@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/propagation/install/JSON/parse.test.js

@@ -1,968 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const {
-  DataflowTag: { UNTRUSTED, LIMITED_CHARS, HEADER, WEAK_URL_ENCODED },
-  traverseValues,
-} = require('@contrast/common');
-
-describe('assess dataflow propagation JSON parse', function () {
-  let core,
-    tracker,
-    trackString,
-    simulateRequestScope,
-    objWithTrackedStr,
-    arrayWithTrackedStr,
-    standardEvent;
-
-  beforeEach(function () {
-    ({ core, trackString, simulateRequestScope } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-
-    core.assess.dataflow.propagation.jsonInstrumentation.stringify.install();
-    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
-    core.assess.dataflow.propagation.jsonInstrumentation.parse.install();
-
-    simulateRequestScope(() => {
-      objWithTrackedStr = {
-        prop1: trackString('test'),
-        prop2: trackString('test2'),
-        test2: "':\"",
-        arr: [
-          {
-            name: {
-              prop3: trackString('test3', {
-                tags: {
-                  [UNTRUSTED]: [0, 0, 2, 4],
-                },
-              }),
-            },
-          },
-          2,
-          trackString('test4'),
-        ],
-        nested: {
-          prop4: trackString('prop'),
-        },
-        prop5: trackString('test5', {
-          tags: {
-            [UNTRUSTED]: [0, 0, 2, 3],
-            [LIMITED_CHARS]: [0, 1],
-            [HEADER]: [1, 2],
-            [WEAK_URL_ENCODED]: [0, 1, 3, 4],
-          },
-        }),
-      };
-    });
-
-    simulateRequestScope(() => {
-      arrayWithTrackedStr = [
-        [1, trackString('test')],
-        [
-          2,
-          trackString('test2', {
-            tags: {
-              [UNTRUSTED]: [0, 0, 2, 3],
-              [LIMITED_CHARS]: [0, 1],
-              [HEADER]: [1, 2],
-              [WEAK_URL_ENCODED]: [0, 1, 3, 4],
-            },
-          }),
-        ],
-        [
-          3,
-          trackString('test3', {
-            tags: {
-              [UNTRUSTED]: [0, 0, 2, 3],
-            },
-          }),
-        ],
-        [
-          4,
-          {
-            name: trackString('test4', {
-              tags: {
-                [UNTRUSTED]: [0, 0, 2, 3],
-                [LIMITED_CHARS]: [0, 1],
-              },
-            }),
-          },
-        ],
-        [trackString('test5'), 5],
-      ];
-    });
-
-    standardEvent = {
-      object: {
-        tracked: false,
-        value: 'JSON',
-      },
-      name: 'JSON.parse',
-      source: 'P0',
-      target: 'R',
-      tags: {},
-    };
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.jsonInstrumentation.parse.uninstall();
-  });
-
-  it('will not propagate if the instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const trackedString = trackString('foo');
-        const string = JSON.stringify({ prop: trackedString });
-        const result = JSON.parse(string);
-
-        expect(result.prop).to.be.equal('foo');
-        expect(tracker.getData(result.prop)).to.be.null;
-      });
-    });
-  });
-
-  it('will not propagate if there is no assess policy in request context', function () {
-    simulateRequestScope(function () {
-      const trackedString = trackString('foo');
-      const string = JSON.stringify({ prop: trackedString });
-      const result = JSON.parse(string);
-
-      expect(result.prop).to.be.equal('foo');
-      expect(tracker.getData(result.prop)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('should ignore empty string', function () {
-    simulateRequestScope(function () {
-      const trackedString = trackString('');
-      const string = JSON.stringify({ prop: trackedString });
-      const result = JSON.parse(string);
-
-      expect(result.prop).to.be.equal('');
-      expect(tracker.getData(result.prop)).to.be.null;
-    });
-  });
-
-  it('will not propagate if the argument is not tracked', function () {
-    simulateRequestScope(function () {
-      const string = JSON.stringify({ prop: 'foo' });
-      const result = JSON.parse(string);
-
-      expect(result.prop).to.be.equal('foo');
-      expect(tracker.getData(result.prop)).to.be.null;
-    });
-  });
-
-  it('parse objWithTrackedStr', function () {
-    simulateRequestScope(() => {
-      const string = JSON.stringify(objWithTrackedStr);
-      const result = JSON.parse(string);
-      const prop1 = tracker.getData(result.prop1);
-
-      const expected1 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: result.prop1,
-        result: {
-          tracked: true,
-          value: result.prop1,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-      for (const key in expected1) {
-        expect(prop1[key]).deep.equal(expected1[key], `prop1.${key} is not as expected`);
