@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/propagation/install/string/split.test.js

@@ -1,513 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation string split', function () {
-  let core, simulateRequestScope, trackString, tracker;
-  const allPatcher = new Map();
-
-  beforeEach(function () {
-    ({
-      core,
-      trackString,
-      simulateRequestScope
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    sinon.spy(tracker, 'track');
-
-    core.assess.dataflow.propagation.stringInstrumentation.substring.install();
-    core.assess.dataflow.propagation.stringInstrumentation.split.install();
-  });
-
-  afterEach(function () {
-    tracker.track.restore();
-    core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
-    core.assess.dataflow.propagation.stringInstrumentation.split.uninstall();
-  });
-
-  // eslint-disable-next-line mocha/no-sibling-hooks
-  afterEach(function() {
-    core.Perf.fromAllToMap('patcher', allPatcher);
-  });
-
-  after(function() {
-    const stats = core.Perf.getStats(allPatcher);
-    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
-      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
-    }
-  });
-
-  describe('base cases', function () {
-    it('normal split on non-tracked string', function () {
-      simulateRequestScope(() => {
-        const ret = 'foo?foo'.split('?');
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str)).to.be.null;
-        });
-      });
-    });
-
-    it('regex split on non-tracked string', function () {
-      simulateRequestScope(() => {
-        const ret = 'foo?foo'.split(/\?/);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str)).to.be.null;
-        });
-      });
-    });
-
-    it('array split on non-tracked string', function () {
-      simulateRequestScope(() => {
-        const ret = 'foo?,?foo'.split(['?', '?']);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str)).to.be.null;
-        });
-      });
-    });
-
-    it('apply split on non-tracked string', function () {
-      simulateRequestScope(() => {
-        const ret = String.prototype.split.apply('foo?foo', ['?']);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str)).to.be.null;
-        });
-      });
-    });
-
-    it('limited split on non-tracked string', function () {
-      simulateRequestScope(() => {
-        const ret = 'foo?foo?foo'.split('?', 2);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str)).to.be.null;
-        });
-      });
-    });
-
-    it('split on empty string', function () {
-      simulateRequestScope(() => {
-        const ret = ''.split('?');
-        expect(ret).to.deep.equal(['']);
-        expect(tracker.getData(ret[0])).to.be.null;
-      });
-    });
-
-    it('split on object', function () {
-      simulateRequestScope(() => {
-        const ret = String.prototype.split.apply({ foo: 'foo' }, ['foo']);
-        expect(ret).to.deep.equal(['[object Object]']);
-        expect(tracker.getData(ret[0])).to.be.null;
-      });
-    });
-  });
-
-  describe('undefined/empty separators', function () {
-    [
-      [],
-      [undefined],
-      [null]
-    ].forEach((rest) => {
-      it(`handles ${rest[0]} separator`, function () {
-        simulateRequestScope(() => {
-          const extern = trackString('foo');
-          const ret = extern.split(rest[0]);
-          expect(ret).to.deep.equal(['foo']);
-          expect(tracker.getData(ret[0]).tags).to.deep.equal({
-            UNTRUSTED: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('handles empty separator for a fully tracked string', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo');
-        const ret = extern.split('');
-        expect(ret).to.deep.equal(['f', 'o', 'o']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            UNTRUSTED: [0, 0]
-          });
-        });
-      });
-    });
-
-    it('handles empty separator for a partially tracked string', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo', {
-          tags: {
-            UNTRUSTED: [1, 1]
-          }
-        });
-        const ret = extern.split('');
-        expect(ret).to.deep.equal(['f', 'o', 'o']);
-        expect(tracker.getData(ret[0])).to.be.null;
-        expect(tracker.getData(ret[1]).tags).to.deep.equal({
-          UNTRUSTED: [0, 0]
-        });
-        expect(tracker.getData(ret[2])).to.be.null;
-      });
-    });
-
-    it('handles empty separator for a tracked string with different named ranges', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo', {
