@contrast/assess 1.46.0 → 1.46.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/package.json +14 -11
  2. package/lib/crypto-analysis/install/crypto.test.js +0 -146
  3. package/lib/crypto-analysis/install/math.test.js +0 -65
  4. package/lib/dataflow/index.test.js +0 -36
  5. package/lib/dataflow/propagation/index.test.js +0 -103
  6. package/lib/dataflow/propagation/install/JSON/index.test.js +0 -50
  7. package/lib/dataflow/propagation/install/JSON/parse-fn.test.js +0 -232
  8. package/lib/dataflow/propagation/install/JSON/parse.test.js +0 -968
  9. package/lib/dataflow/propagation/install/JSON/stringify.test.js +0 -265
  10. package/lib/dataflow/propagation/install/array-prototype-join.test.js +0 -106
  11. package/lib/dataflow/propagation/install/buffer.test.js +0 -112
  12. package/lib/dataflow/propagation/install/contrast-methods/add.test.js +0 -94
  13. package/lib/dataflow/propagation/install/contrast-methods/index.test.js +0 -49
  14. package/lib/dataflow/propagation/install/contrast-methods/number.test.js +0 -50
  15. package/lib/dataflow/propagation/install/contrast-methods/string.test.js +0 -148
  16. package/lib/dataflow/propagation/install/contrast-methods/tag.test.js +0 -145
  17. package/lib/dataflow/propagation/install/decode-uri-component.test.js +0 -78
  18. package/lib/dataflow/propagation/install/ejs/escape-xml.test.js +0 -69
  19. package/lib/dataflow/propagation/install/ejs/template.test.js +0 -62
  20. package/lib/dataflow/propagation/install/encode-uri.test.js +0 -83
  21. package/lib/dataflow/propagation/install/escape-html.test.js +0 -71
  22. package/lib/dataflow/propagation/install/escape.test.js +0 -73
  23. package/lib/dataflow/propagation/install/fastify-send.test.js +0 -42
  24. package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.test.js +0 -71
  25. package/lib/dataflow/propagation/install/isnumeric-0.test.js +0 -58
  26. package/lib/dataflow/propagation/install/joi/any.test.js +0 -270
  27. package/lib/dataflow/propagation/install/joi/array.test.js +0 -912
  28. package/lib/dataflow/propagation/install/joi/boolean.test.js +0 -103
  29. package/lib/dataflow/propagation/install/joi/expression.test.js +0 -76
  30. package/lib/dataflow/propagation/install/joi/index.test.js +0 -39
  31. package/lib/dataflow/propagation/install/joi/number.test.js +0 -103
  32. package/lib/dataflow/propagation/install/joi/object.test.js +0 -119
  33. package/lib/dataflow/propagation/install/joi/ref.test.js +0 -607
  34. package/lib/dataflow/propagation/install/joi/string-schema.test.js +0 -513
  35. package/lib/dataflow/propagation/install/mongoose/index.test.js +0 -42
  36. package/lib/dataflow/propagation/install/mongoose/schema-map.test.js +0 -348
  37. package/lib/dataflow/propagation/install/mongoose/schema-mixed.test.js +0 -511
  38. package/lib/dataflow/propagation/install/mongoose/schema-string.test.js +0 -199
  39. package/lib/dataflow/propagation/install/mustache-escape.test.js +0 -62
  40. package/lib/dataflow/propagation/install/mysql-connection-escape.test.js +0 -74
  41. package/lib/dataflow/propagation/install/parse-int.test.js +0 -48
  42. package/lib/dataflow/propagation/install/path/basename.test.js +0 -143
  43. package/lib/dataflow/propagation/install/path/dirname.test.js +0 -167
  44. package/lib/dataflow/propagation/install/path/extname.test.js +0 -141
  45. package/lib/dataflow/propagation/install/path/format.test.js +0 -250
  46. package/lib/dataflow/propagation/install/path/index.test.js +0 -45
  47. package/lib/dataflow/propagation/install/path/join-and-resolve.test.js +0 -485
  48. package/lib/dataflow/propagation/install/path/normalize.test.js +0 -176
  49. package/lib/dataflow/propagation/install/path/parse.test.js +0 -238
  50. package/lib/dataflow/propagation/install/path/relative.test.js +0 -239
