@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/sources/install/hapi/hapi.test.js

@@ -1,171 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { InputType } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow sources hapi', function () {
-  const hapi = {
-    server(server) {
-      return server;
-    },
-    Server(server) {
-      return server;
-    }
-  };
-
-  const reqMock = {
-    query: { q: 'value' },
-    path: '/uri/{id}',
-    state: { cookie: 'foo' },
-    payload: { foo: 'bar' },
-    params: { p: '1' },
-  };
-
-  const hMock = {
-    continue: sinon.stub()
-  };
-
-  let core, sources, simulateRequestScope;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    core.depHooks.resolve
-      .withArgs({ name: '@hapi/hapi', version: '>=18 <22' })
-      .yields(hapi);
-
-    sources = core.assess.dataflow.sources;
-    sinon.stub(sources, 'handle');
-
-    require('./hapi')(core).install();
-  });
-
-  ['server', 'Server'].forEach((server) => {
-    describe(`${server}`, function () {
-
-      ['onRequest', 'onPostAuth'].forEach((ext) => {
-        it(`logs error when handle fails ${ext}`, function() {
-          simulateRequestScope(() => {
-
-            const err = new Error('Error');
-            const serverInstance = {
-              ext: sinon.stub(),
-            };
-
-            serverInstance.ext.withArgs(ext, sinon.match.func).callsFake((string, method) => {
-              method(reqMock, hMock);
-            });
-
-            sources.handle.throws(err);
-            hapi[server](serverInstance);
-
-            expect(core.logger.error).to.have.been.calledWith({ err, inputType: sinon.match.string, funcKey: `assess-dataflow-source:hapi.${server}` }, 'unable to handle Hapi source');
-          });
-        });
-      });
-
-      it('does not call handle with tracked data onRequest', function() {
-        simulateRequestScope(() => {
-          const sourceContext = core.scopes.sources.getStore()?.assess;
-          sourceContext.parsedQuery = true;
-          sourceContext.parsedPath = true;
-
-          const serverInstance = {
-            ext: sinon.stub(),
-          };
-
-          serverInstance.ext.withArgs('onRequest', sinon.match.func).callsFake((string, method) => {
-            method(reqMock, hMock);
-          });
-
-          hapi[server](serverInstance);
-
-          expect(sources.handle).to.not.have.been.called;
-        });
-      });
-
-      it('calls handle with request data onRequest', function () {
-        simulateRequestScope(() => {
-          const serverInstance = {
-            ext: sinon.stub(),
-          };
-
-          serverInstance.ext.withArgs('onRequest', sinon.match.func).callsFake((string, method) => {
-            method(reqMock, hMock);
-          });
-
-          hapi[server](serverInstance);
-
-          expect(sources.handle).to.have.been.calledWithMatch({
-            context: 'req.query',
-            data: reqMock.query,
-            inputType: InputType.QUERYSTRING,
-            name: 'hapi.onRequest',
-          });
-          expect(sources.handle).to.have.been.calledWithMatch({
-            context: 'req.path',
-            data: reqMock.path,
-            inputType: InputType.URI,
-            name: 'hapi.onRequest',
-          });
-        });
-      });
-
-      it('does not call handle with tracked data onPostAuth', function() {
-        simulateRequestScope(() => {
-          const sourceContext = core.scopes.sources.getStore()?.assess;
-          sourceContext.parsedCookies = true;
-          sourceContext.parsedBody = true;
-          sourceContext.parsedParams = true;
-
-          const serverInstance = {
-            ext: sinon.stub(),
-          };
-
-          serverInstance.ext.withArgs('onPostAuth', sinon.match.func).callsFake((string, method) => {
-            method(reqMock, hMock);
-          });
-
-          hapi[server](serverInstance);
-
-          expect(sources.handle).to.not.have.been.called;
-        });
-      });
-
-      it('calls handle with request data onPostAuth', function () {
-        simulateRequestScope(() => {
-          const serverInstance = {
-            ext: sinon.stub(),
-          };
-
-          serverInstance.ext.withArgs('onPostAuth', sinon.match.func).callsFake((string, method) => {
-            method(reqMock, hMock);
-          });
-
-          hapi[server](serverInstance);
-
-          expect(sources.handle).to.have.been.calledWithMatch({
-            context: 'req.state',
-            data: reqMock.state,
-            inputType: InputType.COOKIE_VALUE,
-            name: 'hapi.onPostAuth',
-          });
-          expect(sources.handle).to.have.been.calledWithMatch({
-            context: 'req.payload',
-            data: reqMock.payload,
-            inputType: InputType.BODY,
-            name: 'hapi.onPostAuth',
-          });
-          expect(sources.handle).to.have.been.calledWithMatch({
-            context: 'req.params',
-            data: reqMock.params,
-            inputType: InputType.URL_PARAMETER,
-            name: 'hapi.onPostAuth',
-          });
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/sources/install/hapi/index.test.js

