@contrast/assess 1.46.0 → 1.46.2

package/lib/dataflow/sources/install/qs6.test.js

@@ -1,131 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const qsInstr = require('./qs6');
-
-describe('assess dataflow sources qs v6.x', function () {
-  let core, simulateRequestScope, qsMock, patchedQs, query, sources;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sources = core.assess.dataflow.sources;
-    sinon.spy(sources, 'handle');
-
-    query = 'querystring';
-    qsMock = {
-      parse: (query) => ({ query } || {})
-    };
-    sinon.spy(core.patcher, 'patch');
-
-    qsInstr(core).install();
-    patchedQs = core.depHooks.resolve.yield(qsMock)[0];
-    core.patcher.patch.resetHistory();
-  });
-
-  it('calls patcher on the `.parse` method', function () {
-    core.depHooks.resolve.yield(qsMock);
-
-    expect(core.patcher.patch).to.have.been.calledOnce;
-    expect(core.patcher.patch).to.have.been.calledWithMatch(qsMock, 'parse', {
-      name: 'qs.parse',
-      patchType: 'assess-dataflow-source',
-      post: sinon.match.func
-    });
-  });
-
-  it('calls `.handle` when parsing is successful, in right context and with reqData.queries present', function () {
-    let sourceContext;
-
-    simulateRequestScope(() => {
-      sourceContext = core.scopes.sources.getStore()?.assess;
-
-      Object.assign(sourceContext.reqData, {
-        queries: 'querystring'
-      });
-      patchedQs.parse(query);
-    });
-
-    expect(sources.handle).to.have.been.calledOnce;
-    expect(sources.handle).to.have.been.calledWithMatch({
-      context: 'req.query',
-      name: 'qs.parse',
-      stacktraceOpts: {
-        constructorOpt: sinon.match.func,
-      },
-      inputType: InputType.QUERYSTRING,
-      data: { query: 'querystring' },
-      sourceContext
-    });
-  });
-
-  it('does not call `.handle` when parsing is successful, in right context but with reqData.queries not present', function () {
-    simulateRequestScope(() => {
-      patchedQs.parse(query);
-    });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(core.logger.debug).not.to.have.been.called;
-  });
-
-  it('does not call `.handle` when not in context', function () {
-    simulateRequestScope(() => {
-      patchedQs.parse(query);
-    }, {});
-
-    expect(sources.handle).not.to.have.been.called;
-  });
-
-  it('does not call `.handle` when the values are already tracked', function () {
-    simulateRequestScope(() => {
-      const sourceContext = core.scopes.sources.getStore()?.assess;
-      sourceContext.parsedQuery = true;
-
-      patchedQs.parse(query);
-    });
-
-    expect(sources.handle).not.to.have.been.called;
-    expect(core.logger.trace).to.have.been.calledWith(
-      { inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:qs.parse' },
-      'values already tracked',
-    );
-  });
-
-  it('does not call `.handle` when `qs` does not return a result', function () {
-    simulateRequestScope(() => {
-      const sourceContext = core.scopes.sources.getStore()?.assess;
-
-      Object.assign(sourceContext.reqData, {
-        queries: 'querystring'
-      });
-      patchedQs.parse(null);
-    });
-
-    expect(sources.handle).not.to.have.been.called;
-  });
-
-  it('handles a case with an error in the `.handle` method', function () {
-    const err = new Error('test');
-
-    core.assess.dataflow.sources.handle = () => {
-      throw err;
-    };
-
-    simulateRequestScope(() => {
-      const sourceContext = core.scopes.sources.getStore()?.assess;
-
-      Object.assign(sourceContext.reqData, {
-        queries: 'querystring'
-      });
-      patchedQs.parse(query);
-    });
-
-    expect(core.logger.error).to.have.been.calledWith(
-      { err, inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:qs.parse' },
-      'unable to handle source',
-    );
-  });
-});

package/lib/dataflow/sources/install/querystring.test.js

@@ -1,82 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-
-describe('assess dataflow sources querystring', function () {
-  let core, simulateRequestScope, querystring;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    const querystringMock = {
-      parse: (query) => ({ query })
-    };
-
-    require('./querystring')(core).install();
-    querystring = core.depHooks.resolve.yield(querystringMock)[0];
-  });
-
-  it('calls `.handle` when parsing is successful, in right context and with reqData.queries present', function () {
-    simulateRequestScope(() => {
-      querystring.parse('query');
-
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
-        context: 'req.query',
-        name: 'querystring.parse',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-          prependFrames: sinon.match.array,
-        },
-        inputType: InputType.QUERYSTRING,
-        data: { query: 'query' },
-        sourceContext: core.scopes.sources.getStore().assess
-      });
-    }, { assess: { reqData: { queries: 'query' } } });
-  });
-
-  it('does not call `.handle` when parsing is successful, in right context but without matching reqData.queries', function () {
-    simulateRequestScope(() => {
-      querystring.parse('query1');
-
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    }, { assess: { reqData: { queries: 'query2' } } });
-  });
-
-  it('does not call `.handle` when not in context', function () {
-    simulateRequestScope(() => {
-      querystring.parse('query');
-
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-    }, {});
-  });
-
-  it('does not call `.handle` when the values are already tracked', function () {
-    simulateRequestScope(() => {
-      querystring.parse('query');
-
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:querystring.parse' },
-        'values already tracked'
-      );
-    }, { assess: { parsedQuery: true } });
-  });
-
-  it('handles a case with an error in the `.handle` method', function () {
-    const err = new Error('test');
-    core.assess.dataflow.sources.handle.throws(err);
-
-    simulateRequestScope(() => {
-      querystring.parse('query');
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:querystring.parse' },
-        'unable to handle source'
-      );
-    }, { assess: { reqData: { queries: 'query' } } });
-  });
-});

