@contrast/assess 1.44.0 → 1.46.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/lib/crypto-analysis/common.js +1 -1
- package/lib/crypto-analysis/index.js +1 -1
- package/lib/crypto-analysis/install/crypto.js +1 -1
- package/lib/crypto-analysis/install/math.js +1 -1
- package/lib/dataflow/index.js +1 -1
- package/lib/dataflow/propagation/common.js +1 -1
- package/lib/dataflow/propagation/index.js +1 -1
- package/lib/dataflow/propagation/install/JSON/index.js +1 -1
- package/lib/dataflow/propagation/install/JSON/parse-fn.js +1 -1
- package/lib/dataflow/propagation/install/JSON/parse.js +1 -1
- package/lib/dataflow/propagation/install/JSON/stringify.js +1 -1
- package/lib/dataflow/propagation/install/array-prototype-join.js +1 -1
- package/lib/dataflow/propagation/install/buffer.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/add.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/index.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/number.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/string.js +1 -1
- package/lib/dataflow/propagation/install/contrast-methods/tag.js +1 -1
- package/lib/dataflow/propagation/install/decode-uri-component.js +1 -1
- package/lib/dataflow/propagation/install/ejs/escape-xml.js +1 -1
- package/lib/dataflow/propagation/install/ejs/index.js +1 -1
- package/lib/dataflow/propagation/install/ejs/template.js +1 -1
- package/lib/dataflow/propagation/install/encode-uri.js +1 -1
- package/lib/dataflow/propagation/install/escape-html.js +1 -1
- package/lib/dataflow/propagation/install/escape.js +1 -1
- package/lib/dataflow/propagation/install/fastify-send.js +1 -1
- package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js +1 -1
- package/lib/dataflow/propagation/install/isnumeric-0.js +1 -1
- package/lib/dataflow/propagation/install/joi/any.js +1 -1
- package/lib/dataflow/propagation/install/joi/boolean.js +1 -1
- package/lib/dataflow/propagation/install/joi/expression.js +1 -1
- package/lib/dataflow/propagation/install/joi/index.js +1 -1
- package/lib/dataflow/propagation/install/joi/keys.js +1 -1
- package/lib/dataflow/propagation/install/joi/number.js +1 -1
- package/lib/dataflow/propagation/install/joi/object.js +1 -1
- package/lib/dataflow/propagation/install/joi/string-schema.js +1 -1
- package/lib/dataflow/propagation/install/joi/utils.js +1 -1
- package/lib/dataflow/propagation/install/joi/values.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/common.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/index.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-map.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-mixed.js +1 -1
- package/lib/dataflow/propagation/install/mongoose/schema-string.js +1 -1
- package/lib/dataflow/propagation/install/mustache-escape.js +1 -1
- package/lib/dataflow/propagation/install/mysql-connection-escape.js +1 -1
- package/lib/dataflow/propagation/install/parse-int.js +1 -1
- package/lib/dataflow/propagation/install/path/basename.js +1 -1
- package/lib/dataflow/propagation/install/path/common.js +1 -1
- package/lib/dataflow/propagation/install/path/dirname.js +1 -1
- package/lib/dataflow/propagation/install/path/extname.js +1 -1
- package/lib/dataflow/propagation/install/path/format.js +1 -1
- package/lib/dataflow/propagation/install/path/index.js +1 -1
- package/lib/dataflow/propagation/install/path/join-and-resolve.js +1 -1
- package/lib/dataflow/propagation/install/path/normalize.js +1 -1
- package/lib/dataflow/propagation/install/path/parse.js +1 -1
- package/lib/dataflow/propagation/install/path/relative.js +1 -1
- package/lib/dataflow/propagation/install/path/toNamespacedPath.js +1 -1
- package/lib/dataflow/propagation/install/pug/index.js +1 -1
- package/lib/dataflow/propagation/install/pug-runtime-escape.js +1 -1
- package/lib/dataflow/propagation/install/querystring/escape.js +1 -1
- package/lib/dataflow/propagation/install/querystring/index.js +1 -1
- package/lib/dataflow/propagation/install/querystring/parse.js +1 -1
- package/lib/dataflow/propagation/install/querystring/stringify.js +1 -1
- package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js +1 -1
- package/lib/dataflow/propagation/install/send.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/index.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/query-generator.js +1 -1