  51. package/lib/dataflow/propagation/install/path/toNamespacedPath.test.js +0 -158
  52. package/lib/dataflow/propagation/install/pug/index.test.js +0 -55
  53. package/lib/dataflow/propagation/install/pug-runtime-escape.test.js +0 -69
  54. package/lib/dataflow/propagation/install/querystring/escape.test.js +0 -63
  55. package/lib/dataflow/propagation/install/querystring/index.test.js +0 -40
  56. package/lib/dataflow/propagation/install/querystring/parse.test.js +0 -272
  57. package/lib/dataflow/propagation/install/querystring/stringify.test.js +0 -301
  58. package/lib/dataflow/propagation/install/reg-exp-prototype-exec.test.js +0 -283
  59. package/lib/dataflow/propagation/install/send.test.js +0 -63
  60. package/lib/dataflow/propagation/install/sequelize/query-generator.test.js +0 -74
  61. package/lib/dataflow/propagation/install/sequelize/sql-string.test.js +0 -119
  62. package/lib/dataflow/propagation/install/sql-template-strings.test.js +0 -100
  63. package/lib/dataflow/propagation/install/string/concat.test.js +0 -145
  64. package/lib/dataflow/propagation/install/string/format-methods.test.js +0 -74
  65. package/lib/dataflow/propagation/install/string/html-methods.test.js +0 -177
  66. package/lib/dataflow/propagation/install/string/index.test.js +0 -103
  67. package/lib/dataflow/propagation/install/string/match-all.test.js +0 -412
  68. package/lib/dataflow/propagation/install/string/match.test.js +0 -374
  69. package/lib/dataflow/propagation/install/string/replace.test.js +0 -601
  70. package/lib/dataflow/propagation/install/string/slice.test.js +0 -278
  71. package/lib/dataflow/propagation/install/string/split.test.js +0 -513
  72. package/lib/dataflow/propagation/install/string/substring.test.js +0 -251
  73. package/lib/dataflow/propagation/install/string/trim.test.js +0 -135
  74. package/lib/dataflow/propagation/install/unescape.test.js +0 -78
  75. package/lib/dataflow/propagation/install/url/domain-parsers.test.js +0 -63
  76. package/lib/dataflow/propagation/install/url/parse.test.js +0 -391
  77. package/lib/dataflow/propagation/install/url/searchParams.test.js +0 -538
  78. package/lib/dataflow/propagation/install/url/url.test.js +0 -466
  79. package/lib/dataflow/propagation/install/util-format.test.js +0 -336
  80. package/lib/dataflow/propagation/install/validator/hooks.test.js +0 -211
  81. package/lib/dataflow/sinks/index.test.js +0 -78
  82. package/lib/dataflow/sinks/install/child-process.test.js +0 -338
  83. package/lib/dataflow/sinks/install/eval.test.js +0 -95
  84. package/lib/dataflow/sinks/install/express/index.test.js +0 -33
  85. package/lib/dataflow/sinks/install/express/reflected-xss.test.js +0 -109
  86. package/lib/dataflow/sinks/install/express/unvalidated-redirect.test.js +0 -144
  87. package/lib/dataflow/sinks/install/fastify/index.test.js +0 -32
  88. package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.test.js +0 -130
  89. package/lib/dataflow/sinks/install/fs.test.js +0 -138
  90. package/lib/dataflow/sinks/install/function.test.js +0 -103
  91. package/lib/dataflow/sinks/install/hapi/index.test.js +0 -32
  92. package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.test.js +0 -130
  93. package/lib/dataflow/sinks/install/http/index.test.js +0 -33
  94. package/lib/dataflow/sinks/install/http/request.test.js +0 -184
  95. package/lib/dataflow/sinks/install/http/server-response.test.js +0 -160
  96. package/lib/dataflow/sinks/install/koa/index.test.js +0 -32
  97. package/lib/dataflow/sinks/install/koa/unvalidated-redirect.test.js +0 -200
  98. package/lib/dataflow/sinks/install/libxmljs.test.js +0 -158
  99. package/lib/dataflow/sinks/install/marsdb.test.js +0 -166
  100. package/lib/dataflow/sinks/install/mongodb.test.js +0 -617
  101. package/lib/dataflow/sinks/install/mssql.test.js +0 -134
