@contrast/assess 1.46.0 → 1.46.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/package.json +14 -11
  2. package/lib/crypto-analysis/install/crypto.test.js +0 -146
  3. package/lib/crypto-analysis/install/math.test.js +0 -65
  4. package/lib/dataflow/index.test.js +0 -36
  5. package/lib/dataflow/propagation/index.test.js +0 -103
  6. package/lib/dataflow/propagation/install/JSON/index.test.js +0 -50
  7. package/lib/dataflow/propagation/install/JSON/parse-fn.test.js +0 -232
  8. package/lib/dataflow/propagation/install/JSON/parse.test.js +0 -968
  9. package/lib/dataflow/propagation/install/JSON/stringify.test.js +0 -265
  10. package/lib/dataflow/propagation/install/array-prototype-join.test.js +0 -106
  11. package/lib/dataflow/propagation/install/buffer.test.js +0 -112
  12. package/lib/dataflow/propagation/install/contrast-methods/add.test.js +0 -94
  13. package/lib/dataflow/propagation/install/contrast-methods/index.test.js +0 -49
  14. package/lib/dataflow/propagation/install/contrast-methods/number.test.js +0 -50
  15. package/lib/dataflow/propagation/install/contrast-methods/string.test.js +0 -148
  16. package/lib/dataflow/propagation/install/contrast-methods/tag.test.js +0 -145
  17. package/lib/dataflow/propagation/install/decode-uri-component.test.js +0 -78
  18. package/lib/dataflow/propagation/install/ejs/escape-xml.test.js +0 -69
  19. package/lib/dataflow/propagation/install/ejs/template.test.js +0 -62
  20. package/lib/dataflow/propagation/install/encode-uri.test.js +0 -83
  21. package/lib/dataflow/propagation/install/escape-html.test.js +0 -71
  22. package/lib/dataflow/propagation/install/escape.test.js +0 -73
  23. package/lib/dataflow/propagation/install/fastify-send.test.js +0 -42
  24. package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.test.js +0 -71
  25. package/lib/dataflow/propagation/install/isnumeric-0.test.js +0 -58
  26. package/lib/dataflow/propagation/install/joi/any.test.js +0 -270
  27. package/lib/dataflow/propagation/install/joi/array.test.js +0 -912
  28. package/lib/dataflow/propagation/install/joi/boolean.test.js +0 -103
  29. package/lib/dataflow/propagation/install/joi/expression.test.js +0 -76
  30. package/lib/dataflow/propagation/install/joi/index.test.js +0 -39
  31. package/lib/dataflow/propagation/install/joi/number.test.js +0 -103
  32. package/lib/dataflow/propagation/install/joi/object.test.js +0 -119
  33. package/lib/dataflow/propagation/install/joi/ref.test.js +0 -607
  34. package/lib/dataflow/propagation/install/joi/string-schema.test.js +0 -513
  35. package/lib/dataflow/propagation/install/mongoose/index.test.js +0 -42
  36. package/lib/dataflow/propagation/install/mongoose/schema-map.test.js +0 -348
  37. package/lib/dataflow/propagation/install/mongoose/schema-mixed.test.js +0 -511
  38. package/lib/dataflow/propagation/install/mongoose/schema-string.test.js +0 -199
  39. package/lib/dataflow/propagation/install/mustache-escape.test.js +0 -62
  40. package/lib/dataflow/propagation/install/mysql-connection-escape.test.js +0 -74
  41. package/lib/dataflow/propagation/install/parse-int.test.js +0 -48
  42. package/lib/dataflow/propagation/install/path/basename.test.js +0 -143
  43. package/lib/dataflow/propagation/install/path/dirname.test.js +0 -167
  44. package/lib/dataflow/propagation/install/path/extname.test.js +0 -141
  45. package/lib/dataflow/propagation/install/path/format.test.js +0 -250