-      }
-
-      const prop2 = tracker.getData(result.prop2);
-      const expected2 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: result.prop2,
-        result: {
-          tracked: true,
-          value: result.prop2,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-      for (const key in expected2) {
-        expect(prop2[key]).deep.equal(expected2[key], `prop2.${key} is not as expected`);
-      }
-
-      const prop3 = tracker.getData(result.arr[0].name.prop3);
-      const expected3 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop3.value,
-        result: {
-          tracked: true,
-          value: prop3.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 4],
-        },
-      });
-      for (const key in expected3) {
-        expect(prop3[key]).deep.equal(expected3[key], `prop3.${key} is not as expected`);
-      }
-
-      const test4 = tracker.getData(result.arr[2]);
-      const expected4 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test4.value,
-        result: {
-          tracked: true,
-          value: test4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-      for (const key in expected4) {
-        expect(test4[key]).deep.equal(expected4[key], `test4.${key} is not as expected`);
-      }
-
-      const prop4 = tracker.getData(result.nested.prop4);
-      const expected5 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop4.value,
-        result: {
-          tracked: true,
-          value: prop4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-      for (const key in expected5) {
-        expect(prop4[key]).deep.equal(expected5[key], `prop4.${key} is not as expected`);
-      }
-
-      const prop5 = tracker.getData(result.prop5);
-      const expected6 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop5.value,
-        result: {
-          tracked: true,
-          value: prop5.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-          [LIMITED_CHARS]: [0, 1],
-          [HEADER]: [1, 2],
-          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
-        },
-      });
-      for (const key in expected6) {
-        expect(prop5[key]).deep.equal(expected6[key], `prop5.${key} is not as expected`);
-      }
-
-    });
-  });
-
-  it('parse objWithTrackedStr with reviver', function () {
-    simulateRequestScope(() => {
-      const string = JSON.stringify(objWithTrackedStr);
-      const reviver = (key, value) => value;
-      const result = JSON.parse(string, reviver);
-
-      const prop1 = tracker.getData(result.prop1);
-      const expectedProp1 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: result.prop1,
-        result: {
-          tracked: true,
-          value: result.prop1,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-      for (const key in expectedProp1) {
-        expect(prop1[key]).deep.equal(expectedProp1[key], `prop1.${key} is not as expected`);
-      }
-
-      const prop2 = tracker.getData(result.prop2);
-      const expectedProp2 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: result.prop2,
-        result: {
-          tracked: true,
-          value: result.prop2,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-      for (const key in expectedProp2) {
-        expect(prop2[key]).deep.equal(expectedProp2[key], `prop2.${key} is not as expected`);
-      }
-
-      const prop3 = tracker.getData(result.arr[0].name.prop3);
-      const expectedProp3 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: prop3.value,
-        result: {
-          tracked: true,
-          value: prop3.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 4],
-        },
-      });
-      for (const key in expectedProp3) {
-        expect(prop3[key]).deep.equal(expectedProp3[key], `prop3.${key} is not as expected`);
-      }
-
-      const test4 = tracker.getData(result.arr[2]);
-      const expectedTest4 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: test4.value,
-        result: {
-          tracked: true,
-          value: test4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-      for (const key in expectedTest4) {
-        expect(test4[key]).deep.equal(expectedTest4[key], `test4.${key} is not as expected`);
-      }
-
-      const prop4 = tracker.getData(result.nested.prop4);
-      const expectedProp4 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: prop4.value,
-        result: {
-          tracked: true,
-          value: prop4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-      for (const key in expectedProp4) {
-        expect(prop4[key]).deep.equal(expectedProp4[key], `prop4.${key} is not as expected`);
-      }
-
-      const prop5 = tracker.getData(result.prop5);
-      const expectedProp5 = Object.assign({}, standardEvent, {