- package/lib/dataflow/propagation/install/sequelize/sql-string.js +1 -1
- package/lib/dataflow/propagation/install/sql-template-strings.js +1 -1
- package/lib/dataflow/propagation/install/string/concat.js +1 -1
- package/lib/dataflow/propagation/install/string/format-methods.js +1 -1
- package/lib/dataflow/propagation/install/string/html-methods.js +1 -1
- package/lib/dataflow/propagation/install/string/index.js +1 -1
- package/lib/dataflow/propagation/install/string/match-all.js +1 -1
- package/lib/dataflow/propagation/install/string/match.js +1 -1
- package/lib/dataflow/propagation/install/string/replace.js +1 -1
- package/lib/dataflow/propagation/install/string/slice.js +1 -1
- package/lib/dataflow/propagation/install/string/split.js +1 -1
- package/lib/dataflow/propagation/install/string/substring.js +1 -1
- package/lib/dataflow/propagation/install/string/trim.js +1 -1
- package/lib/dataflow/propagation/install/unescape.js +1 -1
- package/lib/dataflow/propagation/install/url/domain-parsers.js +1 -1
- package/lib/dataflow/propagation/install/url/index.js +1 -1
- package/lib/dataflow/propagation/install/url/parse.js +1 -1
- package/lib/dataflow/propagation/install/url/searchParams.js +1 -1
- package/lib/dataflow/propagation/install/url/url.js +1 -1
- package/lib/dataflow/propagation/install/util-format.js +1 -1
- package/lib/dataflow/propagation/install/validator/hooks.js +1 -1
- package/lib/dataflow/propagation/install/validator/index.js +1 -1
- package/lib/dataflow/propagation/install/validator/methods.js +1 -1
- package/lib/dataflow/sinks/common.js +1 -1
- package/lib/dataflow/sinks/index.js +1 -1
- package/lib/dataflow/sinks/install/child-process.js +1 -1
- package/lib/dataflow/sinks/install/eval.js +1 -1
- package/lib/dataflow/sinks/install/express/index.js +1 -1
- package/lib/dataflow/sinks/install/express/reflected-xss.js +1 -1
- package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/fastify/index.js +1 -1
- package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/fs.js +1 -1
- package/lib/dataflow/sinks/install/function.js +1 -1
- package/lib/dataflow/sinks/install/hapi/index.js +1 -1
- package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/http/index.js +1 -1
- package/lib/dataflow/sinks/install/http/request.js +1 -1
- package/lib/dataflow/sinks/install/http/server-response.js +1 -1
- package/lib/dataflow/sinks/install/koa/index.js +1 -1
- package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/libxmljs.js +1 -1
- package/lib/dataflow/sinks/install/marsdb.js +1 -1
- package/lib/dataflow/sinks/install/mongodb.js +1 -1
- package/lib/dataflow/sinks/install/mssql.js +1 -1
- package/lib/dataflow/sinks/install/mysql.js +1 -1
- package/lib/dataflow/sinks/install/node-serialize.js +1 -1
- package/lib/dataflow/sinks/install/postgres.js +1 -1
- package/lib/dataflow/sinks/install/restify.js +1 -1
- package/lib/dataflow/sinks/install/sequelize.js +1 -1
- package/lib/dataflow/sinks/install/sqlite3.js +1 -1
- package/lib/dataflow/sinks/install/vm.js +1 -1
- package/lib/dataflow/sources/common.js +1 -1
- package/lib/dataflow/sources/handler.js +1 -1
- package/lib/dataflow/sources/index.js +2 -1
- package/lib/dataflow/sources/index.test.js +2 -0
- package/lib/dataflow/sources/install/body-parser1.js +1 -1
- package/lib/dataflow/sources/install/busboy.js +1 -1
- package/lib/dataflow/sources/install/cookie-parser1.js +1 -1
- package/lib/dataflow/sources/install/express/index.js +1 -1
- package/lib/dataflow/sources/install/express/params.js +1 -1
- package/lib/dataflow/sources/install/express/parsedUrl.js +1 -1
- package/lib/dataflow/sources/install/fastify/fastify.js +1 -1
- package/lib/dataflow/sources/install/fastify/index.js +1 -1
- package/lib/dataflow/sources/install/formidable1.js +1 -1
- package/lib/dataflow/sources/install/graphql-http.js +118 -0
- package/lib/dataflow/sources/install/graphql-http.test.js +133 -0
- package/lib/dataflow/sources/install/hapi/hapi.js +1 -1
- package/lib/dataflow/sources/install/hapi/index.js +1 -1
- package/lib/dataflow/sources/install/http.js +1 -1
- package/lib/dataflow/sources/install/koa/index.js +1 -1
