@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/propagation/install/contrast-methods/string.test.js

@@ -1,148 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { DataflowTag } = require('@contrast/common');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation String', function () {
-  let core, trackString, simulateRequestScope, tracker;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    core.contrastMethods.install();
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.string.install();
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  describe('base cases', function () {
-
-    it('null', function () {
-      expect(global.ContrastMethods.String(null)).to.equal('null');
-      expect(global.ContrastMethods.String(undefined)).to.equal('undefined');
-    });
-
-    it('number', function () {
-      expect(global.ContrastMethods.String(42)).to.equal('42');
-    });
-
-    it('boolean', function () {
-      expect(global.ContrastMethods.String(false)).to.equal('false');
-    });
-
-    it('Object.create(null) with no toString throws an error', function () {
-      const obj = Object.create(null);
-      expect(() => {
-        global.ContrastMethods.String(obj);
-      }).to.throw(TypeError);
-    });
-
-  });
-
-  describe('propagation', function () {
-    it('non-string does not propagate', function () {
-      simulateRequestScope(function () {
-        const extern = trackString({});
-
-        const result = global.ContrastMethods.String(extern);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-
-    it('untracked string does not propagate', function () {
-      simulateRequestScope(function () {
-        const result = global.ContrastMethods.String('foo');
-        expect(result).to.equal('foo');
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-
-    it('tracked string propagates', function () {
-      simulateRequestScope(function () {
-        const extern = trackString('foo');
-
-        const result = global.ContrastMethods.String(extern);
-        expect(result).to.equal('foo');
-        expect(tracker.getData(result).tags).to.deep.equal({
-          [DataflowTag.UNTRUSTED]: [0, 2],
-          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
-        });
-      });
-    });
-
-    it('toString propagates', function () {
-      simulateRequestScope(function () {
-        const extern = trackString('foo');
-
-        const result = global.ContrastMethods.String(extern).toString();
-        expect(result).to.equal('foo');
-        expect(tracker.getData(result).tags).to.deep.equal({
-          [DataflowTag.UNTRUSTED]: [0, 2],
-          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
-        });
-      });
-    });
-
-    it('tracked string propagates copy', function () {
-      simulateRequestScope(function () {
-        const extern = trackString('foo');
-
-        const result = new global.ContrastMethods.String(extern.substring(0, extern.length)).toString();
-        expect(result).to.equal('foo');
-        expect(tracker.getData(result).tags).to.deep.equal({
-          [DataflowTag.UNTRUSTED]: [0, 2],
-          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
-        });
-      });
-    });
-
-    it('object with a custom toString propagates', function () {
-      simulateRequestScope(function () {
-        const extern = trackString('foo');
-        const string = new String({
-          toString() {
-            return extern;
-          }
-        });
-
-        const result = global.ContrastMethods.String(string);
-        expect(result).to.equal('foo');
-        expect(tracker.getData(result).tags).to.deep.equal({
-          [DataflowTag.UNTRUSTED]: [0, 2],
-          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
-        });
-      });
-    });
-
-    it('class with a custom toString propagates', function () {
-      simulateRequestScope(function () {
-        const extern = trackString('foo');
-        class Test {
-          constructor() {
-            this.tracked = extern;
-          }
-
-          toString() {
-            return this.tracked;
-          }
-        }
-        const test = new Test();
-        const result = global.ContrastMethods.String(test);
-        expect(result).to.equal('foo');
-        expect(tracker.getData(result).tags).to.deep.equal({
-          [DataflowTag.UNTRUSTED]: [0, 2],
-          [DataflowTag.STRING_TYPE_CHECKED]: [0, 2]
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/contrast-methods/tag.test.js