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: prop5.value,
-        result: {
-          tracked: true,
-          value: prop5.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-          [LIMITED_CHARS]: [0, 1],
-          [HEADER]: [1, 2],
-          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
-        },
-      });
-      for (const key in expectedProp5) {
-        expect(prop5[key]).deep.equal(expectedProp5[key], `prop5.${key} is not as expected`);
-      }
-    });
-  });
-
-  it('parse arrayWithTrackedStr', function () {
-    simulateRequestScope(() => {
-      const string = JSON.stringify(arrayWithTrackedStr);
-      const result = JSON.parse(string);
-
-      const test = tracker.getData(result[0][1]);
-      expect(test).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test.value,
-        result: {
-          tracked: true,
-          value: test.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-
-      const test2 = tracker.getData(result[1][1]);
-      expect(test2).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test2.value,
-        result: {
-          tracked: true,
-          value: test2.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-          [LIMITED_CHARS]: [0, 1],
-          [HEADER]: [1, 2],
-          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
-        },
-      });
-
-      const test3 = tracker.getData(result[2][1]);
-      expect(test3).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test3.value,
-        result: {
-          tracked: true,
-          value: test3.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-        },
-      });
-
-      const test4 = tracker.getData(result[3][1].name);
-      expect(test4).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test4.value,
-        result: {
-          tracked: true,
-          value: test4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-          [LIMITED_CHARS]: [0, 1],
-        },
-      });
-
-      const test5 = tracker.getData(result[4][0]);
-      expect(test5).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test5.value,
-        result: {
-          tracked: true,
-          value: test5.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-    });
-  });
-
-  it('parse arrayWithTrackedStr with reviver', function () {
-    simulateRequestScope(() => {
-      const string = JSON.stringify(arrayWithTrackedStr);
-      const reviver = (key, value) => (key === '' ? new Map(value) : value);
-      const result = JSON.parse(string, reviver);
-
-      const test = tracker.getData(result.get(1));
-      expect(test).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: test.value,
-        result: {
-          tracked: true,
-          value: test.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-
-      const test2 = tracker.getData(result.get(2));
-      expect(test2).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: test2.value,
-        result: {
-          tracked: true,
-          value: test2.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-          [LIMITED_CHARS]: [0, 1],
-          [HEADER]: [1, 2],
-          [WEAK_URL_ENCODED]: [0, 1, 3, 4],
-        },
-      });
-
-      const test3 = tracker.getData(result.get(3));
-      expect(test3).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: test3.value,
-        result: {
-          tracked: true,
-          value: test3.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-        },
-      });
-
-      const test4 = tracker.getData(result.get(4).name);
-      expect(test4).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: test4.value,
-        result: {
-          tracked: true,
-          value: test4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 0, 2, 3],
-          [LIMITED_CHARS]: [0, 1],
-        },
-      });
-
-      const test5 = tracker.getData(
-        Array.from(result.keys()).find((key) => key === 'test5')
-      );
-      expect(test5).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-          {
-            tracked: false,
-            value: reviver.toString(),
-          },
-        ],
-        value: test5.value,
-        result: {
-          tracked: true,
-          value: test5.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-    });
-  });
-
-  it('parse with spaces', function () {
-    simulateRequestScope(() => {
-      const input = {
-        prop1: 'test',
-        prop2: trackString('test2'),
-        arr: [
-          {
-            name: {
-              prop3: trackString('test3'),
-            },
-          },
-          2,
-          trackString('test4'),
-        ],
-        nested: {
-          prop4: trackString('prop'),
-        },
-        prop5: trackString('test5'),
-      };
-
-      const string = JSON.stringify(input);
-      const result = JSON.parse(string, null, ' ');