  102. package/lib/dataflow/sinks/install/mysql.test.js +0 -224
  103. package/lib/dataflow/sinks/install/node-serialize.test.js +0 -83
  104. package/lib/dataflow/sinks/install/postgres.test.js +0 -152
  105. package/lib/dataflow/sinks/install/restify.test.js +0 -140
  106. package/lib/dataflow/sinks/install/sequelize.test.js +0 -100
  107. package/lib/dataflow/sinks/install/sqlite3.test.js +0 -118
  108. package/lib/dataflow/sinks/install/vm.test.js +0 -326
  109. package/lib/dataflow/sources/handler.test.js +0 -501
  110. package/lib/dataflow/sources/index.test.js +0 -60
  111. package/lib/dataflow/sources/install/body-parser1.test.js +0 -244
  112. package/lib/dataflow/sources/install/busboy.test.js +0 -152
  113. package/lib/dataflow/sources/install/cookie-parser1.test.js +0 -141
  114. package/lib/dataflow/sources/install/express/params.test.js +0 -110
  115. package/lib/dataflow/sources/install/express/parsedUrl.test.js +0 -107
  116. package/lib/dataflow/sources/install/fastify/fastify.test.js +0 -207
  117. package/lib/dataflow/sources/install/fastify/index.test.js +0 -33
  118. package/lib/dataflow/sources/install/formidable1.test.js +0 -119
  119. package/lib/dataflow/sources/install/graphql-http.test.js +0 -133
  120. package/lib/dataflow/sources/install/hapi/hapi.test.js +0 -171
  121. package/lib/dataflow/sources/install/hapi/index.test.js +0 -33
  122. package/lib/dataflow/sources/install/http.test.js +0 -149
  123. package/lib/dataflow/sources/install/koa/index.test.js +0 -40
  124. package/lib/dataflow/sources/install/koa/koa-bodyparsers.test.js +0 -160
  125. package/lib/dataflow/sources/install/koa/koa-multer.test.js +0 -197
  126. package/lib/dataflow/sources/install/koa/koa-routers.test.js +0 -146
  127. package/lib/dataflow/sources/install/koa/koa2.test.js +0 -145
  128. package/lib/dataflow/sources/install/multer1.test.js +0 -143
  129. package/lib/dataflow/sources/install/qs6.test.js +0 -131
  130. package/lib/dataflow/sources/install/querystring.test.js +0 -82
  131. package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.test.js +0 -86
  132. package/lib/dataflow/sources/install/restify/index.test.js +0 -38
  133. package/lib/dataflow/sources/install/restify/jsonBodyParser.test.js +0 -140
  134. package/lib/dataflow/sources/install/restify/router.test.js +0 -81
  135. package/lib/dataflow/tag-utils-complete.test.js +0 -27
  136. package/lib/dataflow/tag-utils.test.js +0 -192
  137. package/lib/dataflow/tracker.test.js +0 -216
  138. package/lib/dataflow/utils/is-safe-content-type.test.js +0 -16
  139. package/lib/dataflow/utils/is-vulnerable.test.js +0 -115
  140. package/lib/event-factory.test.js +0 -326
  141. package/lib/get-policy.test.js +0 -194
  142. package/lib/get-source-context.test.js +0 -161
  143. package/lib/index.test.js +0 -45
  144. package/lib/make-source-context.test.js +0 -50
  145. package/lib/response-scanning/handlers/index.test.js +0 -419
  146. package/lib/response-scanning/handlers/utils.test.js +0 -380
  147. package/lib/response-scanning/index.test.js +0 -41
  148. package/lib/response-scanning/install/http.test.js +0 -175
  149. package/lib/rule-scopes.test.js +0 -27
  150. package/lib/sampler/common.test.js +0 -101
  151. package/lib/sampler/index.test.js +0 -313
  152. package/lib/session-configuration/handlers.test.js +0 -84
  153. package/lib/session-configuration/index.test.js +0 -36
  154. package/lib/session-configuration/install/express-session.test.js +0 -218
  155. package/lib/session-configuration/install/fastify-cookie.test.js +0 -63
  156. package/lib/session-configuration/install/hapi.test.js +0 -269
  157. package/lib/session-configuration/install/koa.test.js +0 -92
@@ -1,250 +0,0 @@
1
- 'use strict';
2
-
3
- const sinon = require('sinon');
4
