

@@ -25,7 +25,6 @@ const {
     StringPrototypeReplace
   }
 } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const {
   createSubsetTags,
   createAppendTags,
@@ -37,7 +36,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     },
@@ -152,7 +151,7 @@ module.exports = function(core) {
         patchType,
         usePerf: 'sync',
         pre(data) {
-          if (!getSourceContext(PROPAGATOR)) return;
+          if (!getPropagatorContext()) return;
 
           // setup state
           data._objInfo = tracker.getData(data.obj);

package/lib/dataflow/propagation/install/string/slice.js

@@ -14,7 +14,6 @@
  */
 'use strict';
 const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -22,7 +21,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -57,7 +56,7 @@ module.exports = function(core) {
         usePerf: 'sync',
         post(data) {
           const { name, args: origArgs, obj, result, hooked, orig } = data;
-          if (!result || !getSourceContext(PROPAGATOR)) return;
+          if (!result || !getPropagatorContext()) return;
 
           const objInfo = tracker.getData(obj);
           if (!objInfo) return;

package/lib/dataflow/propagation/install/string/split.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -24,7 +23,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory,
       dataflow: { tracker }
     }
@@ -47,7 +46,7 @@ module.exports = function(core) {
             result.length === 0 ||
             typeof obj !== 'string' ||
             (origArgs.length === 1 && origArgs[0] == null) ||
-            !getSourceContext(PROPAGATOR)
+            !getPropagatorContext()
           ) return;
 
           const objInfo = tracker.getData(obj);

package/lib/dataflow/propagation/install/string/substring.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { primordials: { ArrayPrototypeJoin } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -24,7 +23,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -65,7 +64,7 @@ module.exports = function(core) {
           usePerf: 'sync',
           post(data) {
             const { obj, args: origArgs, result, name, hooked, orig } = data;
-            if (!result || !getSourceContext(PROPAGATOR)) return;
+            if (!result || !getPropagatorContext()) return;
 
             const objInfo = tracker.getData(obj);
             if (!objInfo) return;

package/lib/dataflow/propagation/install/string/trim.js

@@ -15,7 +15,6 @@
 
 'use strict';
 
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -23,7 +22,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -33,7 +32,7 @@ module.exports = function(core) {
     return function(data) {
       const { obj, result, hooked, orig } = data;
 
-      if (!result?.length || !getSourceContext(PROPAGATOR)) {
+      if (!result?.length || !getPropagatorContext()) {
         return;
       }
       const rInfo = tracker.getData(result);

package/lib/dataflow/propagation/install/unescape.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { DataflowTag: { WEAK_URL_ENCODED } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
 const { createFullLengthCopyTags } = require('../../tag-utils');
 const { patchType, createObjectLabel } = require('../common');
 
@@ -24,7 +23,7 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -40,7 +39,7 @@ module.exports = function(core) {
         usePerf: 'sync',
         post(data) {
           const { args, result, hooked, orig } = data;
-          if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
+          if (!result || !args[0] || !getPropagatorContext()) return;
 
           const argInfo = tracker.getData(args[0]);
 

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -15,7 +15,6 @@
 
 'use strict';
 
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createFullLengthCopyTags } = require('../../../tag-utils');
 const { patchType, createModuleLabel } = require('../../common');
 
@@ -24,7 +23,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -32,7 +31,7 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.urlInstrumentation.domainParsers = {
     install() {
-      depHooks.resolve({ name: 'url' }, (url, version) => {
+      depHooks.resolve({ name: 'url', version: '*' }, (url, version) => {
         ['domainToASCII', 'domainToUnicode'].forEach((method) => {
           const name = `url.${method}`;
 
@@ -42,7 +41,7 @@ module.exports = function(core) {
             usePerf: 'sync',
             post(data) {
               const { args, result, hooked, orig } = data;
-              if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
+              if (!result || !args[0] || !getPropagatorContext()) return;
 
               const argInfo = tracker.getData(args[0]);
 

package/lib/dataflow/propagation/install/url/parse.js

@@ -15,7 +15,6 @@
 
 'use strict';
 
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
@@ -23,7 +22,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
@@ -80,7 +79,7 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.urlInstrumentation.parse = {
     install() {
-      depHooks.resolve({ name: 'url' }, (url) => {
+      depHooks.resolve({ name: 'url', version: '*' }, (url) => {
 
         const name = 'url.parse';
 