- package/lib/dataflow/sources/install/koa/koa-bodyparsers.js +1 -1
- package/lib/dataflow/sources/install/koa/koa-multer.js +1 -1
- package/lib/dataflow/sources/install/koa/koa-routers.js +1 -1
- package/lib/dataflow/sources/install/koa/koa2.js +1 -1
- package/lib/dataflow/sources/install/multer1.js +1 -1
- package/lib/dataflow/sources/install/qs6.js +1 -1
- package/lib/dataflow/sources/install/querystring.js +1 -1
- package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.js +1 -1
- package/lib/dataflow/sources/install/restify/index.js +1 -1
- package/lib/dataflow/sources/install/restify/jsonBodyParser.js +1 -1
- package/lib/dataflow/sources/install/restify/router.js +1 -1
- package/lib/dataflow/tag-utils.js +1 -1
- package/lib/dataflow/tracker.js +1 -1
- package/lib/dataflow/utils/is-safe-content-type.js +1 -1
- package/lib/dataflow/utils/is-vulnerable.js +1 -1
- package/lib/event-factory.js +1 -1
- package/lib/get-policy.js +1 -1
- package/lib/get-source-context.js +1 -1
- package/lib/index.d.ts +1 -1
- package/lib/index.js +1 -1
- package/lib/make-source-context.js +1 -1
- package/lib/response-scanning/handlers/index.js +1 -1
- package/lib/response-scanning/handlers/utils.js +1 -1
- package/lib/response-scanning/index.js +1 -1
- package/lib/response-scanning/install/http.js +1 -1
- package/lib/rule-scopes.js +1 -1
- package/lib/sampler/common.js +1 -1
- package/lib/sampler/index.js +1 -1
- package/lib/session-configuration/common.js +1 -1
- package/lib/session-configuration/handlers.js +1 -1
- package/lib/session-configuration/index.js +1 -1
- package/lib/session-configuration/install/express-session.js +1 -1
- package/lib/session-configuration/install/fastify-cookie.js +1 -1
- package/lib/session-configuration/install/hapi.js +1 -1
- package/lib/session-configuration/install/koa.js +1 -1
- package/package.json +11 -11
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/*
|
|
2
|
-
* Copyright:
|
|
2
|
+
* Copyright: 2025 Contrast Security, Inc
|
|
3
3
|
* Contact: support@contrastsecurity.com
|
|
4
4
|
* License: Commercial
|
|
5
5
|
|
|
@@ -31,6 +31,7 @@ module.exports = function (core) {
|
|
|
31
31
|
require('./install/busboy')(core);
|
|
32
32
|
require('./install/cookie-parser1')(core);
|
|
33
33
|
require('./install/formidable1')(core);
|
|
34
|
+
require('./install/graphql-http')(core);
|
|
34
35
|
require('./install/http')(core);
|
|
35
36
|
require('./install/qs6')(core);
|
|
36
37
|
require('./install/querystring')(core);
|
|
@@ -28,6 +28,7 @@ describe('assess dataflow sources', function () {
|
|
|
28
28
|
'./install/busboy': moduleMock('busboyInstrumentation', sourcesMock),
|
|
29
29
|
'./install/multer1': moduleMock('multer1Instrumentation', sourcesMock),
|
|
30
30
|
'./install/formidable1': moduleMock('formidable1Instrumentation', sourcesMock),
|
|
31
|
+
'./install/graphql-http': moduleMock('graphqlHttpInstrumentation', sourcesMock),
|
|
31
32
|
'./install/qs6': moduleMock('qs6Instrumentation', sourcesMock),
|
|
32
33
|
'./install/querystring': moduleMock('querystringInstrumentation', sourcesMock),
|
|
33
34
|
});
|
|
@@ -43,6 +44,7 @@ describe('assess dataflow sources', function () {
|
|
|
43
44
|
'multer1Instrumentation',
|
|
44
45
|
'cookieParser1Instrumentation',
|
|
45
46
|
'formidable1Instrumentation',
|
|
47
|
+
'graphqlHttpInstrumentation',
|
|
46
48
|
'qs6Instrumentation',
|
|
47
49
|
'querystringInstrumentation',
|
|
48
50
|
];
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
/*
|
|
2
|
+
* Copyright: 2025 Contrast Security, Inc
|
|
3
|
+
* Contact: support@contrastsecurity.com
|
|
4
|
+
* License: Commercial
|
|
5
|
+
|
|
6
|
+
* NOTICE: This Software and the patented inventions embodied within may only be
|
|
7
|
+
* used as part of Contrast Security’s commercial offerings. Even though it is
|
|
8
|
+
* made available through public repositories, use of this Software is subject to
|
|
9
|
+
* the applicable End User Licensing Agreement found at
|
|
10
|
+
* https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
|
|
11
|
+
* between Contrast Security and the End User. The Software may not be reverse
|
|
12
|
+
* engineered, modified, repackaged, sold, redistributed or otherwise used in a
|
|
13
|
+
* way not consistent with the End User License Agreement.