-          tags: {
-            foo: [0, 0],
-            bar: [1, 2]
-          }
-        });
-        const ret = extern.split('');
-        expect(ret).to.deep.equal(['f', 'o', 'o']);
-        expect(tracker.getData(ret[0]).tags).to.deep.equal({
-          foo: [0, 0]
-        });
-        expect(tracker.getData(ret[1]).tags).to.deep.equal({
-          bar: [0, 0]
-        });
-        expect(tracker.getData(ret[2]).tags).to.deep.equal({
-          bar: [0, 0]
-        });
-      });
-    });
-  });
-
-  describe('string separators', function () {
-
-    it('keeps track of an unsplit string', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo', {
-          tags: {
-            untrusted: [0, 2]
-          }
-        });
-        const ret = extern.split('?');
-        expect(ret).to.deep.equal(['foo']);
-        expect(tracker.getData(ret[0]).tags).to.deep.equal({
-          untrusted: [0, 2]
-        });
-      });
-    });
-
-    it('handles split limit of 0', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-        const ret = extern.split('?', 0);
-        expect(ret).to.deep.equal([]);
-      });
-    });
-
-    it('handles non-zero split limit', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo');
-        const ret = extern.split('?', 2);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            UNTRUSTED: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('keeps track of a tracked split string', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo');
-        const ret = extern.split('?');
-        expect(ret).to.deep.equal(['foo', 'foo', 'foo']);
-
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            UNTRUSTED: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('does not call tracker.track if the split result is the original string', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo');
-        tracker.track.resetHistory();
-
-        const ret = extern.split('!');
-        expect(ret).to.deep.equal(['foo?foo?foo']);
-        expect(tracker.getData(ret[0]).tags).to.deep.equal({
-          UNTRUSTED: [0, 10]
-        });
-        expect(tracker.track).to.not.have.been.called;
-      });
-    });
-
-    it('keeps track of a tracked split string (long separator)', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo');
-        const ret = extern.split('?foo?');
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            UNTRUSTED: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('keeps track of a partially tracked split string', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 2, 8, 10]
-          }
-        });
-        const ret = extern.split('?');
-        expect(ret).to.deep.equal(['foo', 'foo', 'foo']);
-        expect(tracker.getData(ret[0]).tags).to.deep.equal({
-          untrusted: [0, 2]
-        });
-        expect(tracker.getData(ret[1])).to.be.null;
-        expect(tracker.getData(ret[2]).tags).to.deep.equal({
-          untrusted: [0, 2]
-        });
-      });
-    });
-
-    it('keeps track of a tracked split string with different tag range names', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 2, 8, 10],
-            foo: [0, 2],
-            bar: [4, 10]
-          }
-        });
-        const ret = extern.split('?');
-        expect(ret).to.deep.equal(['foo', 'foo', 'foo']);
-        expect(tracker.getData(ret[0]).tags).to.deep.equal({
-          untrusted: [0, 2],
-          foo: [0, 2]
-        });
-        expect(tracker.getData(ret[1]).tags).to.deep.equal({
-          bar: [0, 2]
-        });
-        expect(tracker.getData(ret[2]).tags).to.deep.equal({
-          untrusted: [0, 2],
-          bar: [0, 2]
-        });
-      });
-    });
-
-    it('keeps track of tracked separators', function () {
-      simulateRequestScope(() => {
-
-        const extern = trackString('foo?foo', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-
-        const trackedSep = trackString('?', {
-          tags: {
-            untrusted: [0, 0]
-          }
-        });
-        const ret = extern.split(trackedSep);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).args).to.deep.equal([{
-            value: '?', tracked: true
-          }]);
-        });
-      });
-    });
-
-    it('reports result as a comma delimited list', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-        const ret = extern.split('?');