@@ -1,145 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const {
-  DataflowTag: {
-    UNTRUSTED,
-  }
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation contrast-methods tag', function () {
-  let core, simulateRequestScope, trackString, tracker;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-
-    // We're effectively testing that `ContrastMethods.tag` delegates
-    // propagation to `String.prototype.concat` correctly.
-    core.contrastMethods.install();
-    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.tag.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.tag.uninstall();
-    core.assess.dataflow.propagation.stringInstrumentation.concat.uninstall();
-  });
-
-  const bar = () => trackString('bar');
-  const baz = () => 'baz';
-
-  [
-    {
-      name: '`foo${bar}`',
-      context: '`foo${expr0}`',
-      strings: ['foo', ''],
-      args: [bar],
-      expected: {
-        [UNTRUSTED]: [3, 5],
-      },
-      history: 1,
-    },
-    {
-      name: '`foo${bar}boo`',
-      context: '`foo${expr0}boo`',
-      strings: ['foo', 'boo'],
-      args: [bar],
-      expected: {
-        [UNTRUSTED]: [3, 5],
-      },
-      history: 1,
-    },
-    {
-      name: '`foo${baz}boo${bar}`',
-      context: '`foo${expr0}boo${expr1}`',
-      strings: ['foo', 'boo', ''],
-      args: [baz, bar],
-      expected: {
-        [UNTRUSTED]: [9, 11],
-      },
-      history: 1,
-    },
-    {
-      name: '`foo${bar}boo${bar}.`',
-      context: '`foo${expr0}boo${expr1}.`',
-      strings: ['foo', 'boo', '.'],
-      args: [bar, bar],
-      expected: {
-        [UNTRUSTED]: [3, 5, 9, 11],
-      },
-      history: 2,
-    },
-    {
-      name: '`foo${concat}`',
-      context: '`foo${expr0}`',
-      strings: ['foo', ''],
-      args: [() => trackString('con').concat(trackString('cat'))],
-      expected: {
-        [UNTRUSTED]: [3, 8],
-      },
-      history: 1,
-    },
-    {
-      name: '`foo${bar}boo${bar}baz{$bar}.`',
-      context: '`foo${expr0}boo${expr1}baz${expr2}.`',
-      strings: ['foo', 'boo', 'baz', '.'],
-      args: [bar, bar, bar],
-      expected: {
-        [UNTRUSTED]: [3, 5, 9, 11, 15, 17],
-      },
-      history: 3,
-    },
-  ].forEach(({ name, context, strings, args, expected, history }) => {
-    it(`propagates ${name} correctly`, function () {
-      simulateRequestScope(() => {
-        const result = global.ContrastMethods.tag(
-          strings,
-          ...args.map(Reflect.apply),
-        );
-
-        const data = tracker.getData(result);
-        expect(data).to.have.property('tags').that.deep.equals(expected);
-        expect(data).to.have.property('name', 'ContrastMethods.tag');
-        expect(data).to.have.property('history').with.length(history);
-        expect(data).to.have.property('context').that.equals(context);
-        expect(data).to.have.property('moduleName').that.equals('global');
-        expect(data).to.have.property('methodName').that.equals('ContrastMethods.tag');
-      });
-    });
-  });
-
-  /*
-   * name: '`${bar}`',
-   * strings: ['', ''],
-   * args: [bar],
-   */
-  it('handles the `${bar}` edge case appropriately', function () {
-    simulateRequestScope(() => {
-      const result = global.ContrastMethods.tag(['', ''], trackString('bar'));
-      const data = tracker.getData(result);
-      expect(data)
-        .to.have.property('tags')
-        .that.deep.equals({ [UNTRUSTED]: [0, 2] });
-      expect(data).to.have.property('name', 'assess-dataflow-fixture');
-      expect(data).not.to.have.property('history');
-    });
-  });
-
-  it('does not propagate if args are untracked', function () {
-    simulateRequestScope(() => {
-      const result = global.ContrastMethods.tag(['', ''], 'bar');
-      const data = tracker.getData(result);
-      expect(data).to.be.null;
-    });
-  });
-
-  it('does not propagate if no assess policy in request store', function () {
-    simulateRequestScope(() => {
-      const result = global.ContrastMethods.tag(['', ''], trackString('bar'));
-      const data = tracker.getData(result);
-      expect(data).to.be.null;
-    }, { assess: { policy: null } });
-  });
-});

