@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/sinks/install/mongodb.test.js

@@ -1,617 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const {
-  DataflowTag: { UNTRUSTED, LIMITED_CHARS },
-  Rule,
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow sinks mongodb-v4', function () {
-  let core, simulateRequestScope, trackString, reportFindings, instr, getQueryVulnInfo, getAggregateVulnInfo, getMapReduceVulnInfo, getGroupVulnInfo;
-
-  class Db {
-    command() { }
-    eval() { }
-    aggregate() { }
-  }
-
-  class Collection {
-    find() { }
-    findOne() { }
-    findAndModify() { }
-    findOneAndDelete() { }
-    findOneAndReplace() { }
-    findOneAndUpdate() { }
-    remove() { }
-    removeOne() { }
-    replaceOne() { }
-    removeMany() { }
-    rename() { }
-    update() { }
-    updateOne() { }
-    updateMany() { }
-    deleteOne() { }
-    deleteMany() { }
-    aggregate() { }
-    mapReduce() { }
-    group() { }
-  }
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-    reportFindings = sinon.stub(core.assess.dataflow.sinks, 'reportFindings');
-    core.depHooks.resolve.yields({ Collection, Db });
-
-    // while the Assess fixture will have already composed the module, we re-require (which
-    // just reassigns the component) so we're able to inject the spied-upon functions above
-    instr = require('./mongodb')(core);
-    getQueryVulnInfo = sinon.spy(instr, 'getQueryVulnerabilityInfo');
-    getAggregateVulnInfo = sinon.spy(instr, 'getAggregateVulnerabilityInfo');
-    getMapReduceVulnInfo = sinon.spy(instr, 'getMapReduceVulnerabilityInfo');
-    getGroupVulnInfo = sinon.spy(instr, 'getGroupVulnerabilityInfo');
-    instr.install();
-  });
-
-  [
-    { subject: Collection, method: 'find' },
-    { subject: Collection, method: 'findOne' },
-    { subject: Collection, method: 'findAndModify' },
-    { subject: Collection, method: 'findOneAndDelete' },
-    { subject: Collection, method: 'findOneAndReplace' },
-    { subject: Collection, method: 'findOneAndUpdate' },
-    { subject: Collection, method: 'remove' },
-    { subject: Collection, method: 'replaceOne' },
-    { subject: Collection, method: 'update' },
-    { subject: Collection, method: 'updateOne' },
-    { subject: Collection, method: 'updateMany' },
-    { subject: Collection, method: 'deleteOne' },
-    { subject: Collection, method: 'deleteMany' },
-    { subject: Db, method: 'command' },
-  ].forEach(({ subject, method }) => {
-    describe(`${subject.name}.prototype.${method}()`, function () {
-      it('skips instrumentation if assess store is missing', function () {
-        const tracked = trackString('foo');
-        (new subject())[method]({ tracked });
-        expect(getQueryVulnInfo).not.to.have.been.called;
-      });
-
-      it('skips instrumentation if the argument is not a string', function () {
-        simulateRequestScope(function () {
-          (new subject())[method]({});
-          expect(reportFindings).not.to.have.been.called;
-        });
-      });
-
-      it('does not report when query argument has no tracked values', function () {
-        simulateRequestScope(function () {
-          (new subject())[method]({ foo: 'bar' });
-          expect(reportFindings).not.to.have.been.called;
-        });
-      });
-
-      it('reports safe event when the input is sanitized', function () {
-        simulateRequestScope(function () {
-          const tracked = trackString('foo', {
-            tags: {
-              [LIMITED_CHARS]: [0, 2],
-              [UNTRUSTED]: [0, 2],
-            },
-          });
-          const strInfo = core.assess.dataflow.tracker.getData(tracked);
-          (new subject())[method]({ tracked });
-          expect(getQueryVulnInfo.getCall(0).returnValue).to.deep.equal({
-            vulnInfo: null,
-            reportSafe: [{ path: ['tracked'], strInfo }]
-          });
-          expect(reportFindings).not.to.have.been.called;
-        });
-      });
-
-      it('reports a nosql-injection', function () {
-        simulateRequestScope(function () {
-          const tracked = trackString('foo');
-          (new subject())[method]({ tracked });
-
-          expect(reportFindings).to.have.been.calledWithMatch({
-            ruleId: Rule.NOSQL_INJECTION_MONGO,
-            sinkEvent: {
-              args: [{ value: "{...'tracked':'foo'...}", tracked: true }],
-              name: sinon.match(method),
-              context: `${subject.name === 'Collection' ? 'db.collection' : 'db'}.${method}({...'tracked':'foo'...})`,
-              moduleName: 'mongodb',
