@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/sources/install/express/parsedUrl.test.js

@@ -1,107 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow sources express parsedUrl', function () {
-  let core, instrumentation, patcher, simulateRequestScope, req, res, tracker;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    instrumentation = core.assess.dataflow.sources.expressInstrumentation.parsedUrl;
-    tracker = core.assess.dataflow.tracker;
-    patcher = core.patcher;
-
-    req = {};
-    res = {};
-  });
-
-  describe('express4', function() {
-    let middleware;
-
-    beforeEach(function() {
-      middleware = {
-        init() {
-          return function (req, res, next) {
-            req._parsedUrl = {
-              href: '/some/path?asdf=jkl',
-              path: '/some/path?asdf=jkl',
-              pathname: '/some/path',
-              query: 'asdf=jkl',
-              search: '?asdf=jkl;',
-            };
-            next();
-          };
-        }
-      };
-
-      core.depHooks.resolve.withArgs(sinon.match({ name: 'express' })).yields(middleware);
-    });
-
-    it('hooks init next in order to track req._parsedUrl values', function () {
-      instrumentation.install();
-      expect(patcher.isContrastHooked(middleware.init)).to.be.true;
-
-      const middlewareFn = middleware.init('text');
-
-      simulateRequestScope(() => {
-        const cb = sinon.spy(function () {
-          [
-            'href',
-            'path',
-            'pathname',
-            'query',
-            'search',
-          ].forEach((prop) => {
-            const strInfo = tracker.getData(req._parsedUrl[prop]);
-            expect(strInfo).to.be.ok;
-          });
-        });
-
-        middlewareFn(req, res, cb);
-
-        expect(cb).to.have.been.called;
-      });
-    });
-  });
-
-  describe('express5', function() {
-    let LayerMock;
-
-    beforeEach(function() {
-      req = {
-        _parsedUrl: {
-          href: '/some/path?asdf=jkl',
-          path: '/some/path?asdf=jkl',
-          pathname: '/some/path',
-          query: 'asdf=jkl',
-          search: '?asdf=jkl;',
-        }
-      };
-
-      LayerMock = sinon.stub();
-      LayerMock.prototype.handleRequest = sinon.stub();
-
-      core.depHooks.resolve.withArgs(sinon.match({ name: 'router' })).yields(LayerMock);
-    });
-
-    it('hooks handleRequest in order to track req._parsedUrl values', function () {
-      instrumentation.install();
-      simulateRequestScope(() => {
-        LayerMock.prototype.handleRequest(req);
-        [
-          'href',
-          'path',
-          'pathname',
-          'query',
-          'search',
-        ].forEach((prop) => {
-          const strInfo = tracker.getData(req._parsedUrl[prop]);
-          expect(strInfo).to.be.ok;
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/sources/install/fastify/fastify.test.js

