@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/propagation/install/pug-runtime-escape.test.js

@@ -1,69 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const {
-  DataflowTag: { UNTRUSTED, WEAK_URL_ENCODED }
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation pugRuntime.escape', function () {
-  let core, trackString, simulateRequestScope, tracker, mockPugRuntime;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    mockPugRuntime = {
-      escape: (str) => `mock-escape_${str}_mock-escape`
-    };
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.pugRuntimeEscape.install();
-    core.depHooks.resolve.yield(mockPugRuntime);
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  it('propagates correctly', function () {
-    simulateRequestScope(function () {
-      const notTrackedValue = 'foo';
-      const trackedValue = trackString('foo');
-
-      const notTrackedResult = mockPugRuntime.escape(notTrackedValue);
-      const notTrackedStrInfo = tracker.getData(notTrackedResult);
-
-      const trackedResult = mockPugRuntime.escape(trackedValue);
-      const trackedStrInfo = tracker.getData(trackedResult);
-
-      expect(notTrackedStrInfo).to.be.null;
-      expect(trackedStrInfo?.tags).to.deep.equal({
-        [UNTRUSTED]: [0, trackedStrInfo.value.length - 1],
-        [WEAK_URL_ENCODED]: [0, trackedStrInfo.value.length - 1]
-      });
-    });
-  });
-
-  it('will not propagate if there is no assess context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('foo');
-      const result = mockPugRuntime.escape(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('foo');
-        const result = mockPugRuntime.escape(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/querystring/escape.test.js

@@ -1,63 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { DataflowTag: { URL_ENCODED, UNTRUSTED } } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation querystring escape', function () {
-  let core, simulateRequestScope, tracker, trackString, querystring;
-
-  const baseEvent = {
-    moduleName: 'querystring',
-    methodName: 'escape',
-    object: { tracked: false, value: 'querystring' },
-    source: 'P',
-    target: 'R',
-  };
-
-  before(function () {
-    ({ core, trackString, simulateRequestScope } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-
-    querystring = require('querystring');
-    core.depHooks.resolve.yields(querystring);
-
-    core.assess.dataflow.propagation.querystringInstrumentation.escape.install();
-  });
-
-  after(function () {
-    core.assess.dataflow.propagation.querystringInstrumentation.escape.uninstall();
-  });
-
-  it('propagates to entire result when value is escaped and modified', function () {
-    simulateRequestScope(() => {
-      const str = trackString('😺');
-      const result = querystring.escape(str);
-      const strInfo = tracker.getData(result);
-
-      expect(strInfo).to.deep.include({
-        ...baseEvent,
-        tags: {
-          [UNTRUSTED]: [0, 11],
-          [URL_ENCODED]: [0, 11]
-        },
-      });
-    });
-  });
-
-  it('propagates exactly to result when value is escaped and not modified and adds URL_ENCODED tag', function () {
-    simulateRequestScope(() => {
-      const str = trackString('foo', { tags: { UNTRUSTED: [0, 1] } });
-      const result = querystring.escape(str);
-      const strInfo = tracker.getData(result);
-
-      expect(strInfo).to.deep.include({
-        ...baseEvent,
-        tags: {
-          [UNTRUSTED]: [0, 1],
-          [URL_ENCODED]: [0, 2]
-        },
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/querystring/index.test.js

@@ -1,40 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation querystring', function () {
-  let core, instr;
-
-  beforeEach(function () {
-    ({ core } = initAssessFixture());
-    instr = core.assess.dataflow.propagation.querystringInstrumentation;
-  });
-
-  const propagatorList = [
-    'parse'
-  ];
-
-  it('composes different installers', function () {
-    propagatorList.forEach((name) => {
-      expect(instr[name]).to.have.property('install').and.be.a('function');
-    });
-  });
-
-  it('dispatches installation to sub-components', function () {
-    const installs = [];
-    propagatorList.forEach((name) => {
-      const instr = core.assess.dataflow.propagation.querystringInstrumentation;
-      installs.push(sinon.stub(instr[name], 'install'));
-    });
-
-    instr.install();
-
-    expect(installs).to.have.lengthOf(1);
-    installs.forEach((installer) => {
-      expect(installer).to.have.been.called;
-    });
-  });
-});
-