@@ -1,33 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const proxyquire = require('proxyquire');
-const mocks = require('@contrast/test/mocks');
-
-const moduleMock = (moduleName, mock) => (deps) => {
-  deps.assess.dataflow.sources.hapiInstrumentation[moduleName] = mock[moduleName];
-};
-
-describe('assess dataflow sources Hapi', function () {
-  let core, hapiSourcesMock, hapiSourcesModule, modulesWithInstall;
-
-  beforeEach(function () {
-    core = mocks.core();
-    core.assess = mocks.assess();
-    hapiSourcesMock = core.assess.dataflow.sources.hapiInstrumentation;
-    hapiSourcesModule = proxyquire('.', {
-      './hapi': moduleMock('hapi', hapiSourcesMock)
-    });
-    modulesWithInstall = [
-      'hapi'
-    ];
-  });
-
-  it('installs the components', function () {
-    hapiSourcesModule(core).install();
-
-    modulesWithInstall.forEach((module) => {
-      expect(hapiSourcesMock[module].install).to.have.been.calledOnce;
-    });
-  });
-});

package/lib/dataflow/sources/install/http.test.js

@@ -1,149 +0,0 @@
-'use strict';
-
-const EventEmitter = require('events');
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const mocks = require('@contrast/test/mocks');
-
-describe('assess dataflow sources http', function () {
-  let core, simulateRequestScope, request, response, server;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    request = mocks.incomingMessage();
-    response = mocks.serverResponse();
-
-    class Server extends EventEmitter { }
-    core.depHooks.resolve.withArgs(sinon.match({ name: 'http' })).yields({ Server });
-    core.logger.child = () => core.logger;
-
-    require('./http')(core).install();
-    server = new Server();
-  });
-
-  it('instantiates assess store with appropriate metadata and handles base sources', function (next) {
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.req;
-      server.on('request', test);
-      server.emit('request', request, response);
-    });
-
-    function test(req, res) {
-      const store = core.scopes.sources.getStore()?.assess;
-      // validate store
-      expect(store).to.have.property('propagationEventsCount', 0);
-      // url(1), headers(3), rawHeaders(3)
-      expect(store).to.have.property('sourceEventsCount', 7);
-      expect(store.policy.enabledRules).to.be.a('Set').and.length.greaterThan(5);
-      // should match the mock
-      expect(store.reqData).to.deep.equal({
-        ip: '127.0.0.1',
-        httpVersion: '1.1',
-        method: 'get',
-        headers: {
-          'content-type': 'text/html',
-          language: 'en',
-          referer: 'http://fake.url.foo'
-        },
-        uriPath: '/index',
-        queries: '_id=123',
-        contentType: 'text/html'
-      });
-      expect(store.responseData).to.deep.equal({});
-      // tracked inputs
-      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.ok;
-      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.ok;
-      // patched methods
-      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.true;
-      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.true;
-      response.writeHead(200, { 'content-type': 'application/json' });
-      expect(store.responseData).to.deep.equal({ contentType: 'application/json' });
-      response.setHeader('content-type', 'text/html');
-      expect(store.responseData).to.deep.equal({ contentType: 'text/html' });
-      response.writeHead(); // instrumentation is noop
-      expect(store.responseData).to.deep.equal({ contentType: 'text/html' });
-      next();
-    }
-  });
-
-  it('noop if server event is not type \'request\'', function (next) {
-    simulateRequestScope(() => {
-      server.on('foo', test);
-      server.emit('foo', request, response);
-    });
-
-    function test(req, res) {
-      const store = core.scopes.sources.getStore()?.assess;
-      // // validate store
-      expect(store).to.have.property('propagationEventsCount', 0);
-      expect(store).to.have.property('sourceEventsCount', 0);
-      expect(store.policy.enabledRules).to.be.a('Set').and.length.greaterThan(5);
-      // // tracked inputs
-      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.null;
-      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.null;
-      // // patched methods
-      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.false;
-      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.false;
-      next();
-    }
-  });
-
-  it('logs debug message if there is no async request store', function (next) {
-    server.on('request', test);
-    server.emit('request', request, response);
-
-    function test(req, res) {
-      const store = core.scopes.sources.getStore()?.assess;
-      // validate store
-      expect(store).to.be.undefined;
-      // tracked inputs
-      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.null;
-      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.null;
-      // patched methods
-      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.false;
-      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.false;
-      next();
-    }
-  });
-
-  it('handles a case with an error in the `.handle` method', function (next) {
-    const err = new Error('test');
-    core.assess.dataflow.sources.handle = sinon.stub().throws(err);
-
-    simulateRequestScope(() => {
-      server.on('request', test);
-      server.emit('request', request, response);
-    });
-
-    function test(req, res) {
-      const store = core.scopes.sources.getStore()?.assess;
-      // validate store
-      expect(store).to.have.property('propagationEventsCount', 0);
-      expect(store).to.have.property('sourceEventsCount', 0);
-      expect(store.policy.enabledRules).to.be.a('Set').and.length.greaterThan(5);
-      expect(store.reqData).to.deep.equal({
-        ip: '127.0.0.1',
-        httpVersion: '1.1',
-        method: 'get',
-        headers: {
-          'content-type': 'text/html',
-          language: 'en',
-          referer: 'http://fake.url.foo'
-        },
-        uriPath: '/index',
-        queries: '_id=123',
-        contentType: 'text/html'
-      });
-      expect(store.responseData).to.deep.equal({});
-      // tracked inputs
-      expect(core.assess.dataflow.tracker.getData(request.url)).to.be.null;
-      expect(core.assess.dataflow.tracker.getData(request.headers['content-type'])).to.be.null;
-      // patched methods
-      expect(core.patcher.isContrastHooked(res.writeHead)).to.be.true;
-      expect(core.patcher.isContrastHooked(res.setHeader)).to.be.true;
-      next();
-    }
-  });
-});