@@ -90,7 +89,7 @@ module.exports = function(core) {
           usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
-            if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
+            if (!result || !args[0] || !getPropagatorContext()) return;
 
             const [url, parseQueryString] = args;
             const argInfo = tracker.getData(url);

package/lib/dataflow/propagation/install/url/parse.test.js

@@ -35,8 +35,8 @@ describe('assess dataflow propagation url.parse', function () {
     core.assess.dataflow.propagation.querystringInstrumentation.parse.install();
     core.assess.dataflow.propagation.urlInstrumentation.parse.install();
 
-    core.depHooks.resolve.withArgs({ name: 'url' }).yield(url);
-    core.depHooks.resolve.withArgs({ name: 'querystring' }).yield(querystring);
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'url' })).yield(url);
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'querystring' })).yield(querystring);
 
     matchURL = {
       href: 'https://user:pass@foo.com:3000/path?query=input#hash',

package/lib/dataflow/propagation/install/url/searchParams.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { isString, primordials: { StringPrototypeConcat, StringPrototypeReplaceAll } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { createAppendTags } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
@@ -26,7 +25,7 @@ module.exports = function(core) {
     depHooks,
     assess: {
       inspect, // TODO NODE-3455: remove
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -60,7 +59,7 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.urlInstrumentation.searchParams = {
     install() {
-      depHooks.resolve({ name: 'url' }, (url) => {
+      depHooks.resolve({ name: 'url', version: '*' }, (url) => {
         const name = 'url.URLSearchParams';
 
         patcher.patch(url, 'URLSearchParams', {
@@ -69,7 +68,7 @@ module.exports = function(core) {
           usePerf: 'sync',
           post(data) {
             const { args, obj, result } = data;
-            if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
+            if (!result || !args[0] || !getPropagatorContext()) return;
 
             const [params] = args;
 

package/lib/dataflow/propagation/install/url/url.js

@@ -15,7 +15,6 @@
 
 'use strict';
 
-const { InstrumentationType: { PROPAGATOR } } = require('../../../../constants');
 const { patchType } = require('../../common');
 
 const { primordials: { StringPrototypeSplit } } = require('@contrast/common');
@@ -25,7 +24,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       inspect, // TODO NODE-3455: remove
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
@@ -86,7 +85,7 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.urlInstrumentation.url = {
     install() {
-      depHooks.resolve({ name: 'url' }, (url) => {
+      depHooks.resolve({ name: 'url', version: '*' }, (url) => {
         const { URLSearchParams } = url;
         const name = 'url.URL';
         patcher.patch(url, 'URL', {
@@ -95,7 +94,7 @@ module.exports = function(core) {
           usePerf: 'sync',
           post(data) {
             const { args, result } = data;
-            if (!result || !args[0] || !getSourceContext(PROPAGATOR)) return;
+            if (!result || !args[0] || !getPropagatorContext()) return;
 
             const [input, basename] = args;
             let url = input;

package/lib/dataflow/propagation/install/util-format.js

@@ -16,7 +16,6 @@
 'use strict';
 
 const { isString, primordials: { StringPrototypeMatch, StringPrototypeToLowerCase } } = require('@contrast/common');
-const { InstrumentationType: { PROPAGATOR } } = require('../../../constants');
 const { createAppendTags } = require('../../tag-utils');
 const { patchType } = require('../common');
 
@@ -25,7 +24,7 @@ module.exports = function(core) {
     patcher,
     depHooks,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -33,7 +32,7 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.utilFormat = {
     install() {
-      depHooks.resolve({ name: 'util' }, (util) => {
+      depHooks.resolve({ name: 'util', version: '*' }, (util) => {
         const name = 'util.format';
 
         return patcher.patch(util, 'format', {
@@ -42,7 +41,7 @@ module.exports = function(core) {
           usePerf: 'sync',
           post(data) {
             const { args, result, hooked, orig } = data;
-            if (!result || !args[0] || !isString(args[0]) || !getSourceContext(PROPAGATOR)) return;
+            if (!result || !args[0] || !isString(args[0]) || !getPropagatorContext()) return;
 
             let idx = 0;
             let newTags = {};