package/lib/dataflow/propagation/install/querystring/parse.test.js

@@ -1,272 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const {
-  DataflowTag: { URL_ENCODED }
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation querystring parse', function () {
-  let core, trackString, simulateRequestScope, tracker, querystring;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    querystring = require('querystring');
-    core.assess.dataflow.propagation.querystringInstrumentation.parse.install();
-    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
-    core.depHooks.resolve.yield(querystring);
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  ['parse', 'decode'].forEach((method) => {
-    it('should do nothing on empty input', function () {
-      simulateRequestScope(() => {
-        const ret = querystring[method]('');
-        expect(ret).to.deep.equal({});
-      });
-    });
-
-    it('should do nothing if input isn\'t tracked', function () {
-      simulateRequestScope(() => {
-        const ret = querystring[method]('x=abcd&y=bcde&z=&w=cdef');
-        expect(ret).to.deep.equal({
-          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
-        });
-        Object.values(ret).forEach((val) => {
-          expect(tracker.getData(val)).to.be.null;
-        });
-      });
-    });
-
-    it('should not track tracked input that is parsed out', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd&y=bcde', {
-          tags: {
-            x: [0, 1],
-            ampersand: [6, 6],
-            y: [7, 8]
-          }
-        });
-        const ret = querystring[method](extern);
-        expect(ret).to.deep.equal({
-          x: 'abcd', y: 'bcde'
-        });
-        expect(tracker.getData(ret.x)).to.be.null;
-        expect(tracker.getData(ret.y)).to.be.null;
-        Object.keys(ret).forEach((key) => {
-          expect(tracker.getData(key)).to.be.null;
-        });
-      });
-    });
-
-    it('should propagate tags to object values', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd&y=abcd&z=&w=cdef', {
-          tags: {
-            foo: [2, 5],
-            bar: [9, 12]
-          }
-        });
-        const ret = querystring[method](extern);
-        expect(ret).to.deep.equal({
-          x: 'abcd', y: 'abcd', z: '', w: 'cdef'
-        });
-        expect(tracker.getData(ret.x).tags).to.deep.equal({
-          foo: [0, 3]
-        });
-        expect(tracker.getData(ret.y).tags).to.deep.equal({
-          bar: [0, 3]
-        });
-        expect(tracker.getData(ret.z)).to.be.null;
-        expect(tracker.getData(ret.w)).to.be.null;
-      });
-    });
-
-    it('should adjust tags to account for percent decoding', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=%E2%9C%93%F0%9F%98%90%F0%9F%99%89&y=%2F%3F%23&z=&w=cdef', {
-          tags: {
-            foo: [2, 34],
-            bar: [38, 46]
-          }
-        });
-        const ret = querystring[method](extern);
-        expect(ret).to.deep.equal({
-          x: '✓😐🙉', y: '/?#', z: '', w: 'cdef'
-        });
-        expect(tracker.getData(ret.x).tags).to.deep.equal({
-          foo: [0, 4]
-        });
-        expect(tracker.getData(ret.y).tags).to.deep.equal({
-          bar: [0, 2]
-        });
-        expect(tracker.getData(ret.z)).to.be.null;
-        expect(tracker.getData(ret.w)).to.be.null;
-      });
-    });
-
-    it('should strip url-encoded tags', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
-          tags: {
-            [URL_ENCODED]: [2, 5],
-            foo: [2, 5]
-          }
-        });
-        const ret = querystring[method](extern);
-        expect(ret).to.deep.equal({
-          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
-        });
-        expect(tracker.getData(ret.x).tags).to.deep.equal({
-          foo: [0, 3]
-        });
-        expect(tracker.getData(ret.x).removedTags).to.deep.equal([URL_ENCODED]);
-        expect(tracker.getData(ret.y)).to.be.null;
-        expect(tracker.getData(ret.z)).to.be.null;
-        expect(tracker.getData(ret.w)).to.be.null;
-      });
-    });