package/lib/dataflow/propagation/install/decode-uri-component.test.js

@@ -1,78 +0,0 @@
-
-'use strict';
-
-const {
-  DataflowTag: { UNTRUSTED, URL_ENCODED }
-} = require('@contrast/common');
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation decodeURIComponent', function () {
-  let core, trackString, simulateRequestScope, tracker;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.decodeURIComponent.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.decodeURIComponent.uninstall();
-    sinon.resetHistory();
-  });
-
-  [
-    {
-      str: '%3Ftest%3Dstr',
-      tags: {
-        [UNTRUSTED]: [0, 12],
-        [URL_ENCODED]: [0, 12]
-      },
-      expected: { [UNTRUSTED]: [0, 8] }
-    },
-    {
-      str: '?test=str',
-      tags: {
-        [UNTRUSTED]: [0, 8]
-      },
-      expected: { [UNTRUSTED]: [0, 8] }
-    },
-    {
-      str: 'not-tracked',
-    }
-  ].forEach(({ str, tags, expected }) => {
-    it('propagates correctly', function () {
-      simulateRequestScope(function () {
-        const value = tags ? trackString(str, { tags }) : str;
-
-        const result = decodeURIComponent(value);
-        const strInfo = tracker.getData(result);
-        expect(strInfo?.tags).to.deep.equal(expected);
-      });
-    });
-  });
-
-  it('will not propagate if there is no assess context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('%3Ftest%3Dstr');
-      const result = decodeURIComponent(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('%3Ftest%3Dstr');
-        const result = decodeURIComponent(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/ejs/escape-xml.test.js

@@ -1,69 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const {
-  DataflowTag: { UNTRUSTED, WEAK_URL_ENCODED }
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation ejs.utils.escapeXML', function () {
-  let core, trackString, simulateRequestScope, tracker, mockEjsUtils;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    mockEjsUtils = {
-      escapeXML: (str) => `mock-escapeXML_${str}_mock-escapeXML`
-    };
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.ejsInstrumentation.escapeXML.install();
-    core.depHooks.resolve.yield(mockEjsUtils);
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  it('propagates correctly', function () {
-    simulateRequestScope(function () {
-      const notTrackedValue = 'foo';
-      const trackedValue = trackString('foo');
-
-      const notTrackedResult = mockEjsUtils.escapeXML(notTrackedValue);
-      const notTrackedStrInfo = tracker.getData(notTrackedResult);
-
-      const trackedResult = mockEjsUtils.escapeXML(trackedValue);
-      const trackedStrInfo = tracker.getData(trackedResult);
-
-      expect(notTrackedStrInfo).to.be.null;
-      expect(trackedStrInfo?.tags).to.deep.equal({
-        [UNTRUSTED]: [0, trackedStrInfo?.value.length - 1],
-        [WEAK_URL_ENCODED]: [0, trackedStrInfo?.value.length - 1]
-      });
-    });
-  });
-
-  it('will not propagate if there is no assess policy in request context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('foo');
-      const result = mockEjsUtils.escapeXML(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('foo');
-        const result = mockEjsUtils.escapeXML(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/ejs/template.test.js

@@ -1,62 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation ejs.Template', function () {
-  let core, trackString, simulateRequestScope, MockEjsTemplate;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    MockEjsTemplate = function (source) {
-      this.source = source;
-    };
-
-    MockEjsTemplate.prototype.generateSource = function() {
-    };
-
-    core.depHooks.resolve.withArgs({ name: 'ejs', version: '>=2.6.2 <4' }).yields({ Template: MockEjsTemplate });
-    core.assess.dataflow.propagation.ejsInstrumentation.template.install();
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  it('template.generateSource() will generate rewritten \'.source\' code value', function () {
-    simulateRequestScope(function () {
-      const t = new MockEjsTemplate(trackString('a + b'));
-      t.generateSource();
-
-      [
-        'function __append(s) {',
-        'if (ContrastMethods.notEqEq(s, undefined) && ContrastMethods.notEqEq(s, null)) __output = ContrastMethods.addAssign(__output, s);',
-        '}',
-        'ContrastMethods.add(a, b);',
-        'return __output',
-      ].forEach((l) => expect(t.source).to.include(l));
-    });
-  });
-
-  it('will not rewrite content if not in source scope', function () {
-    const t = new MockEjsTemplate(trackString('a + b'));
-    t.generateSource();
-    expect(t.source).to.not.include('ContrastMethods');
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const t = new MockEjsTemplate(trackString('a + b'));
-        t.generateSource();
-        expect(t.source).to.not.include('ContrastMethods');
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/encode-uri.test.js

