@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/propagation/install/mongoose/schema-map.test.js

@@ -1,348 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const {
-  DataflowTag: { CUSTOM_VALIDATED, UNTRUSTED },
-} = require('@contrast/common');
-const { userDefinedType } = require('./common');
-
-describe('assess dataflow propagation mongoose.MapSchema', function () {
-  let core, trackString, simulateRequestScope, tracker, mockSchemaMap;
-
-  const makeMap = (data) => ({
-    toJSON: () => data,
-  });
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-
-    const MockMapSchema = function () {
-      this.validators = [
-        {
-          type: userDefinedType,
-        },
-      ];
-    };
-
-    MockMapSchema.prototype.doValidate = function (value, validationFunction) {
-      if (!validationFunction) return;
-
-      if (value === 'error') {
-        validationFunction({ error: value });
-      } else {
-        validationFunction();
-      }
-    };
-
-    MockMapSchema.prototype.doValidateSync = function (value) {
-      if (value === 'error') {
-        return { error: value };
-      }
-    };
-
-    mockSchemaMap = new MockMapSchema();
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.mongooseInstrumentation.schemaMap.install();
-    core.depHooks.resolve.yield(MockMapSchema);
-    core.config.assess.trust_custom_validators = true;
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  it('SchemaMap.doValidateSync skip instrumentation if trust_custom_validators is false', function () {
-    simulateRequestScope(function () {
-      core.config.assess.trust_custom_validators = false;
-      const str = trackString('error');
-
-      mockSchemaMap.doValidateSync(str);
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-        result: {
-          tracked: true,
-          value: 'error',
-        },
-        value: 'error',
-      });
-    });
-  });
-
-  it('SchemaMap.doValidateSync skip instrumentation if there is an error', function () {
-    simulateRequestScope(function () {
-      const str = trackString('error');
-
-      mockSchemaMap.doValidateSync(str);
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-        result: {
-          tracked: true,
-          value: 'error',
-        },
-        value: 'error',
-      });
-    });
-  });
-
-  it('SchemaMap.doValidateSync skip instrumentation if there is no assess policy in request scope', function () {
-    simulateRequestScope(function () {
-      const str = trackString('error');
-
-      mockSchemaMap.doValidateSync(str);
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('SchemaMap.doValidateSync skip instrumentation if there is no custom validator', function () {
-    simulateRequestScope(function () {
-      mockSchemaMap.validators = [];
-
-      const str1 = trackString('foo');
-
-      mockSchemaMap.doValidateSync(
-        makeMap({
-          name: str1,
-        })
-      );
-
-      const strInfo = tracker.getData(str1);
-      expect(strInfo).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: {
-          [UNTRUSTED]: [0, 2],
-        },
-        result: {
-          tracked: true,
-          value: 'foo',
-        },
-        value: 'foo',
-      });
-    });
-  });
-
-  it(`SchemaMap.doValidateSync adds ${CUSTOM_VALIDATED} tag - objects and arrays`, function () {
-    simulateRequestScope(function () {
-      const str1 = trackString('foo');
-      const str2 = trackString('foo');
-      const str3 = trackString('foo');
-
-      mockSchemaMap.doValidateSync(
-        makeMap({
-          name: str1,
-          nested: {
-            name: str2,
-            nested: ['foo', str3, str3, str3],
-          },
-        })
-      );
-
-      [str1, str2, str3].forEach((str) => {
-        const strInfo = tracker.getData(str);
-        expect(strInfo).to.deep.include({
-          value: 'foo',
-          addedTags: [CUSTOM_VALIDATED],
-          args: [{ tracked: true, value: 'foo' }],
-          context: undefined,
-          name: 'mongoose.map.prototype.doValidateSync',
-          object: { tracked: false, value: 'mongoose.SchemaMap' },
-          removedTags: [],