-
-      const prop1 = tracker.getData(result.prop1);
-      expect(prop1).to.be.null;
-
-      const prop2 = tracker.getData(result.prop2);
-      expect(prop2).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: result.prop2,
-        result: {
-          tracked: true,
-          value: result.prop2,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-
-      const prop3 = tracker.getData(result.arr[0].name.prop3);
-      expect(prop3).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop3.value,
-        result: {
-          tracked: true,
-          value: prop3.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-
-      const test4 = tracker.getData(result.arr[2]);
-      expect(test4).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test4.value,
-        result: {
-          tracked: true,
-          value: test4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-
-      const prop4 = tracker.getData(result.nested.prop4);
-      expect(prop4).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop4.value,
-        result: {
-          tracked: true,
-          value: prop4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-
-      const prop5 = tracker.getData(result.prop5);
-      expect(prop5).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop5.value,
-        result: {
-          tracked: true,
-          value: prop5.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-    });
-  });
-
-  it('parse with spaces and key values as values', function () {
-    simulateRequestScope(() => {
-      const input = {
-        test: true,
-        test2: trackString('test2'),
-        arr: [
-          {
-            name: {
-              test3: trackString('test3'),
-            },
-          },
-          2,
-          trackString('test4'),
-        ],
-        nested: {
-          prop: trackString('prop'),
-        },
-        test5: trackString('test5'),
-      };
-
-      const string = JSON.stringify(input, null);
-      const result = JSON.parse(string);
-
-      const prop1 = tracker.getData(result.test);
-      expect(prop1).to.be.null;
-
-      const prop2 = tracker.getData(result.test2);
-      expect(prop2).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop2.value,
-        result: {
-          tracked: true,
-          value: prop2.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-
-      const prop3 = tracker.getData(result.arr[0].name.test3);
-      expect(prop3).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop3.value,
-        result: {
-          tracked: true,
-          value: prop3.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-
-      const test4 = tracker.getData(result.arr[2]);
-      expect(test4).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: test4.value,
-        result: {
-          tracked: true,
-          value: test4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-
-      const prop4 = tracker.getData(result.nested.prop);
-      expect(prop4).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop4.value,
-        result: {
-          tracked: true,
-          value: prop4.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 3],
-        },
-      });
-
-      const prop5 = tracker.getData(result.test5);
-      expect(prop5).to.be.like({
-        ...standardEvent,
-        args: [
-          {
-            value: string,
-            tracked: true,
-          },
-        ],
-        value: prop5.value,
-        result: {
-          tracked: true,
-          value: prop5.value,
-        },
-        tags: {
-          [UNTRUSTED]: [0, 4],
-        },
-      });
-    });
-  });
-
-  it('propagates correctly when JSON string has leading and trailing \\n characters', function () {
-    const jsonStr = '\n{"hello":"world","foo":["bar"]}\n';
-    // happens outside of request scope so no propagation occurs
-    const expected = JSON.parse(jsonStr);
-
-    simulateRequestScope(() => {
-      const tracked = trackString(jsonStr);
-      const result = JSON.parse(tracked);
-
-      expect(result).to.deep.equal(expected);
-      traverseValues(result, (path, type, value) => {
-        expect(tracker.getData(value)?.tags?.[UNTRUSTED]).to.deep.equal([0, value.length - 1]);
-      });
-    });
-  });
-
-  it('propagates correctly when JSON string is partially tracked', function () {
-    const jsonStr = '\n{"hello":"world","foo":["bar"]}\n';
-    //                           xxx
-    const expected = JSON.parse(jsonStr);
-
-    simulateRequestScope(() => {
-      const tracked = trackString(jsonStr, { tags: { UNTRUSTED: [11, 13] } });
-      const result = JSON.parse(tracked);
-
-      expect(result).to.deep.equal(expected);
-      expect(tracker.getData(result.hello).tags).to.deep.equal({
-        UNTRUSTED: [0, 2],
-      });
-    });
-  });
-});