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -26,7 +26,7 @@ module.exports = function (core) {
     depHooks,
     patcher,
     assess: {
-      getSourceContext,
+      getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
     }
@@ -64,7 +64,7 @@ module.exports = function (core) {
     install() {
       for (const validator in validators) {
         depHooks.resolve(
-          { name: 'validator', file: `lib/${validator}` },
+          { name: 'validator', version: '<14', file: `lib/${validator}` },
           (index) => {
             const name = `validator.${validator}`;
             return patcher.patch(...getPatcherArgs(index), {
@@ -76,7 +76,7 @@ module.exports = function (core) {
                 if (
                   data.result &&
                   (!matches || (matches && core.config.assess.trust_custom_validators)) &&
-                  getSourceContext()
+                  getPropagatorContext()
                 ) {
                   const trackingData = tracker.getData(data.args[0]);
                   if (trackingData) {
@@ -102,13 +102,13 @@ module.exports = function (core) {
 
       untrackers.forEach((untracker) => {
         depHooks.resolve(
-          { name: 'validator', file: `lib/${untracker}` },
+          { name: 'validator', version: '<14', file: `lib/${untracker}` },
           (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${untracker}`,
             patchType,
             usePerf: 'sync',
             post(data) {
-              if (data.result && getSourceContext()) {
+              if (data.result && getPropagatorContext()) {
                 const trackingData = tracker.getData(data.args[0]);
                 if (trackingData) {
                   tracker.untrack(data.args[0]);
@@ -120,12 +120,12 @@ module.exports = function (core) {
 
       for (const sanitizer in sanitizers) {
         depHooks.resolve(
-          { name: 'validator', file: `lib/${sanitizer}` },
+          { name: 'validator', version: '<14', file: `lib/${sanitizer}` },
           (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${sanitizer}`,
             patchType,
             post(data) {
-              if (!getSourceContext()) return;
+              if (!getPropagatorContext()) return;
               const trackingData = tracker.getData(data.args[0]);
               if (trackingData) {
                 const newTags = {};
@@ -153,12 +153,12 @@ module.exports = function (core) {
 
       for (const method in custom) {
         depHooks.resolve(
-          { name: 'validator', file: `lib/${method}` },
+          { name: 'validator', version: '<14', file: `lib/${method}` },
           (index) => patcher.patch(...getPatcherArgs(index), {
             name: `validator.${method}`,
             patchType,
             post(data) {
-              if (!getSourceContext()) return;
+              if (!getPropagatorContext()) return;
 
               const options = data.args[1];
               const trackingData = tracker.getData(data.args[0]);

package/lib/dataflow/sinks/install/child-process.js

@@ -20,7 +20,6 @@ const {
   Rule: { CMD_INJECTION: ruleId },
   isString,
 } = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../constants');
 const { patchType } = require('../common');
 
 /**
@@ -35,7 +34,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       inspect, // TODO NODE-3455: remove
-      getSourceContext,
+      getSinkContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -192,14 +191,14 @@ module.exports = function(core) {
 
   core.assess.dataflow.sinks.cmdInjection = {
     install() {
-      depHooks.resolve({ name: 'child_process' }, (cp) => {
+      depHooks.resolve({ name: 'child_process', version: '*' }, (cp) => {
         ['spawn', 'spawnSync'].forEach((method) => {
           const name = `child_process.${method}`;
           patcher.patch(cp, method, {
             name,
             patchType,
             pre(data) {
-              if (!getSourceContext(RULE, ruleId)) return;
+              if (!getSinkContext(ruleId)) return;
 
               const [command] = data.args;
               if (!command || !isString(command)) return;
@@ -239,7 +238,7 @@ module.exports = function(core) {
             name,
             patchType,
             pre(data) {
-              if (!getSourceContext(RULE, ruleId)) return;
+              if (!getSinkContext(ruleId)) return;
 
               const [command, secondArg, thirdArg] = data.args;
               if (!command || !isString(command)) return;
@@ -263,7 +262,7 @@ module.exports = function(core) {
             name,
             patchType,
             pre(data) {
-              if (!getSourceContext(RULE, ruleId)) return;
+              if (!getSinkContext(ruleId)) return;
 
               const [command] = data.args;
               if (!command || !isString(command)) return;

package/lib/dataflow/sinks/install/eval.js

@@ -27,7 +27,6 @@ const {
   },
   Rule: { UNSAFE_CODE_EXECUTION: ruleId },
 } = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../constants');
 const { patchType, filterSafeTags } = require('../common');
 
 const safeTags = [
@@ -53,7 +52,7 @@ module.exports = function (core) {
     logger,
     patcher,
     assess: {
-      getSourceContext,
+      getSinkContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -73,7 +72,7 @@ module.exports = function (core) {
         name: 'global.ContrastMethods.eval',
         patchType,
         pre({ args, orig }) {
-          if (!getSourceContext(RULE, ruleId)) return;
+          if (!getSinkContext(ruleId)) return;
 
           const script = args[0];
           if (!script || !isString(script)) return;

package/lib/dataflow/sinks/install/express/reflected-xss.js

@@ -31,7 +31,6 @@ const {
   isString
 } = require('@contrast/common');
 const { patchType, filterSafeTags } = require('../../common');
-const { InstrumentationType: { RULE } } = require('../../../../constants');
 