@@ -1,207 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { InputType } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const fastifyInstr = require('./fastify');
-
-describe('assess dataflow sources fastify', function () {
-  let core, simulateRequestScope, fastifyServerMock, serverMock, sources, reqMock, replyMock, doneMock;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    sources = core.assess.dataflow.sources;
-
-    sinon.spy(sources, 'handle');
-
-    reqMock = {
-      query: { foo: 'bar' },
-      params: { frogs: 'bugs' },
-      body: { fred: 'barney' },
-    };
-    replyMock = {};
-    doneMock = sinon.stub();
-    serverMock = {
-      addHook: sinon.stub().yields(reqMock, replyMock, doneMock),
-    };
-    fastifyServerMock = () => serverMock;
-    core.depHooks.resolve.callsFake((desc, cb) => {
-      fastifyServerMock = cb(fastifyServerMock);
-    });
-
-    fastifyInstr(core).install();
-    core.logger.trace.resetHistory();
-  });
-
-  afterEach(function () {
-    sources.handle.restore?.();
-  });
-
-  describe('preValidationHook', function () {
-    const commonData = {
-      name: 'fastify.preValidation',
-      stacktraceOpts: {
-        constructorOpt: sinon.match((value) => typeof value === 'function' && /handler/i.test(value.name)),
-      },
-    };
-
-    it('adds hook and tracks the body, headers and query/url params', function () {
-      simulateRequestScope(function () {
-        fastifyServerMock();
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-
-        expect(serverMock.addHook).to.have.been.calledOnce;
-        expect(doneMock).to.have.been.calledOnce;
-
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.query',
-          inputType: InputType.QUERYSTRING,
-          data: reqMock.query,
-          sourceContext,
-        });
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.params',
-          inputType: InputType.URL_PARAMETER,
-          data: reqMock.params,
-          sourceContext
-        });
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.body',
-          inputType: InputType.PARAMETER_VALUE,
-          data: reqMock.body,
-          sourceContext
-        });
-      });
-
-      simulateRequestScope(function () {
-        reqMock.headers = {
-          'content-type': 'application/json'
-        };
-        fastifyServerMock();
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-
-        expect(serverMock.addHook).to.have.been.calledTwice;
-        expect(doneMock).to.have.been.calledTwice;
-
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.query',
-          inputType: InputType.QUERYSTRING,
-          data: reqMock.query,
-          sourceContext
-        });
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.params',
-          inputType: InputType.URL_PARAMETER,
-          data: reqMock.params,
-          sourceContext
-        });
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.body',
-          inputType: InputType.JSON_VALUE,
-          data: reqMock.body,
-          sourceContext
-        });
-      });
-
-      simulateRequestScope(function () {
-        delete reqMock.headers;
-        reqMock.body = 'non-object-body';
-        fastifyServerMock();
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-
-        expect(serverMock.addHook).to.have.been.calledThrice;
-        expect(doneMock).to.have.been.calledThrice;
-
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.query',
-          inputType: InputType.QUERYSTRING,
-          data: reqMock.query,
-          sourceContext,
-        });
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.params',
-          inputType: InputType.URL_PARAMETER,
-          data: reqMock.params,
-          sourceContext
-        });
-        expect(sources.handle).to.have.been.calledWith({
-          ...commonData,
-          context: 'req.body',
-          inputType: InputType.BODY,
-          data: reqMock.body,
-          sourceContext
-        });
-      });
-    });
-
-    it('does not handle source when there is no assess policy in request context', function () {
-      simulateRequestScope(() => {
-        fastifyServerMock();
-      }, { assess: { policy: null } });
-
-      expect(sources.handle).not.to.have.been.called;
-    });
-
-    it('does not call `.handle` when the values are already tracked', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        sourceContext.parsedQuery = true;
-        sourceContext.parsedParams = true;
-        sourceContext.parsedBody = true;
-
-        fastifyServerMock();
-      });
-
-      expect(sources.handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledThrice;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:fastify.constructor' },
-        'values already tracked',
-      );
-      expect(core.logger.trace).to.have.been.calledWith(
-        { inputType: InputType.URL_PARAMETER, funcKey: 'assess-dataflow-source:fastify.constructor' },
-        'values already tracked',
-      );
-      expect(core.logger.trace).to.have.been.calledWith(
-        { inputType: InputType.PARAMETER_VALUE, funcKey: 'assess-dataflow-source:fastify.constructor' },
-        'values already tracked',
-      );
-    });
-
-    it('handles a case with an error in the `.handle` method', function () {
-      fastifyInstr(core).install();
-      const err = new Error('test');
-
-      core.assess.dataflow.sources.handle = () => {
-        throw err;
-      };
-
-      simulateRequestScope(function () {
-        fastifyServerMock();
-      });
-
-      expect(core.logger.error).to.have.been.calledThrice;
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:fastify.constructor' },
-        'unable to handle Fastify source',
-      );
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, inputType: InputType.URL_PARAMETER, funcKey: 'assess-dataflow-source:fastify.constructor' },
-        'unable to handle Fastify source',
-      );
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, inputType: InputType.PARAMETER_VALUE, funcKey: 'assess-dataflow-source:fastify.constructor' },
-        'unable to handle Fastify source',
-      );
-    });
-  });
-});