package/lib/dataflow/sources/install/restify/fieldedTextBodyParser.test.js

@@ -1,86 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { InputType } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const init = require('./fieldedTextBodyParser');
-
-describe('assess dataflow sources restify fieldedTextBodyParser', function () {
-  let core, simulateRequestScope, handle, middleware, req, res, next;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    handle = sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    let fieldedTextBodyParserStub = sinon.stub().returns(sinon.stub().callsArg(2));
-
-    req = {};
-    res = {};
-    next = sinon.stub();
-
-    core.depHooks.resolve
-      .withArgs({ name: 'restify', file: 'lib/plugins/fieldedTextBodyParser.js', version: '>=8 <12' })
-      .callsFake((_, cb) => {
-        fieldedTextBodyParserStub = cb(fieldedTextBodyParserStub);
-      });
-
-    init(core).install();
-    middleware = fieldedTextBodyParserStub();
-  });
-
-  it('does not call `handle` when there is no assess policy in request context', function () {
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(handle).not.to.have.been.called;
-    }, { assess: { policy: null } });
-  });
-
-  it('does not handle source when body is already tracked', function () {
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedBody = true;
-
-      middleware(req, res, next);
-
-      expect(handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:restify.plugins.fieldedTextBodyParser.parseFieldedText' },
-        'values already tracked'
-      );
-    });
-  });
-
-  it('calls `handle` appropriately', function () {
-    req.body = [{ foo: 'bar' }];
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(handle).to.have.been.calledWith({
-        context: 'req.body',
-        data: req.body,
-        inputType: InputType.BODY,
-        name: 'restify.plugins.fieldedTextBodyParser.parseFieldedText',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        sourceContext: sinon.match.object,
-      });
-    });
-  });
-
-  it('logs errors in the `handle` method', function () {
-    const err = new Error('yikes!');
-    handle.throws(err);
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:restify.plugins.fieldedTextBodyParser.parseFieldedText' },
-        'unable to handle Restify source',
-      );
-    });
-  });
-});

package/lib/dataflow/sources/install/restify/index.test.js

@@ -1,38 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const proxyquire = require('proxyquire');
-const mocks = require('@contrast/test/mocks');
-
-const moduleMock = (moduleName, mock) => (deps) => {
-  deps.assess.dataflow.sources.restifyInstrumentation[moduleName] = mock[moduleName];
-};
-
-describe('assess dataflow sources restify', function () {
-  let core, restifyInstrumentation, init, modules;
-
-  beforeEach(function () {
-    core = mocks.core();
-    core.assess = mocks.assess();
-    restifyInstrumentation = core.assess.dataflow.sources.restifyInstrumentation;
-    init = proxyquire('.', {
-      './fieldedTextBodyParser': moduleMock('fieldedTextBodyParser', restifyInstrumentation),
-      './jsonBodyParser': moduleMock('jsonBodyParser', restifyInstrumentation),
-      './router': moduleMock('router', restifyInstrumentation),
-    });
-    modules = [
-      'fieldedTextBodyParser',
-      'jsonBodyParser',
-      'router',
-    ];
-  });
-
-  it('installs the components', function () {
-    init(core).install();
-
-    modules.forEach((module) => {
-      expect(restifyInstrumentation[module].install).to.have.been.calledOnce;
-    });
-  });
-});
-