-          result: { tracked: false, value: undefined },
-          source: 'P0',
-          stack: [],
-          tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
-          target: 'P0',
-        });
-        expect(strInfo.history[0]).to.deep.include({
-          context: 'UNKNOWN.val',
-          name: 'assess-dataflow-fixture',
-          fieldName: 'val',
-          pathName: 'val',
-          stack: [],
-          inputType: 'UNKNOWN',
-          tags: { [UNTRUSTED]: [0, 2] },
-          result: { tracked: true, value: 'foo' },
-          value: 'foo',
-        });
-      });
-    });
-  });
-
-  it('SchemaMap.doValidate skip instrumentation if trust_custom_validators is false', function () {
-    simulateRequestScope(function () {
-      core.config.assess.trust_custom_validators = false;
-      const str = trackString('error');
-
-      mockSchemaMap.doValidate(str);
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-        result: {
-          tracked: true,
-          value: 'error',
-        },
-        value: 'error',
-      });
-    });
-  });
-
-  it('SchemaMap.doValidate is there is no input', function () {
-    core.assess.eventFactory.createPropagationEvent = sinon.stub();
-
-    simulateRequestScope(function () {
-      mockSchemaMap.doValidate();
-      expect(
-        core.assess.eventFactory.createPropagationEvent
-      ).to.have.been.callCount(0);
-    });
-  });
-
-  it('SchemaMap.doValidate is there is no function as second argument', function () {
-    simulateRequestScope(function () {
-      const str = trackString('foo');
-
-      mockSchemaMap.doValidate(str);
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: {
-          [UNTRUSTED]: [0, 2],
-        },
-        result: {
-          tracked: true,
-          value: 'foo',
-        },
-        value: 'foo',
-      });
-    });
-  });
-
-  it('SchemaMap.doValidate skip instrumentation if there is no assess policy in request scope', function () {
-    simulateRequestScope(function () {
-      const str = trackString('foo');
-
-      mockSchemaMap.doValidate(str, () => { });
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('SchemaMap.doValidate skip instrumentation if there is a validation error', function () {
-    simulateRequestScope(function () {
-      const str = trackString('error');
-
-      mockSchemaMap.doValidate(str, () => 'error');
-
-      const strInfo = tracker.getData(str);
-      expect(strInfo).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-        result: {
-          tracked: true,
-          value: 'error',
-        },
-        value: 'error',
-      });
-    });
-  });
-
-  it(`SchemaMap.doValidate adds ${CUSTOM_VALIDATED} tag - objects and arrays`, function () {
-    simulateRequestScope(function () {
-      const str1 = trackString('foo');
-      const str2 = trackString('foo');
-      const str3 = trackString('foo');
-
-      mockSchemaMap.doValidate(
-        makeMap({
-          name: str1,
-          nested: {
-            name: str2,
-            nested: ['foo', str3, str3, str3],
-          },
-        }),
-        () => undefined
-      );
-
-      [str1, str2, str3].forEach((str) => {
-        const strInfo = tracker.getData(str);
-        expect(strInfo).to.deep.include({
-          value: 'foo',
-          addedTags: [CUSTOM_VALIDATED],
-          args: [{ tracked: true, value: 'foo' }],
-          context: undefined,
-          name: 'mongoose.map.prototype.doValidate',
-          object: { tracked: false, value: 'mongoose.SchemaMap' },
-          removedTags: [],
-          result: { tracked: false, value: undefined },
-          source: 'P0',
-          stack: [],
-          tags: { [UNTRUSTED]: [0, 2], CUSTOM_VALIDATED: [0, 2] },
-          target: 'P0',
-        });
-        expect(strInfo.history[0]).to.deep.include({
-          context: 'UNKNOWN.val',
-          name: 'assess-dataflow-fixture',
-          fieldName: 'val',
-          pathName: 'val',
-          stack: [],
-          inputType: 'UNKNOWN',
-          tags: { [UNTRUSTED]: [0, 2] },
-          result: { tracked: true, value: 'foo' },
-          value: 'foo',
-        });
-      });
-    });
-  });
-});