package/lib/dataflow/sources/install/fastify/index.test.js

@@ -1,33 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const proxyquire = require('proxyquire');
-const mocks = require('@contrast/test/mocks');
-
-const moduleMock = (moduleName, mock) => (deps) => {
-  deps.assess.dataflow.sources.fastifyInstrumentation[moduleName] = mock[moduleName];
-};
-
-describe('assess dataflow sources fastify', function () {
-  let core, fastifySourcesMock, fastifySourcesModule, modulesWithInstall;
-
-  beforeEach(function () {
-    core = mocks.core();
-    core.assess = mocks.assess();
-    fastifySourcesMock = core.assess.dataflow.sources.fastifyInstrumentation;
-    fastifySourcesModule = proxyquire('.', {
-      './fastify': moduleMock('fastify', fastifySourcesMock)
-    });
-    modulesWithInstall = [
-      'fastify'
-    ];
-  });
-
-  it('installs the components', function () {
-    fastifySourcesModule(core).install();
-
-    modulesWithInstall.forEach((module) => {
-      expect(fastifySourcesMock[module].install).to.have.been.calledOnce;
-    });
-  });
-});

package/lib/dataflow/sources/install/formidable1.test.js

@@ -1,119 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const formidableInstr = require('./formidable1');
-
-describe('assess dataflow sources formidable v1.x', function () {
-  let core, simulateRequestScope, parseMock, patchedParse, req, cbStub, sources;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sources = core.assess.dataflow.sources;
-    sinon.spy(sources, 'handle');
-
-    req = { fields: { parameter: 'parsed' }, files: { fileField: { name: 'some-file' } } };
-    parseMock = (req, cb) => {
-      if (typeof cb === 'function') {
-        cb(null, req.fields, req.files);
-      }
-    };
-    cbStub = sinon.stub();
-    sinon.spy(core.patcher, 'patch');
-
-    formidableInstr(core).install();
-    patchedParse = core.depHooks.resolve.yield({ IncomingForm: { prototype: { parse: parseMock } } })[0].IncomingForm.prototype.parse;
-    core.patcher.patch.resetHistory();
-  });
-
-  it('calls patcher on the `.parse` method', function () {
-    core.depHooks.resolve.yield({ IncomingForm: { prototype: { parse: parseMock } } });
-
-    expect(core.patcher.patch).to.have.been.calledOnce;
-    expect(core.patcher.patch).to.have.been.calledWithMatch(sinon.match.func, {
-      name: 'Formidable.IncomingForm.prototype.parse',
-      patchType: 'assess-dataflow-source',
-      pre: sinon.match.func
-    });
-  });
-
-  it('calls `.handle` when parsing is successful and in right context', function () {
-    let sourceContext;
-
-    simulateRequestScope(() => {
-      patchedParse(req, cbStub);
-
-      sourceContext = core.scopes.sources.getStore()?.assess;
-    });
-
-    expect(cbStub).to.have.been.calledOnce;
-    expect(sources.handle).to.have.been.calledOnce;
-    expect(sources.handle).to.have.been.calledWithMatch({
-      context: 'req.body',
-      name: 'Formidable.IncomingForm.prototype.parse',
-      stacktraceOpts: {
-        constructorOpt: sinon.match.func,
-        prependFrames: [sinon.match.func]
-      },
-      inputType: InputType.MULTIPART_VALUE,
-      data: { parameter: 'parsed' },
-      sourceContext
-    });
-  });
-
-  it('logs an error when `handle` throws one', function () {
-    const err = new Error('test');
-
-    core.assess.dataflow.sources.handle = () => {
-      throw err;
-    };
-
-    simulateRequestScope(() => {
-      patchedParse(req, cbStub);
-    });
-
-    expect(cbStub).to.have.been.calledOnce;
-    expect(core.logger.error).to.have.been.calledWith(
-      { err, inputType: InputType.MULTIPART_VALUE, funcKey: 'assess-dataflow-source:Formidable.IncomingForm.prototype.parse' },
-      'unable to handle source',
-    );
-  });
-
-  it('does not call `.handle` when there is no assess policy in request context', function () {
-    simulateRequestScope(() => {
-      patchedParse(req, cbStub);
-    }, { assess: { policy: null } });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(cbStub).to.have.been.calledOnce;
-  });
-
-  it('does not call `.handle` when the values are already tracked', function () {
-    simulateRequestScope(() => {
-      const sourceContext = core.scopes.sources.getStore()?.assess;
-      sourceContext.parsedBody = true;
-
-      patchedParse(req, cbStub);
-    });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(core.logger.trace).to.have.been.calledWith(
-      { inputType: InputType.MULTIPART_VALUE, funcKey: 'assess-dataflow-source:Formidable.IncomingForm.prototype.parse' },
-      'values already tracked',
-    );
-    expect(cbStub).to.have.been.calledOnce;
-  });
-
-  it('does not call `.handle` when `formidable` does not return a result', function () {
-    simulateRequestScope(() => {
-      patchedParse({}, cbStub);
-    });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(core.logger.debug).not.to.have.been.called;
-    expect(cbStub).to.have.been.calledOnce;
-  });
-});