  46. package/lib/dataflow/propagation/install/path/index.test.js +0 -45
  47. package/lib/dataflow/propagation/install/path/join-and-resolve.test.js +0 -485
  48. package/lib/dataflow/propagation/install/path/normalize.test.js +0 -176
  49. package/lib/dataflow/propagation/install/path/parse.test.js +0 -238
  50. package/lib/dataflow/propagation/install/path/relative.test.js +0 -239
  51. package/lib/dataflow/propagation/install/path/toNamespacedPath.test.js +0 -158
  52. package/lib/dataflow/propagation/install/pug/index.test.js +0 -55
  53. package/lib/dataflow/propagation/install/pug-runtime-escape.test.js +0 -69
  54. package/lib/dataflow/propagation/install/querystring/escape.test.js +0 -63
  55. package/lib/dataflow/propagation/install/querystring/index.test.js +0 -40
  56. package/lib/dataflow/propagation/install/querystring/parse.test.js +0 -272
  57. package/lib/dataflow/propagation/install/querystring/stringify.test.js +0 -301
  58. package/lib/dataflow/propagation/install/reg-exp-prototype-exec.test.js +0 -283
  59. package/lib/dataflow/propagation/install/send.test.js +0 -63
  60. package/lib/dataflow/propagation/install/sequelize/query-generator.test.js +0 -74
  61. package/lib/dataflow/propagation/install/sequelize/sql-string.test.js +0 -119
  62. package/lib/dataflow/propagation/install/sql-template-strings.test.js +0 -100
  63. package/lib/dataflow/propagation/install/string/concat.test.js +0 -145
  64. package/lib/dataflow/propagation/install/string/format-methods.test.js +0 -74
  65. package/lib/dataflow/propagation/install/string/html-methods.test.js +0 -177
  66. package/lib/dataflow/propagation/install/string/index.test.js +0 -103
  67. package/lib/dataflow/propagation/install/string/match-all.test.js +0 -412
  68. package/lib/dataflow/propagation/install/string/match.test.js +0 -374
  69. package/lib/dataflow/propagation/install/string/replace.test.js +0 -601
  70. package/lib/dataflow/propagation/install/string/slice.test.js +0 -278
  71. package/lib/dataflow/propagation/install/string/split.test.js +0 -513
  72. package/lib/dataflow/propagation/install/string/substring.test.js +0 -251
  73. package/lib/dataflow/propagation/install/string/trim.test.js +0 -135
  74. package/lib/dataflow/propagation/install/unescape.test.js +0 -78
  75. package/lib/dataflow/propagation/install/url/domain-parsers.test.js +0 -63
  76. package/lib/dataflow/propagation/install/url/parse.test.js +0 -391
  77. package/lib/dataflow/propagation/install/url/searchParams.test.js +0 -538
  78. package/lib/dataflow/propagation/install/url/url.test.js +0 -466
  79. package/lib/dataflow/propagation/install/util-format.test.js +0 -336
  80. package/lib/dataflow/propagation/install/validator/hooks.test.js +0 -211
  81. package/lib/dataflow/sinks/index.test.js +0 -78
  82. package/lib/dataflow/sinks/install/child-process.test.js +0 -338
  83. package/lib/dataflow/sinks/install/eval.test.js +0 -95
  84. package/lib/dataflow/sinks/install/express/index.test.js +0 -33
  85. package/lib/dataflow/sinks/install/express/reflected-xss.test.js +0 -109
  86. package/lib/dataflow/sinks/install/express/unvalidated-redirect.test.js +0 -144
  87. package/lib/dataflow/sinks/install/fastify/index.test.js +0 -32
  88. package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.test.js +0 -130
  89. package/lib/dataflow/sinks/install/fs.test.js +0 -138