package/lib/dataflow/sources/install/koa/index.test.js

@@ -1,40 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const proxyquire = require('proxyquire');
-const mocks = require('@contrast/test/mocks');
-
-const moduleMock = (moduleName, mock) => (deps) => {
-  deps.assess.dataflow.sources.koaInstrumentation[moduleName] = mock[moduleName];
-};
-
-describe('assess dataflow sources koa', function () {
-  let core, koaSourcesMock, koaSourcesModule, modulesWithInstall;
-
-  beforeEach(function () {
-    core = mocks.core();
-    core.assess = mocks.assess();
-    koaSourcesMock = core.assess.dataflow.sources.koaInstrumentation;
-    koaSourcesModule = proxyquire('.', {
-      './koa2': moduleMock('koa2', koaSourcesMock),
-      './koa-bodyparsers': moduleMock('koaBodyparsers', koaSourcesMock),
-      './koa-multer': moduleMock('koaMulter', koaSourcesMock),
-      './koa-routers': moduleMock('koaRouters', koaSourcesMock),
-    });
-    modulesWithInstall = [
-      'koa2',
-      'koaBodyparsers',
-      'koaMulter',
-      'koaRouters',
-    ];
-  });
-
-  it('installs the components', function () {
-    koaSourcesModule(core).install();
-
-    modulesWithInstall.forEach((module) => {
-      expect(koaSourcesMock[module].install).to.have.been.calledOnce;
-    });
-  });
-});
-