 /**
  * @param {{
@@ -47,7 +46,7 @@ module.exports = function(core) {
     patcher,
     config,
     assess: {
-      getSourceContext,
+      getSinkContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -78,7 +77,7 @@ module.exports = function(core) {
         name,
         patchType,
         around: (next, data) => {
-          const sourceContext = getSourceContext(RULE, ruleId);
+          const sourceContext = getSinkContext(ruleId);
           if (!sourceContext) return next();
 
           const { contentType } = sourceContext.responseData;

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -27,7 +27,6 @@ const {
   },
   isString
 } = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
 const { patchType, filterSafeTags } = require('../../common');
 
@@ -46,7 +45,7 @@ module.exports = function(core) {
     config,
     assess: {
       inspect, // TODO NODE-3455: remove
-      getSourceContext,
+      getSinkContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -73,7 +72,7 @@ module.exports = function(core) {
         name: 'Express.Response.location',
         patchType,
         pre: (data) => {
-          if (!getSourceContext(RULE, ruleId)) return;
+          if (!getSinkContext(ruleId)) return;
 
           let [url] = data.args;
           if (url === 'back') {

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -27,7 +27,6 @@ const {
   },
   isString
 } = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../../constants');
 const { createSubsetTags } = require('../../../tag-utils');
 const { filterSafeTags, patchType } = require('../../common');
 
@@ -65,7 +64,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       inspect, // TODO NODE-3455: remove
-      getSourceContext,
+      getSinkContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -87,12 +86,12 @@ module.exports = function(core) {
 
   unvalidatedRedirect.install = function() {
     const name = 'fastify.Reply.prototype.redirect';
-    depHooks.resolve({ name: 'fastify', file: 'lib/reply' }, (Reply) => {
+    depHooks.resolve({ name: 'fastify', version: '>=3 <5', file: 'lib/reply' }, (Reply) => {
       patcher.patch(Reply.prototype, 'redirect', {
         name,
         patchType,
         post(data) {
-          if (!getSourceContext(RULE, ruleId)) return;
+          if (!getSinkContext(ruleId)) return;
 
           const { url, index: valueIndex } = getURLArgument(data.args);
           if (!url || !isString(url)) return;

package/lib/dataflow/sinks/install/fs.js

@@ -28,7 +28,6 @@ const {
   isString,
   primordials: { ArrayPrototypeJoin },
 } = require('@contrast/common');
-const { InstrumentationType: { RULE } } = require('../../../constants');
 
 module.exports = function(core) {
   const {
@@ -36,7 +35,7 @@ module.exports = function(core) {
     patcher,
     assess: {
       inspect, // TODO NODE-3455: remove
-      getSourceContext,
+      getSinkContext,
       eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
@@ -63,7 +62,7 @@ module.exports = function(core) {
 
   const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
     const { name: methodName, indices } = method;
-    if (!getSourceContext(RULE, ruleId)) return;
+    if (!getSinkContext(ruleId)) return;
 
     const values = getValues(indices, data.args);
     if (!values.length) return;
@@ -116,7 +115,7 @@ module.exports = function(core) {
 
   core.assess.dataflow.sinks.pathTraversal = {
     install() {
-      depHooks.resolve({ name: 'fs' }, (fs) => {
+      depHooks.resolve({ name: 'fs', version: '*' }, (fs) => {
         for (const method of FS_METHODS) {
           // not all methods are available on every OS or Node version.
           if (fs[method.name]) {
@@ -151,7 +150,7 @@ module.exports = function(core) {
         }
       });
 
-      depHooks.resolve({ name: 'fs/promises' }, (fsPromises) => {
+      depHooks.resolve({ name: 'fs/promises', version: '*' }, (fsPromises) => {
         for (const method of FS_METHODS) {
           if (method.promises && fsPromises[method.name]) {
             const name = `fsPromises.${method.name}`;

package/lib/dataflow/sinks/install/fs.test.js

@@ -33,8 +33,8 @@ describe('assess dataflow sinks path-traversal', function () {
     ({ core, simulateRequestScope, trackString } = initAssessFixture());
     reportFindings = sinon.stub(core.assess.dataflow.sinks, 'reportFindings');
 
-    core.depHooks.resolve.withArgs({ name: 'fs' }).yields(fs);
-    core.depHooks.resolve.withArgs({ name: 'fs/promises' }).yields(fsPromises);
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'fs' })).yields(fs);
+    core.depHooks.resolve.withArgs(sinon.match({ name: 'fs/promises' })).yields(fsPromises);
 
     require('./fs')(core).install();
   });