  90. package/lib/dataflow/sinks/install/function.test.js +0 -103
  91. package/lib/dataflow/sinks/install/hapi/index.test.js +0 -32
  92. package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.test.js +0 -130
  93. package/lib/dataflow/sinks/install/http/index.test.js +0 -33
  94. package/lib/dataflow/sinks/install/http/request.test.js +0 -184
  95. package/lib/dataflow/sinks/install/http/server-response.test.js +0 -160
  96. package/lib/dataflow/sinks/install/koa/index.test.js +0 -32
  97. package/lib/dataflow/sinks/install/koa/unvalidated-redirect.test.js +0 -200
  98. package/lib/dataflow/sinks/install/libxmljs.test.js +0 -158
  99. package/lib/dataflow/sinks/install/marsdb.test.js +0 -166
  100. package/lib/dataflow/sinks/install/mongodb.test.js +0 -617
  101. package/lib/dataflow/sinks/install/mssql.test.js +0 -134
  102. package/lib/dataflow/sinks/install/mysql.test.js +0 -224
  103. package/lib/dataflow/sinks/install/node-serialize.test.js +0 -83
  104. package/lib/dataflow/sinks/install/postgres.test.js +0 -152
  105. package/lib/dataflow/sinks/install/restify.test.js +0 -140
  106. package/lib/dataflow/sinks/install/sequelize.test.js +0 -100
  107. package/lib/dataflow/sinks/install/sqlite3.test.js +0 -118
  108. package/lib/dataflow/sinks/install/vm.test.js +0 -326
  109. package/lib/dataflow/sources/handler.test.js +0 -501
  110. package/lib/dataflow/sources/index.test.js +0 -60
  111. package/lib/dataflow/sources/install/body-parser1.test.js +0 -244
  112. package/lib/dataflow/sources/install/busboy.test.js +0 -152
  113. package/lib/dataflow/sources/install/cookie-parser1.test.js +0 -141
  114. package/lib/dataflow/sources/install/express/params.test.js +0 -110
  115. package/lib/dataflow/sources/install/express/parsedUrl.test.js +0 -107
  116. package/lib/dataflow/sources/install/fastify/fastify.test.js +0 -207
  117. package/lib/dataflow/sources/install/fastify/index.test.js +0 -33
  118. package/lib/dataflow/sources/install/formidable1.test.js +0 -119
  119. package/lib/dataflow/sources/install/graphql-http.test.js +0 -133
  120. package/lib/dataflow/sources/install/hapi/hapi.test.js +0 -171
  121. package/lib/dataflow/sources/install/hapi/index.test.js +0 -33
  122. package/lib/dataflow/sources/install/http.test.js +0 -149
  123. package/lib/dataflow/sources/install/koa/index.test.js +0 -40
  124. package/lib/dataflow/sources/install/koa/koa-bodyparsers.test.js +0 -160
  125. package/lib/dataflow/sources/install/koa/koa-multer.test.js +0 -197
  126. package/lib/dataflow/sources/install/koa/koa-routers.test.js +0 -146
  127. package/lib/dataflow/sources/install/koa/koa2.test.js +0 -145
  128. package/lib/dataflow/sources/install/multer1.test.js +0 -143
  129. package/lib/dataflow/sources/install/qs6.test.js +0 -131
  130. package/lib/dataflow/sources/install/querystring.test.js +0 -82
  131. package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.test.js +0 -86
  132. package/lib/dataflow/sources/install/restify/index.test.js +0 -38
  133. package/lib/dataflow/sources/install/restify/jsonBodyParser.test.js +0 -140
  134. package/lib/dataflow/sources/install/restify/router.test.js +0 -81
  135. package/lib/dataflow/tag-utils-complete.test.js +0 -27
  136. package/lib/dataflow/tag-utils.test.js +0 -192
  137. package/lib/dataflow/tracker.test.js +0 -216
  138. package/lib/dataflow/utils/is-safe-content-type.test.js +0 -16