-        expect(ret).to.deep.equal(['foo', 'foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).result).to.deep.equal({
-            value: 'foo',
-            tracked: true
-          });
-        });
-      });
-    });
-  });
-
-  describe('regEx separators', function () {
-    it('keeps track of a tracked split string separated by a RegEx', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-        const ret = extern.split(/\?/g);
-        expect(ret).to.deep.equal(['foo', 'foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            untrusted: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('keeps track of a tracked split string separated by a more complex RegEx', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo1foo2foo', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-        const ret = extern.split(/\d/g);
-        expect(ret).to.deep.equal(['foo', 'foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            untrusted: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('keeps track of a tracked split string separated by a RegEx containing capturing parentheses', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-        const ret = extern.split(/(\?)/g);
-        expect(ret).to.deep.equal(['foo', '?', 'foo', '?', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            untrusted: [0, str.length - 1]
-          });
-        });
-      });
-    });
-  });
-
-  describe('complex/edge cases', function () {
-
-    it('handles non-english characters', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('fꙨꙨꙮፈar', {
-          tags: {
-            untrusted: [0, 10]
-          }
-        });
-        const ret = extern.split('ꙮ');
-        expect(ret).to.deep.equal(['fꙨꙨ', 'ፈar']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            untrusted: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('handles multiple calls to split and keeps track of tracked strings with different named ranges', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('foo?foo?foo', {
-          tags: {
-            untrusted: [0, 8],
-            foo: [0, 2],
-            bar: [0, 6],
-            foobar: [9, 10]
-          }
-        });
-        let [foo1, foo2, foo3] = [...extern.split('?')];
-        foo1 = foo1.split();
-        foo2 = foo2.split('');
-        foo3 = foo3.split(/(o)/g);
-
-        expect(foo1).to.deep.equal(['foo']);
-        expect(foo2).to.deep.equal(['f', 'o', 'o']);
-        expect(foo3).to.deep.equal(['f', 'o', '', 'o', '']);
-
-        expect(tracker.getData(foo1[0]).tags).to.deep.equal({
-          untrusted: [0, 2],
-          foo: [0, 2],
-          bar: [0, 2]
-        });
-        foo2.forEach((char) => {
-          expect(tracker.getData(char).tags).to.deep.equal({
-            untrusted: [0, 0],
-            bar: [0, 0]
-          });
-        });
-        expect(tracker.getData(foo3[0]).tags).to.deep.equal({
-          untrusted: [0, 0]
-        });
-        expect(tracker.getData(foo3[1]).tags).to.deep.equal({
-          foobar: [0, 0]
-        });
-        expect(tracker.getData(foo3[3]).tags).to.deep.equal({
-          foobar: [0, 0]
-        });
-      });
-    });
-
-    it('custom splitter returns tracked strings', function () {
-      simulateRequestScope(() => {
-        const customSplit = {
-          [Symbol.split](str) {
-            return [str, str];
-          }
-        };
-        const extern = trackString('foo', {
-          tags: {
-            untrusted: [0, 2]
-          }
-        });
-        const ret = extern.split(customSplit);
-        expect(ret).to.deep.equal(['foo', 'foo']);
-        ret.forEach((str) => {
-          expect(tracker.getData(str).tags).to.deep.equal({
-            untrusted: [0, 2]
-          });
-        });
-      });
-    });
-
-    it('custom splitter calls split', function () {
-      simulateRequestScope(() => {
-        const onlySplitFoo = {
-          [Symbol.split](str) {
-            if (str.includes('foo')) {
-              return str.split('?');
-            } else {
-              return [];
-            }
-          }
-        };
-        const extern = trackString('foo?bar', {
-          tags: {
-            untrusted: [0, 2]
-          }
-        });
-        const ret = extern.split(onlySplitFoo);
-        expect(ret).to.deep.equal(['foo', 'bar']);
-        expect(tracker.getData(ret[0]).tags).to.deep.equal({
-          untrusted: [0, 2]
-        });
-        expect(tracker.getData(ret[1])).to.be.null;
-      });
-    });
-  });
-});