-              methodName: `${subject.name}.prototype.${method}`,
-              object: {
-                value: sinon.match(subject.name),
-                tracked: false,
-              },
-              result: { value: 'Promise', tracked: false },
-              source: 'P0',
-              tags: { [UNTRUSTED]: [15, 17] },
-            },
-          });
-        });
-      });
-    });
-  });
-
-  describe('Db.prototype.aggregate and Collection.prototype.aggregate', function () {
-    it('report nosql-injection from user input in the $function operator', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        (new Collection()).aggregate([
-          {
-            $function: {
-              body: tracked
-            }
-          }
-        ]);
-        (new Db()).aggregate([
-          {
-            $function: {
-              body: tracked
-            }
-          }
-        ]);
-
-        expect(reportFindings).to.have.been.calledTwice;
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [{ value: "[...'body':'foo'...]", tracked: true }],
-            name: 'mongodb.Collection.prototype.aggregate',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P0',
-            tags: { [UNTRUSTED]: [12, 14] },
-          },
-        });
-
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [{ value: "[...'body':'foo'...]", tracked: true }],
-            name: sinon.match('aggregate'),
-            object: {
-              value: sinon.match('Db'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P0',
-            tags: { [UNTRUSTED]: [12, 14] },
-          },
-        });
-      });
-    });
-
-    [
-      { prop: 'init', tagRange: [12, 14] },
-      { prop: 'merge', tagRange: [13, 15] },
-      { prop: 'accumulate', tagRange: [18, 20] },
-      { prop: 'finalize', tagRange: [16, 18] }
-    ].forEach(({ prop, tagRange }) => {
-      it(`report nosql-injection from user input in the $accumulator operator and ${prop} property`, function () {
-        simulateRequestScope(function () {
-          const tracked = trackString('foo');
-          (new Collection()).aggregate([
-            {
-              $accumulator: {
-                [prop]: tracked
-              }
-            }
-          ]);
-          expect(reportFindings).to.have.been.calledWithMatch({
-            ruleId: Rule.NOSQL_INJECTION_MONGO,
-            sinkEvent: {
-              args: [
-                { value: `[...'${prop}':'foo'...]`, tracked: true }
-              ],
-              name: 'mongodb.Collection.prototype.aggregate',
-              object: {
-                value: sinon.match('Collection'),
-                tracked: false,
-              },
-              result: { value: 'Promise', tracked: false },
-              source: 'P0',
-              tags: { [UNTRUSTED]: tagRange },
-            },
-          });
-        });
-      });
-    });
-
-    it('reports safe event when the input is sanitized', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo', {
-          tags: {
-            [LIMITED_CHARS]: [0, 2],
-            [UNTRUSTED]: [0, 2],
-          },
-        });
-        const strInfo = core.assess.dataflow.tracker.getData(tracked);
-        (new Collection()).aggregate({
-          $function: {
-            body: tracked
-          }
-        });
-        expect(getAggregateVulnInfo.getCall(0).returnValue).to.deep.equal({
-          vulnInfo: null,
-          reportSafe: [{ path: ['$function', 'body'], strInfo }]
-        });
-        expect(reportFindings).not.to.have.been.called;
-      });
-    });
-  });
-
-  describe('Collection.prototype.mapReduce', function () {
-    it('report nosql-injection from user input in the first 2 arguments of `mapReduce` method', function () {
-      const options = { options: 'untracked' };
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        (new Collection()).mapReduce(
-          tracked,
-          'untracked',
-          options
-        );
-        (new Collection()).mapReduce(
-          'untracked',
-          tracked,
-          options
-        );
-
-        expect(reportFindings).to.have.been.calledTwice;
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'foo', tracked: true },
-              { value: 'String', tracked: false },
-              { value: 'Object', tracked: false },
-
-            ],
-            name: 'mongodb.Collection.prototype.mapReduce',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P0',
-            tags: { [UNTRUSTED]: [0, 2] },
-          },
-        });
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'String', tracked: false },