  139. package/lib/dataflow/utils/is-vulnerable.test.js +0 -115
  140. package/lib/event-factory.test.js +0 -326
  141. package/lib/get-policy.test.js +0 -194
  142. package/lib/get-source-context.test.js +0 -161
  143. package/lib/index.test.js +0 -45
  144. package/lib/make-source-context.test.js +0 -50
  145. package/lib/response-scanning/handlers/index.test.js +0 -419
  146. package/lib/response-scanning/handlers/utils.test.js +0 -380
  147. package/lib/response-scanning/index.test.js +0 -41
  148. package/lib/response-scanning/install/http.test.js +0 -175
  149. package/lib/rule-scopes.test.js +0 -27
  150. package/lib/sampler/common.test.js +0 -101
  151. package/lib/sampler/index.test.js +0 -313
  152. package/lib/session-configuration/handlers.test.js +0 -84
  153. package/lib/session-configuration/index.test.js +0 -36
  154. package/lib/session-configuration/install/express-session.test.js +0 -218
  155. package/lib/session-configuration/install/fastify-cookie.test.js +0 -63
  156. package/lib/session-configuration/install/hapi.test.js +0 -269
  157. package/lib/session-configuration/install/koa.test.js +0 -92
@@ -1,278 +0,0 @@
1
- 'use strict';
2
-
3
- const { expect } = require('chai');
4
- const sinon = require('sinon');
5
- const { initAssessFixture } = require('@contrast/test/fixtures');
6
-
7
- describe('assess dataflow propagation string slice', function () {
8
- let core, tracker, trackString, simulateRequestScope;
9
- const allPatcher = new Map();
10
-
11
- beforeEach(function () {
12
- ({
13
- core,
14
- simulateRequestScope,
15
- trackString
16
- } = initAssessFixture());
17
- tracker = core.assess.dataflow.tracker;
18
-
19
- core.assess.dataflow.propagation.stringInstrumentation.slice.install();
20
- });
21
-
22
- afterEach(function () {
23
- core.assess.dataflow.propagation.stringInstrumentation.slice.uninstall();
24
- sinon.resetHistory();
25
- });
26
-
27
- // eslint-disable-next-line mocha/no-sibling-hooks
28
- afterEach(function() {
29
- core.Perf.fromAllToMap('patcher', allPatcher);
30
- });
31
-
32
- after(function() {
33
- const stats = core.Perf.getStats(allPatcher);
34
- for (const [key, { n, totalMicros, mean }] of stats.entries()) {
35
- console.log(key, n, totalMicros, 'nsec', mean, 'mean');
36
- }
37
- });
38
-
39
- [
40
- {
41
- desc: 'not tracked',
42
- str: '-----------',
43
- args: [0, 2],
44
- },
45
- {
46
- desc: 'above',
47
- str: '-----xx',
48
- tags: {
49
- untrusted: [5, 6]
50
- },
51
- expected: {
52
- untrusted: [5, 6]
53
- },
54
- args: [0],
55
- result: '-----xx',
56
- },
57
- {
58
- desc: 'above',
59
- str: '-----xx',
60
- tags: {
61
- untrusted: [5, 6]
62
- },
63
- args: [0, 3],
64
- result: '---',
65
- },
66
- {
67
- desc: 'highspan',
68
- str: '--xxx--',
69
- tags: {
70
- untrusted: [2, 4]
71
- },
72
- args: [1, 4],
73
- expected: {
74
- untrusted: [1, 2]
75
- },
76
- expectedResult: '-xx',
77
- },
78
- {
79
- desc: 'within',
80
- str: '--xxx--',
81
- tags: {
82
- untrusted: [2, 4]
83
- },
84
- args: [1],
85
- expected: {
86
- untrusted: [1, 3]
87
- },
88
- result: '-xxx--',
89
- },
90
- {
91
- desc: 'fullSpan',
92
- str: '--xxx--',
93
- tags: {
94
- untrusted: [2, 4]
95
- },
96
- args: [2, 4],
97
- expected: {
98
- untrusted: [0, 1]
99
- },
100
- result: 'xx',
101
- },
102
- {
103
- desc: 'lowspan',
104
- str: '--xxx--',
105
- tags: {
106
- untrusted: [2, 4]
107
- },
108