package/lib/dataflow/sources/install/graphql-http.test.js

@@ -1,133 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-
-describe('assess dataflow sources graphql-http v1', function () {
-  let core, simulateRequestScope, createHandler, parseRequestParams, _exports;
-
-  this.beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    createHandler = sinon.stub().callsFake(({ parseRequestParams }) =>
-      sinon.stub().callsFake((req) => parseRequestParams(req)),
-    );
-    parseRequestParams = sinon.stub().resolves({ query: 'query { foo }' });
-
-    require('./graphql-http')(core).install();
-    _exports = core.depHooks.resolve.yield({ createHandler, parseRequestParams })[0];
-  });
-
-  describe('parseRequestParams', function () {
-    it('does not emit an event when the parser does not return a promise', function () {
-      parseRequestParams.returns(undefined);
-
-      return simulateRequestScope(async () => {
-        await _exports.parseRequestParams();
-        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      });
-    });
-
-    it('does not emit an event when the parser does not resolve a result', function () {
-      parseRequestParams.resolves(undefined);
-
-      return simulateRequestScope(async () => {
-        await _exports.parseRequestParams();
-        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      });
-    });
-
-    it('does not emit an event when outside of a source context', async function () {
-      await _exports.parseRequestParams();
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    });
-
-    it('does not emit an event when already parsed', function () {
-      return simulateRequestScope(async () => {
-        await _exports.parseRequestParams();
-        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        expect(core.logger.trace).to.have.been.calledWith(sinon.match.object, 'values already tracked');
-      }, { assess: { parsedBody: true } });
-    });
-
-
-    it('emits an event when handling a GET request', function () {
-      return simulateRequestScope(async () => {
-        await _exports.parseRequestParams({ method: 'GET' });
-
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-          name: 'graphql-http.parseRequestParams',
-          context: 'req.url',
-          inputType: InputType.PARAMETER_VALUE,
-          data: { query: 'query { foo }' },
-          keys: ['query'],
-          sourceContext: core.scopes.sources.getStore().assess,
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-            prependFrames: [sinon.match.func],
-          },
-        });
-      });
-    });
-
-    it('emits an event when handling a POST request', function () {
-      return simulateRequestScope(async () => {
-        await _exports.parseRequestParams({ method: 'POST' });
-
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-          name: 'graphql-http.parseRequestParams',
-          context: 'req.body',
-          inputType: InputType.JSON_VALUE,
-          data: { query: 'query { foo }' },
-          keys: ['query'],
-          sourceContext: core.scopes.sources.getStore().assess,
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-            prependFrames: [sinon.match.func],
-          },
-        });
-      });
-    });
-
-    it('handles errors when emitting', function () {
-      const err = new Error('test');
-      core.assess.dataflow.sources.handle.throws(err);
-
-      return simulateRequestScope(async () => {
-        await _exports.parseRequestParams({ method: 'POST' });
-        expect(core.logger.error).to.have.been.calledWith(sinon.match.object, 'unable to handle source');
-      });
-    });
-  });
-
-  describe('createHandler', function () {
-    it('provides the patched default when no parseRequestParams is provided', function () {
-      const handler = _exports.createHandler({ schema: {} });
-      const req = { method: 'POST' };
-
-      return simulateRequestScope(async () => {
-        await handler(req);
-        expect(parseRequestParams).to.have.been.calledWith(req);
-        expect(core.assess.dataflow.sources.handle).to.have.been.called;
-      });
-    });
-
-    it('patches a provided parseRequestParams function', function () {
-      const newParseRequestParams = sinon.stub().resolves({ query: 'query SomethingElse { bar } ' });
-      const handler = _exports.createHandler({ schema: {}, parseRequestParams: newParseRequestParams });
-      const req = { method: 'GET' };
-
-      return simulateRequestScope(async () => {
-        await handler(req);
-        expect(parseRequestParams).not.to.have.been.called;
-        expect(newParseRequestParams).to.have.been.calledWith(req);
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-          data: { query: 'query SomethingElse { bar } ' }
-        });
-      });
-    });
-  });
-});