- const { expect } = require('chai');
5
- const { initAssessFixture } = require('@contrast/test/fixtures');
6
- const { DataflowTag: { UNTRUSTED } } = require('@contrast/common');
7
-
8
- describe('assess dataflow propagation path format', function () {
9
- let core, tracker, createPropagationEvent, trackString, simulateRequestScope;
10
-
11
- beforeEach(function () {
12
- ({ core, simulateRequestScope, trackString } = initAssessFixture());
13
- tracker = core.assess.dataflow.tracker;
14
- createPropagationEvent = sinon.spy(
15
- core.assess.eventFactory,
16
- 'createPropagationEvent'
17
- );
18
- core.assess.dataflow.propagation.stringInstrumentation.concat.install();
19
- });
20
-
21
- ['posix', 'win32'].forEach((os) => {
22
- describe(os, function () {
23
- let path;
24
-
25
- beforeEach(function () {
26
- path = require('path')[os];
27
-
28
- core.depHooks.resolve.yields(path);
29
- const formatInstr = require('./format')(core);
30
- formatInstr.install();
31
- });
32
-
33
- it('should ignore empty object', function () {
34
- simulateRequestScope(function () {
35
- const result = path.format({});
36
- const strInfo = tracker.getData(result);
37
-
38
- expect(strInfo).to.be.null;
39
- });
40
- });
41
-
42
- it('will not propagate if there is no assess policy in request context', function () {
43
- simulateRequestScope(function () {
44
- const dir = trackString('/path/to');
45
-
46
- const result = path.format({
47
- dir,
48
- base: 'file.txt'
49
- });
50
-
51
- expect(tracker.getData(result)).to.be.null;
52
- }, { assess: { policy: null } });
53
- });
54
-
55
- it('will not propagate if there instrumentation is locked', function () {
56
- simulateRequestScope(function () {
57
- core.scopes.instrumentation.run({ lock: true }, function () {
58
- const dir = trackString('/path/to');
59
-
60
- const result = path.format({
61
- dir,
62
- base: 'file.txt'
63
- });
64
-
65
- expect(tracker.getData(result)).to.be.null;
66
- });
67
- });
68
- });
69
-
70
- it('will not propagate if the argument is not tracked', function () {
71
- simulateRequestScope(function () {
72
- const dir = '/path/to';
73
-
74
- path.format({
75
- dir,
76
- base: 'file.txt'
77
- });
78
-
79
- expect(createPropagationEvent).to.not.have.been.called;
80
- });
81
- });
82
-
83
- it('will not propagate if there no event created', function () {
84
- simulateRequestScope(function () {
85
- core.config.assess.max_propagation_events = 0;
86
- const dir = trackString('/path/to');
87
-
88
- const result = path.format({
89
- dir,
90
- base: 'file.txt'
91
- });
92
-
93
- expect(tracker.getData(result)).to.be.null;
94
- });
95
- });
96
-
97
- it('should not propagate if tracked string is not in result', function() {
98
- simulateRequestScope(function () {
99
- const root = trackString('/root');
100
-
101
- const result = path.format({
102
- root,
103
- dir: '/path/to',
104
- base: 'file.txt'
105
- });
106
- expect(tracker.getData(result)).to.be.null;
107
- });
108
- });
109
-
110
- it('should propagate tracked root', function() {
111
- simulateRequestScope(function () {
112
- const root = trackString('/root');
113
-
114
- const result = path.format({
115
- root,
116
- base: '/file.txt'
117
- });
118
- const strInfo = tracker.getData(result);
119
- expect(result).to.be.equal('/root/file.txt');
120
- if (os === 'win32') {
121
- expect(strInfo.tags).to.deep.equal({
122
- [UNTRUSTED]: [1, 4],
123
- });
124
- } else {
125
- expect(strInfo.tags).to.deep.equal({
126
- [UNTRUSTED]: [0, 4],
127
- });
128
- }
129
- });
130
- });
131
-
132
- it('should propagate tracked dir', function() {
133
- simulateRequestScope(function () {
134
- const dir = trackString('/path/to');
135
-
136
- const result = path.format({
137
- dir,
138
- base: 'file.txt'
139
- });
140
- const strInfo = tracker.getData(result);
141