- args: [3, 5],
109
- expected: {
110
- untrusted: [0, 1]
111
- },
112
- },
113
- {
114
- desc: 'lowspan',
115
- str: '--xxx--',
116
- tags: {
117
- untrusted: [2, 4],
118
- cat: [0, 2]
119
- },
120
- args: [3, 5],
121
- expected: {
122
- untrusted: [0, 1]
123
- },
124
- },
125
- {
126
- desc: 'lowspan',
127
- str: '--xxx--',
128
- tags: {
129
- untrusted: [2, 4],
130
- cat: [0, 4]
131
- },
132
- args: [3, 5],
133
- expected: {
134
- untrusted: [0, 1],
135
- cat: [0, 1]
136
- },
137
- },
138
- {
139
- desc: 'lowspan',
140
- str: '--xxx--',
141
- tags: {
142
- untrusted: [2, 4],
143
- cat: [4, 5]
144
- },
145
- args: [3, 5],
146
- expected: {
147
- untrusted: [0, 1],
148
- cat: [1, 1]
149
- },
150
- },
151
- {
152
- desc: 'lowspan',
153
- str: '--xxx--',
154
- tags: {
155
- untrusted: [2, 4],
156
- cat: [6, 6]
157
- },
158
- args: [3, 5],
159
- expected: {
160
- untrusted: [0, 1]
161
- },
162
- },
163
- // Negative implementation
164
- {
165
- desc: 'negative / not tracked',
166
- str: '-----------',
167
- args: [-3, -8],
168
- },
169
- {
170
- desc: 'negative / above',
171
- str: '-----xx',
172
- tags: {
173
- untrusted: [5, 6]
174
- },
175
- args: [-6, -3],
176
- result: '---',
177
- },
178
- {
179
- desc: 'above',
180
- str: '-----xx',
181
- tags: {
182
- untrusted: [5, 6]
183
- },
184
- args: [2, -1],
185
- result: '---x',
186
- expected: {
187
- untrusted: [3, 3]
188
- },
189
- },
190
- {
191
- desc: 'negative / highspan',
192
- str: '--xxx--',
193
- tags: {
194
- untrusted: [2, 4]
195
- },
196
- args: [-6, -3],
197
- expected: {
198
- untrusted: [1, 2]
199
- },
200
- expectedResult: '-xx',
201
- },
202
- {
203
- desc: 'negative / within',
204
- str: '--xxx--',
205
- tags: {
206
- untrusted: [2, 4]
207
- },
208
- args: [-6],
209
- expected: {
210
- untrusted: [1, 3]
211
- },
212
- result: '-xxx--',
213
- },
214
- {
215
- desc: 'negative / fullSpan',
216
- str: '--xxx--',
217
- tags: {
218
- untrusted: [2, 4]
219
- },
220
- args: [-5, -3],
221
- expected: {
222
- untrusted: [0, 1]
223
- },
224
- result: 'xx',
225
- },
226
- {
227
- desc: 'negative / lowspan',
228
- str: '--xxx--',
229
- tags: {
230
- untrusted: [2, 4]
231
- },
232
- args: [-4, -2],
233
- expected: {
234
- untrusted: [0, 1]
235
- },
236
- },
237
- ].forEach(({ desc, str, tags, args, expected }) => {
238
- it(desc, function () {
239
- simulateRequestScope(function () {
240
- const extern = trackString(str, { tags });
241
- const result = extern.slice(...args);
242
- const strInfo = tracker.getData(result);
243
-
244
- if (expected) {
245
- expect(strInfo.tags).to.deep.equal(expected);
246
- } else {
247
- expect(strInfo).to.be.null;
248
- }
249
- });
250
- });
251
- });
252
-
253
- it('won\'t do anything if the result is the same or not in proper scope', function () {
254
- const extern = trackString('foo');
255
-
256
- let result;
257
-
258
- core.scopes.sources.run({}, function () {
259
- result = extern.slice(5);
260
- });
261
-
262
- expect(tracker.getData(result)).to.be.null;
263
-
264
- core.scopes.sources.run(null, function () {
265
- result = extern.slice(0, 2);
266
- });
267
-
268
- expect(tracker.getData(result)).to.be.null;
269
-
270
- core.scopes.instrumentation.run({ lock: true }, function () {
271
- core.scopes.sources.run({}, function () {
272
- result = extern.slice(0, 2);
273
- });
274
- });
275
-
276
- expect(tracker.getData(result)).to.be.null;
277
- });
278
- });