|
|
14
|
+
*/
|
|
15
|
+
|
|
16
|
+
'use strict';
|
|
17
|
+
|
|
18
|
+
const { InputType } = require('@contrast/common');
|
|
19
|
+
const { patchType } = require('../common');
|
|
20
|
+
|
|
21
|
+
/**
|
|
22
|
+
* @param {{
|
|
23
|
+
* assess: import('@contrast/assess').Assess;
|
|
24
|
+
* depHooks: import('@contrast/dep-hooks').DepHooks;
|
|
25
|
+
* logger: import('@contrast/logger').Logger;
|
|
26
|
+
* patcher: import('@contrast/patcher').Patcher;
|
|
27
|
+
* }} core
|
|
28
|
+
*/
|
|
29
|
+
module.exports = function init(core) {
|
|
30
|
+
const {
|
|
31
|
+
assess: { dataflow, getSourceContext },
|
|
32
|
+
depHooks,
|
|
33
|
+
logger,
|
|
34
|
+
patcher,
|
|
35
|
+
} = core;
|
|
36
|
+
|
|
37
|
+
return core.assess.dataflow.sources.graphqlHttpInstrumentation = {
|
|
38
|
+
install() {
|
|
39
|
+
const parseRequestParamsOpts = {
|
|
40
|
+
name: 'graphql-http.parseRequestParams',
|
|
41
|
+
patchType,
|
|
42
|
+
post(data) {
|
|
43
|
+
if (!data.result) return;
|
|
44
|
+
|
|
45
|
+
const sourceContext = getSourceContext();
|
|
46
|
+
if (!sourceContext) return;
|
|
47
|
+
if (sourceContext.parsedBody) {
|
|
48
|
+
logger.trace({ funcKey: data.funcKey }, 'values already tracked');
|
|
49
|
+
return;
|
|
50
|
+
}
|
|
51
|
+
|
|
52
|
+
data.result = data.result.then((result) => {
|
|
53
|
+
if (!result) return;
|
|
54
|
+
|
|
55
|
+
let inputType, context;
|
|
56
|
+
if (data.args[0].method === 'GET') {
|
|
57
|
+
inputType = InputType.PARAMETER_VALUE;
|
|
58
|
+
context = 'req.url';
|
|
59
|
+
} else {
|
|
60
|
+
inputType = InputType.JSON_VALUE;
|
|
61
|
+
context = 'req.body';
|
|
62
|
+
}
|
|
63
|
+
|
|
64
|
+
try {
|
|
65
|
+
dataflow.sources.handle({
|
|
66
|
+
name: data.name,
|
|
67
|
+
context,
|
|
68
|
+
inputType,
|
|
69
|
+
data: result,
|
|
70
|
+
keys: Object.keys(result),
|
|
71
|
+
sourceContext,
|
|
72
|
+
stacktraceOpts: {
|
|
73
|
+
constructorOpt: data.hooked,
|
|
74
|
+
prependFrames: [data.orig],
|
|
75
|
+
}
|
|
76
|
+
});
|
|
77
|
+
} catch (err) {
|
|
78
|
+
logger.error({ err, funcKey: data.funcKey }, 'unable to handle source');
|
|
79
|
+
}
|
|
80
|
+
|
|
81
|
+
sourceContext.parsedBody = true;
|
|
82
|
+
|
|
83
|
+
return result;
|
|
84
|
+
});
|
|
85
|
+
},
|
|
86
|
+
};
|
|
87
|
+
|
|
88
|
+
depHooks.resolve(
|
|
89
|
+
{ name: 'graphql-http', version: '>=1 <2', file: 'lib/handler' },
|
|
90
|
+
(_exports) => {
|
|
91
|
+
patcher.patch(_exports, 'parseRequestParams', parseRequestParamsOpts);
|
|
92
|
+
|
|
93
|
+
patcher.patch(_exports, 'createHandler', {
|
|
94
|
+
name: 'graphql-http.createHandler',
|
|
95
|
+
patchType,
|
|
96
|
+
pre(data) {
|
|
97
|
+
if (!data.args[0]) return;
|
|
98
|
+
const { parseRequestParams } = data.args[0];
|
|
99
|
+
|
|
100
|
+
// if a `parseRequestParams` option is provided, we want to patch
|
|
101
|
+
// it. if not, the patch above doesn't replace the local variable
|
|
102
|
+
// default parameter so we force the option to be provided as an
|
|
103
|
+
// argument.
|
|
104
|
+
if (parseRequestParams) {
|
|
105
|
+
patcher.unpatch(_exports.parseRequestParams, 'graphql-http.parseRequestParams', patchType);
|
|
106
|
+
data.args[0].parseRequestParams = patcher.patch(parseRequestParams, parseRequestParamsOpts);
|
|
107
|
+
} else {
|
|
108
|
+
data.args[0].parseRequestParams = _exports.parseRequestParams;
|
|
109
|
+
}
|
|
110
|
+
},
|
|
111
|
+
});
|
|
112
|
+
|
|
113
|
+
return _exports;
|
|
114
|
+
},
|
|
115
|
+
);
|
|
116
|
+
},
|
|
117
|
+
};
|
|
118
|
+
};
|