- if (os === 'win32') {
142
- expect(strInfo.tags).to.deep.equal({
143
- [UNTRUSTED]: [1, 4, 6, 7],
144
- });
145
- } else {
146
- expect(strInfo.tags).to.deep.equal({
147
- [UNTRUSTED]: [0, 7],
148
- });
149
- }
150
- });
151
- });
152
-
153
- it('should propagate tracked base', function() {
154
- simulateRequestScope(function () {
155
- const base = trackString('file.txt');
156
-
157
- const result = path.format({
158
- dir: '/path/to',
159
- base
160
- });
161
- const strInfo = tracker.getData(result);
162
- expect(strInfo.tags).to.deep.equal({
163
- [UNTRUSTED]: [9, 12, 14, 16]
164
- });
165
- });
166
- });
167
-
168
- it('should propagate tracked name', function() {
169
- simulateRequestScope(function () {
170
- const name = trackString('file');
171
-
172
- const result = path.format({
173
- dir: '/path/to',
174
- name,
175
- ext: '.txt'
176
- });
177
- const strInfo = tracker.getData(result);
178
- expect(strInfo.tags).to.deep.equal({
179
- [UNTRUSTED]: [9, 12]
180
- });
181
- });
182
- });
183
-
184
- it('should propagate tracked ext', function() {
185
- simulateRequestScope(function () {
186
- const ext = trackString('.txt');
187
-
188
- const result = path.format({
189
- dir: '/path/to',
190
- name: 'file',
191
- ext
192
- });
193
- const strInfo = tracker.getData(result);
194
- expect(strInfo.tags).to.deep.equal({
195
- [UNTRUSTED]: [14, 16]
196
- });
197
- });
198
- });
199
-
200
- it('should propagate multiple tracked properties', function() {
201
- simulateRequestScope(function () {
202
- const name = trackString('file');
203
- const ext = trackString('.txt');
204
-
205
- const result = path.format({
206
- dir: '/path/to',
207
- name,
208
- ext
209
- });
210
- const strInfo = tracker.getData(result);
211
- expect(strInfo.tags).to.deep.equal({
212
- [UNTRUSTED]: [9, 12, 14, 16]
213
- });
214
- });
215
- });
216
-
217
- it('should propagate multiple tag ranges', function() {
218
- simulateRequestScope(function () {
219
- const dir = trackString('/path/to', {
220
- tags: {
221
- UNTRUSTED: [1, 4, 6, 7]
222
- }
223
- });
224
- const name = trackString('file', {
225
- tags: {
226
- 'FOO': [0, 3]
227
- }
228
- });
229
- const ext = trackString('.txt', {
230
- tags: {
231
- 'BAR': [1, 3]
232
- }
233
- });
234
-
235
- const result = path.format({
236
- dir,
237
- name,
238
- ext
239
- });
240
- const strInfo = tracker.getData(result);
241
- expect(strInfo.tags).to.deep.equal({
242
- [UNTRUSTED]: [1, 4, 6, 7],
243
- 'FOO': [9, 12],
244
- 'BAR': [14, 16]
245
- });
246
- });
247
- });
248
- });
249
- });
250
- });
@@ -1,45 +0,0 @@
1
- 'use strict';
2
-
3
- const sinon = require('sinon');
4
- const { expect } = require('chai');
5
- const { initAssessFixture } = require('@contrast/test/fixtures');
6
-
7
- describe('assess dataflow propagation path', function () {
8
- let core, instr;
9
-
10
- beforeEach(function () {
11
- ({ core } = initAssessFixture());
12
- instr = core.assess.dataflow.propagation.pathInstrumentation;
13
- });
14
-
15
- const propagatorList = [
16
- 'basename',
17
- 'dirname',
18
- 'joinAndResolve',
19
- 'normalize',
20
- 'relative'
21
- ];
22
-
23
- it('composes different installers', function () {
24
- propagatorList.forEach((name) => {
25
- expect(instr[name]).to.have.property('install').and.be.a('function');
26
- });
27
- });
28
-
29
- it('dispatches installation to sub-components', function () {
30
- const installs = [];
31
- // stub these to prevent side effects
32
- propagatorList.forEach((name) => {
33
- const instr = core.assess.dataflow.propagation.pathInstrumentation;
34
- installs.push(sinon.stub(instr[name], 'install'));
35
- });
36
-
37
- instr.install();
38
-
39
- expect(installs).to.have.lengthOf(5);
40
- installs.forEach((installer) => {
41
- expect(installer).to.have.been.called;
42
- });
43
- });
44
- });
45
-