-              { value: 'foo', tracked: true },
-              { value: 'Object', tracked: false },
-
-            ],
-            name: 'mongodb.Collection.prototype.mapReduce',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P1',
-            tags: { [UNTRUSTED]: [0, 2] },
-          },
-        });
-      });
-    });
-
-    it('report nosql-injection from user input in the third argument of `mapReduce` method', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        const options1 = { query: tracked };
-        const options2 = { finalize: tracked };
-        (new Collection()).mapReduce(
-          'untracked',
-          'untracked',
-          options1
-        );
-        (new Collection()).mapReduce(
-          'untracked',
-          'untracked',
-          options2
-        );
-
-        expect(reportFindings).to.have.been.calledTwice;
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'String', tracked: false },
-              { value: 'String', tracked: false },
-              { value: '{...\'query\':\'foo\'...}', tracked: true },
-            ],
-            name: 'mongodb.Collection.prototype.mapReduce',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P2',
-            tags: { [UNTRUSTED]: [13, 15] },
-          },
-        });
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'String', tracked: false },
-              { value: 'String', tracked: false },
-              { value: '{...\'query\':\'foo\'...}', tracked: true },
-
-            ],
-            name: 'mongodb.Collection.prototype.mapReduce',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P2',
-            tags: { [UNTRUSTED]: [13, 15] },
-          },
-        });
-      });
-    });
-
-    it('reports safe event when the input is sanitized', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo', {
-          tags: {
-            [LIMITED_CHARS]: [0, 2],
-            [UNTRUSTED]: [0, 2],
-          },
-        });
-        const strInfo = core.assess.dataflow.tracker.getData(tracked);
-        (new Collection()).mapReduce(
-          tracked, // call 0
-          'untracked', // call 1
-          { some: 'options' } // call 2
-        );
-        (new Collection()).mapReduce(
-          tracked, // call 3
-          'untracked', // call 4
-          { query: tracked } // call 5
-        );
-
-        expect(getMapReduceVulnInfo.getCall(0).returnValue).to.deep.equal({
-          vulnInfo: null,
-          reportSafe: [{ strInfo }]
-        });
-        expect(getMapReduceVulnInfo.getCall(5).returnValue).to.deep.equal({
-          vulnInfo: null,
-          reportSafe: [{ path: ['query'], strInfo }]
-        });
-        expect(reportFindings).not.to.have.been.called;
-      });
-    });
-  });
-
-  describe('Collection.prototype.group', function () {
-    it('report nosql-injection from user input in the first and the fourth argument of `group` method', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        const condition = { some: 'condition' };
-        const initState = { init: 'state' };
-        (new Collection()).group(
-          tracked,
-          condition,
-          initState,
-          'reduceFn'
-        );
-        (new Collection()).group(
-          'someKeys',
-          condition,
-          initState,
-          tracked
-        );
-
-        expect(reportFindings).to.have.been.calledTwice;
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'foo', tracked: true },
-              { value: 'Object', tracked: false },
-              { value: 'Object', tracked: false },
-              { value: 'String', tracked: false },
-
-            ],
-            name: 'mongodb.Collection.prototype.group',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P0',
-            tags: { [UNTRUSTED]: [0, 2] },
-          },
-        });
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'String', tracked: false },
-              { value: 'Object', tracked: false },
-              { value: 'Object', tracked: false },
-              { value: 'foo', tracked: true },
-            ],
-            name: 'mongodb.Collection.prototype.group',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P3',
-            tags: { [UNTRUSTED]: [0, 2] },
-          },
-        });
-      });
-    });
-
-    it('report nosql-injection from user input in the second argument of `group` method', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        const condition = { condition: tracked };
-        const initState = { init: 'state' };
-        (new Collection()).group(
-          'someKeys',
-          condition,
-          initState,
-          'reduceFn'