@@ -1,83 +0,0 @@
-
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const {
-  DataflowTag: { UNTRUSTED, URL_ENCODED, WEAK_URL_ENCODED }
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation encodeURI, encodeURIComponent', function () {
-  let core, trackString, simulateRequestScope, tracker;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.encodeURI.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.encodeURI.uninstall();
-    sinon.resetHistory();
-  });
-
-  it('will not propagate if there is no assess policy in request context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('?test=str');
-      const result = encodeURIComponent(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('?test=str');
-        const result = encodeURIComponent(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-
-  it('does not propagate untracked string', function () {
-    simulateRequestScope(function () {
-      const value = '?test=str';
-      const result = encodeURIComponent(value);
-      expect(tracker.getData(result)).to.be.null;
-    });
-  });
-
-  it('encodeURIComponent propagates correctly', function () {
-    simulateRequestScope(function () {
-      const value = trackString('?test=str');
-
-      const result = encodeURIComponent(value);
-      expect(result).to.be.equal('%3Ftest%3Dstr');
-      const strInfo = tracker.getData(result);
-      expect(strInfo?.tags).to.deep.equal({
-        [UNTRUSTED]: [3, 6, 10, 12],
-        [URL_ENCODED]: [0, 12]
-      });
-    });
-  });
-
-  it('encodeURI propagates correctly', function () {
-    simulateRequestScope(function () {
-      const value = trackString('http://foo.org/?tëst=str');
-
-      const result = encodeURI(value);
-      expect(result).to.be.equal('http://foo.org/?t%C3%ABst=str');
-      const strInfo = tracker.getData(result);
-      expect(strInfo?.tags).to.deep.equal({
-        [UNTRUSTED]: [0, 16, 23, 28],
-        [WEAK_URL_ENCODED]: [0, 28]
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/escape-html.test.js

@@ -1,71 +0,0 @@
-'use strict';
-
-const {
-  DataflowTag: { UNTRUSTED, HTML_ENCODED }
-} = require('@contrast/common');
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation escape-html', function () {
-  let core, trackString, simulateRequestScope, tracker, mockEscapeHtml, patchedEscapeHtml;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    mockEscapeHtml = (str) => `mock-escape_${str}_mock-escape`;
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.escapeHtml.install();
-    patchedEscapeHtml = core.depHooks.resolve.yield(mockEscapeHtml)[0];
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  it('will not propagate if there is no assess policy in request context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('<script>alert("hello");</script>');
-      const result = patchedEscapeHtml(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('<script>alert("hello");</script>');
-        const result = patchedEscapeHtml(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-
-  it('will not propagate if string is not tracked', function () {
-    simulateRequestScope(function () {
-      const value = '<script>alert("hello");</script>';
-      const result = patchedEscapeHtml(value);
-      expect(tracker.getData(result)).to.be.null;
-    });
-  });
-
-
-  it('patchedEscapeHtml propagates correctly', function () {
-    simulateRequestScope(function () {
-      const value = trackString('<script>alert("hello");</script>');
-      const result = patchedEscapeHtml(value);
-      const strInfo = tracker.getData(result);
-
-      expect(result).to.be.equal('mock-escape_<script>alert("hello");</script>_mock-escape');
-      expect(strInfo?.tags).to.deep.equal({
-        [UNTRUSTED]: [12, 43],
-        [HTML_ENCODED]: [0, 55]
-      });
-    });
-  });
-});