package/lib/dataflow/sources/install/koa/koa-bodyparsers.test.js

@@ -1,160 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const koaBodyInstr = require('./koa-bodyparsers');
-
-describe('assess dataflow sources koa-body v5.x.x and koa-bodyparser v4.x.x', function () {
-  let core, simulateRequestScope, koaBodyparserMock, patchedKoaBodyparser, body, sources, nextStub;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sources = core.assess.dataflow.sources;
-    sinon.spy(sources, 'handle');
-
-    body = { parameter: 'parsed' };
-
-    koaBodyparserMock = (body) => (ctx, next) => {
-      ctx.request.body = body;
-      next();
-    };
-    nextStub = sinon.stub();
-    sinon.spy(core.patcher, 'patch');
-
-    koaBodyInstr(core).install();
-    patchedKoaBodyparser = core.depHooks.resolve.yield(koaBodyparserMock)[0];
-    core.patcher.patch.resetHistory();
-  });
-
-  it('calls patcher on the `koa-body` and `koa-bodyparser` module exports', function () {
-    core.depHooks.resolve.yield(koaBodyparserMock);
-
-    expect(core.patcher.patch).to.have.been.calledTwice;
-    expect(core.patcher.patch).to.have.been.calledWithMatch(koaBodyparserMock, {
-      name: 'koa-body',
-      patchType: 'assess-dataflow-source',
-      post: sinon.match.func
-    });
-    expect(core.patcher.patch).to.have.been.calledWithMatch(koaBodyparserMock, {
-      name: 'koa-bodyparser',
-      patchType: 'assess-dataflow-source',
-      post: sinon.match.func
-    });
-  });
-
-  it('calls `.handle` when parsing body is successful and in right context', function () {
-    let scCall1, scCall2, scCall3;
-
-    simulateRequestScope(() => {
-      const bParser = patchedKoaBodyparser(body);
-      bParser({ request: { body: {} } }, nextStub);
-
-      scCall1 = core.scopes.sources.getStore()?.assess;
-    });
-    simulateRequestScope(() => {
-      scCall2 = core.scopes.sources.getStore()?.assess;
-      scCall2.reqData.headers = {
-        'content-type': 'application/json'
-      };
-
-      const bParser = patchedKoaBodyparser(body);
-      bParser({ request: {} }, nextStub);
-    });
-    simulateRequestScope(() => {
-      const bParser = patchedKoaBodyparser('non-object-body');
-      bParser({ request: {} }, nextStub);
-
-      scCall3 = core.scopes.sources.getStore()?.assess;
-    });
-
-
-    expect(core.patcher.patch).to.have.been.calledThrice;
-    expect(core.patcher.patch).to.have.been.calledWithMatch(sinon.match.func, {
-      name: 'koa-body',
-      patchType: 'assess-dataflow-source',
-      pre: sinon.match.func
-    });
-
-    expect(nextStub).to.have.been.calledThrice;
-    expect(sources.handle).to.have.been.calledThrice;
-    expect(sources.handle).to.have.been.calledWithMatch({
-      context: 'ctx.request.body',
-      name: 'koa-body',
-      stacktraceOpts: {
-        constructorOpt: sinon.match.func,
-      },
-      inputType: InputType.PARAMETER_VALUE,
-      data: { parameter: 'parsed' },
-      sourceContext: scCall1
-    });
-    expect(sources.handle).to.have.been.calledWithMatch({
-      context: 'ctx.request.body',
-      name: 'koa-body',
-      stacktraceOpts: {
-        constructorOpt: sinon.match.func,
-      },
-      inputType: InputType.JSON_VALUE,
-      data: { parameter: 'parsed' },
-      sourceContext: scCall2
-    });
-    expect(sources.handle).to.have.been.calledWithMatch({
-      context: 'ctx.request.body',
-      name: 'koa-body',
-      stacktraceOpts: {
-        constructorOpt: sinon.match.func,
-      },
-      inputType: InputType.BODY,
-      data: 'non-object-body',
-      sourceContext: scCall3
-    });
-  });
-
-  it('does not call `.handle` when there is no assess policy in request context', function () {
-    simulateRequestScope(() => {
-      const cParser = patchedKoaBodyparser(body);
-      cParser({ request: {} }, nextStub);
-    }, { assess: { policy: null } });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(nextStub).to.have.been.calledOnce;
-  });
-
-  it('does not call `.handle` when the values are already tracked', function () {
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedBody = true;
-
-      const cParser = patchedKoaBodyparser(body);
-      cParser({ request: {} }, nextStub);
-    });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(core.logger.trace).to.have.been.calledWith(
-      { funcKey: 'assess-dataflow-source:koa-body' },
-      'values already tracked',
-    );
-    expect(nextStub).to.have.been.calledOnce;
-  });
-
-  it('handles a case with an error in the `.handle` method', function () {
-    const err = new Error('test');
-
-    core.assess.dataflow.sources.handle = () => {
-      throw err;
-    };
-
-    simulateRequestScope(() => {
-      const cParser = patchedKoaBodyparser(body);
-      cParser({ request: {} }, nextStub);
-    });
-
-    expect(core.logger.error).to.have.been.calledWith(
-      { err, inputType: InputType.PARAMETER_VALUE, funcKey: 'assess-dataflow-source:koa-body' },
-      'unable to handle Koa source',
-    );
-    expect(nextStub).to.have.been.calledOnce;
-    expect(nextStub).not.to.have.been.calledWith(err);
-  });
-});