-        );
-
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [
-              { value: 'String', tracked: false },
-              { value: '{...\'condition\':\'foo\'...}', tracked: true },
-              { value: 'Object', tracked: false },
-              { value: 'String', tracked: false },
-            ],
-            name: 'mongodb.Collection.prototype.group',
-            object: {
-              value: sinon.match('Collection'),
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P1',
-            tags: { [UNTRUSTED]: [17, 19] },
-          },
-        });
-      });
-    });
-
-    it('reports safe event when the input is sanitized', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo', {
-          tags: {
-            [LIMITED_CHARS]: [0, 2],
-            [UNTRUSTED]: [0, 2],
-          },
-        });
-        const strInfo = core.assess.dataflow.tracker.getData(tracked);
-        (new Collection()).group(
-          tracked, // call 0
-          { some: 'condition' }, // call 1
-          { init: 'state' },
-          'reduceFn' // call 2
-        );
-        (new Collection()).group(
-          'untracked', // call 3
-          { field: tracked }, // call 4
-          { init: 'state' },
-          'reduceFn'
-        );
-
-        expect(getGroupVulnInfo.getCall(0).returnValue).to.deep.equal({
-          vulnInfo: null,
-          reportSafe: [{ strInfo }]
-        });
-        expect(getGroupVulnInfo.getCall(4).returnValue).to.deep.equal({
-          vulnInfo: null,
-          reportSafe: [{ path: ['field'], strInfo }]
-        });
-        expect(reportFindings).not.to.have.been.called;
-      });
-    });
-  });
-
-  describe('Db.prototype.eval() and other edge cases', function () {
-    it('skips patching if the method is missing', function () {
-      class Collection {
-        findOne() { }
-      }
-      class Db {
-        command() { }
-      }
-      core.depHooks.resolve.yields({ Collection, Db }, 'v5.x.x');
-
-      const instr = require('./mongodb')(core);
-      instr.install();
-      expect(core.logger.trace).to.have.been.calledWith(
-        { version: 'v5.x.x' },
-        'method %s not found - skipping instrumentation',
-        'mongodb.Db.prototype.eval',
-      );
-      expect(core.logger.trace).to.have.been.calledWith(
-        { version: 'v5.x.x' },
-        'method %s not found - skipping instrumentation',
-        'mongodb.Collection.prototype.findOneAndDelete',
-      );
-    });
-
-    it('logs an error if such occurs during the evaluation', function () {
-      const err = new Error('test');
-
-      reportFindings.throws(err);
-
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        (new Collection()).find({ tracked });
-        (new Db()).command({ tracked });
-
-        expect(core.logger.error).to.have.been.calledWith(
-          { err, funcKey: 'assess-dataflow-sink:mongodb.Collection.prototype.find' },
-          'assess sink analysis failed',
-        );
-        expect(core.logger.error).to.have.been.calledWith(
-          { err, funcKey: 'assess-dataflow-sink:mongodb.Db.prototype.command' },
-          'assess sink analysis failed',
-        );
-      });
-    });
-
-    it('reports a nosql-injection from the eval methhod', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo');
-        (new Db()).eval(tracked);
-
-        expect(reportFindings).to.have.been.calledWithMatch({
-          ruleId: Rule.NOSQL_INJECTION_MONGO,
-          sinkEvent: {
-            args: [{ value: 'foo', tracked: true }],
-            name: 'mongodb.Db.prototype.eval',
-            moduleName: 'mongodb',
-            methodName: 'Db.prototype.eval',
-            context: 'db.eval(\'foo\')',
-            object: {
-              value: 'mongodb.Db',
-              tracked: false,
-            },
-            result: { value: 'Promise', tracked: false },
-            source: 'P0',
-            tags: { [UNTRUSTED]: [0, 2] },
-          },
-        });
-      });
-    });
-
-    it('reports safe event when the input is sanitized', function () {
-      simulateRequestScope(function () {
-        const tracked = trackString('foo', {
-          tags: {
-            [LIMITED_CHARS]: [0, 2],
-            [UNTRUSTED]: [0, 2],
-          },
-        });
-        const strInfo = core.assess.dataflow.tracker.getData(tracked);
-        (new Db()).eval(tracked);
-        expect(getQueryVulnInfo.getCall(0).returnValue).to.deep.equal({
-          vulnInfo: null,
-          reportSafe: [{ strInfo }]
-        });
-        expect(reportFindings).not.to.have.been.called;
-      });
-    });
-  });
-});