package/lib/dataflow/sources/install/restify/jsonBodyParser.test.js

@@ -1,140 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { InputType } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const init = require('./jsonBodyParser');
-
-describe('assess dataflow sources restify jsonBodyParser', function () {
-  let core, simulateRequestScope, handle, jsonBodyParserStub, req, res, next;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    handle = sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    jsonBodyParserStub = sinon.stub().returns([
-      sinon.stub(),
-      sinon.stub().callsArg(2),
-    ]);
-
-    req = {};
-    res = {};
-    next = sinon.stub();
-
-    core.depHooks.resolve
-      .withArgs({ name: 'restify', file: 'lib/plugins/jsonBodyParser.js', version: '>=8 <12' })
-      .callsFake((_, cb) => {
-        jsonBodyParserStub = cb(jsonBodyParserStub);
-      });
-
-    init(core).install();
-  });
-
-  it('does not handle source when there is no assess policy in request context', function () {
-    const [, middleware] = jsonBodyParserStub();
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-      expect(handle).not.to.have.been.called;
-    }, { assess: { policy: null } });
-  });
-
-  it('does not call `handle` when body is already tracked', function () {
-    const [, middleware] = jsonBodyParserStub();
-
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedBody = true;
-      middleware(req, res, next);
-
-      expect(handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:restify.plugins.jsonBodyParser.parseJson' },
-        'values already tracked'
-      );
-    });
-  });
-
-  it('calls `handle` appropriately', function () {
-    const [, middleware] = jsonBodyParserStub();
-    req.body = { foo: 'bar' };
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(handle).to.have.been.calledOnceWith({
-        context: 'req.body',
-        data: req.body,
-        inputType: InputType.JSON_VALUE,
-        name: 'restify.plugins.jsonBodyParser.parseJson',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        sourceContext: sinon.match.object,
-      });
-    });
-  });
-
-  it('calls `handle` twice if `mapParams` is set', function () {
-    const [, middleware] = jsonBodyParserStub({ mapParams: true });
-    req.body = { foo: 'bar' };
-    req.params = req.body;
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(handle).to.have.callCount(2);
-      expect(handle).to.have.been.calledWith({
-        context: 'req.body',
-        data: req.body,
-        inputType: InputType.JSON_VALUE,
-        name: 'restify.plugins.jsonBodyParser.parseJson',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        sourceContext: sinon.match.object,
-      });
-      expect(handle).to.have.been.calledWith({
-        context: 'req.params',
-        data: req.params,
-        inputType: InputType.JSON_VALUE,
-        name: 'restify.plugins.jsonBodyParser.parseJson',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        sourceContext: sinon.match.object,
-      });
-    });
-  });
-
-
-  it('logs errors in the `handle` method', function () {
-    const [, middleware] = jsonBodyParserStub();
-    const err = new Error('yikes!');
-    handle.throws(err);
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:restify.plugins.jsonBodyParser.parseJson' },
-        'unable to handle Restify source',
-      );
-    });
-  });
-
-  it('logs errors in the `handle` method 2 ', function () {
-    const [, middleware] = jsonBodyParserStub({ mapParams: true });
-    const err = new Error('yikes!');
-    handle.onCall(1).throws(err);
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:restify.plugins.jsonBodyParser.parseJson' },
-        'unable to handle Restify source',
-      );
-    });
-  });
-});

package/lib/dataflow/sources/install/restify/router.test.js

@@ -1,81 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { InputType } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const init = require('./router');
-
-describe('assess dataflow sources restify router', function () {
-  let core, simulateRequestScope, handle, Router, req;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    handle = sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    Router = { prototype: { lookup: sinon.stub() } };
-    req = {};
-
-    core.depHooks.resolve
-      .withArgs({ name: 'restify', file: 'lib/router.js', version: '>=8 <12' })
-      .yields(Router);
-
-    init(core).install();
-  });
-
-  it('does not call `handle` when there is no assess policy in request context', function () {
-    simulateRequestScope(() => {
-      Router.prototype.lookup(req);
-
-      expect(handle).not.called;
-      expect(core.logger.trace.callCount).greaterThan(0);
-      expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
-    }, { assess: { policy: null } });
-  });
-
-  it('does not call `handle` when body is already tracked', function () {
-    simulateRequestScope(() => {
-      Router.prototype.lookup(req);
-
-      expect(handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:restify.Router.prototype.lookup' },
-        'values already tracked'
-      );
-    }, { assess: { parsedParams: true } });
-  });
-
-  it('calls `handle` appropriately', function () {
-    req.params = { foo: 'bar' };
-
-    simulateRequestScope(() => {
-      Router.prototype.lookup(req);
-
-      expect(handle).to.have.been.calledWith({
-        context: 'req.params',
-        data: req.params,
-        inputType: InputType.URL_PARAMETER,
-        name: 'restify.Router.prototype.lookup',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-          prependFrames: [sinon.match.func],
-        },
-        sourceContext: sinon.match.object,
-      });
-    });
-  });
-
-  it('logs errors in the `handle` method', function () {
-    const err = new Error('yikes!');
-    handle.throws(err);
-
-    simulateRequestScope(() => {
-      Router.prototype.lookup(req);
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:restify.Router.prototype.lookup' },
-        'unable to handle Restify source',
-      );
-    });
-  });
-});

package/lib/dataflow/tag-utils-complete.test.js

@@ -1,27 +0,0 @@
-/* eslint-disable */
-
-'use strict';
-
-const { expect } = require('chai');
-const utils = require('./tag-utils');
-
-const parsed = require('@contrast/test/data/tag-util-args-and-results');
-
-describe('assess dataflow tag-utils - verify all existing usage', function() {
- for (const test in parsed) {
-   const fnName = test.slice(0, -4);
-   const { lines, tests } = parsed[test];
-   describe(fnName, function() {
-     if (!utils[fnName]) {
-       throw new Error(`No test for ${fnName}`);
-     }
-     for (let i = 0; i < tests.length; i++) {
-       it(lines[i], function() {
-         const { args, ret } = tests[i];
-         const r = utils[fnName](...args);
-         expect(r).to.deep.equal(ret);
-       });
-     }
-   });
- }
-});