-
-    it('should track if custom decode function is passed (querystring.unescape)', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
-          tags: {
-            foo: [2, 5],
-            bar: [9, 12]
-          }
-        });
-        const ret = querystring[method](extern, null, null, { decodeURIComponent: querystring.unescape });
-        expect(ret).to.deep.equal({
-          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
-        });
-        expect(tracker.getData(ret.x).tags).to.deep.equal({
-          foo: [0, 3]
-        });
-        expect(tracker.getData(ret.y).tags).to.deep.equal({
-          bar: [0, 3]
-        });
-        expect(tracker.getData(ret.z)).to.be.null;
-        expect(tracker.getData(ret.w)).to.be.null;
-      });
-    });
-
-    it('should track if custom decode function is passed (custom)', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
-          tags: {
-            foo: [2, 5],
-            bar: [9, 12]
-          }
-        });
-        const ret = querystring[method](extern, null, null, {
-          decodeURIComponent(part) {
-            return part.concat('_');
-          }
-        });
-        expect(ret).to.deep.equal({
-          x_: 'abcd_', y_: 'bcde_', z_: '', w_: 'cdef_'
-        });
-        expect(tracker.getData(ret.x_).tags).to.deep.equal({
-          foo: [0, 3]
-        });
-        expect(tracker.getData(ret.y_).tags).to.deep.equal({
-          bar: [0, 3]
-        });
-        expect(tracker.getData(ret.z_)).to.be.null;
-        expect(tracker.getData(ret.w_)).to.be.null;
-      });
-    });
-
-    it('should track if custom decode function is passed (tracked string in decode)', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd&y=bcde&z=&w=cdef', {
-          tags: {
-            foo: [2, 5],
-            bar: [9, 12]
-          }
-        });
-        const concatStr = trackString('__', {
-          tags: {
-            concat: [1, 1]
-          }
-        });
-        const ret = querystring[method](extern, null, null, {
-          decodeURIComponent(part) {
-            return part.concat(concatStr);
-          }
-        });
-        expect(ret).to.deep.equal({
-          x__: 'abcd__', y__: 'bcde__', z__: '', w__: 'cdef__'
-        });
-        expect(tracker.getData(ret.x__).tags).to.deep.equal({
-          foo: [0, 3],
-          concat: [5, 5]
-        });
-        expect(tracker.getData(ret.y__).tags).to.deep.equal({
-          bar: [0, 3],
-          concat: [5, 5]
-        });
-        expect(tracker.getData(ret.z__)).to.be.null;
-        expect(tracker.getData(ret.w__).tags).to.deep.equal({
-          concat: [5, 5]
-        });
-      });
-    });
-
-    it('should properly handle custom separators', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=abcd...y=bcde...z=...w=cdef', {
-          tags: {
-            foo: [2, 5],
-            bar: [11, 14]
-          }
-        });
-        const ret = querystring[method](extern, '...');
-        expect(ret).to.deep.equal({
-          x: 'abcd', y: 'bcde', z: '', w: 'cdef'
-        });
-        expect(tracker.getData(ret.x).tags).to.deep.equal({
-          foo: [0, 3]
-        });
-        expect(tracker.getData(ret.y).tags).to.deep.equal({
-          bar: [0, 3]
-        });
-        expect(tracker.getData(ret.z)).to.be.null;
-        expect(tracker.getData(ret.w)).to.be.null;
-      });
-    });
-
-    it('should handle arrays', function () {
-      simulateRequestScope(() => {
-        const extern = trackString('x=123&x=4567&z=foo', {
-          tags: {
-            untrusted: [0, 24],
-          }
-        });
-        const ret = querystring[method](extern);
-        expect(ret).to.deep.equal({
-          x: ['123', '4567'], z: 'foo'
-        });
-        expect(tracker.getData(ret.x[0]).tags).to.deep.equal({
-          untrusted: [0, 2]
-        });
-        expect(tracker.getData(ret.x[1]).tags).to.deep.equal({
-          untrusted: [0, 3]
-        });
-        expect(tracker.getData(ret.z).tags).to.deep.equal({
-          untrusted: [0, 2]
-        });
-      });
-    });
-  });
-});