@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/propagation/install/JSON/stringify.test.js

@@ -1,265 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const {
-  primordials: { UtilInspect },
-  DataflowTag: { UNTRUSTED },
-} = require('@contrast/common');
-const origStringify = JSON.stringify;
-
-describe('assess dataflow propagation JSON stringify', function () {
-  let core,
-    simulateRequestScope,
-    trackString,
-    tracker,
-    objWithoutTrackedStr,
-    objWithTrackedStr,
-    standardEvent;
-
-  beforeEach(function () {
-    ({ core, trackString, simulateRequestScope } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-
-    core.assess.dataflow.propagation.jsonInstrumentation.stringify.install();
-    core.assess.dataflow.propagation.stringInstrumentation.concat.install();
-
-    objWithoutTrackedStr = {
-      prop1: 'test',
-      prop2: 'test2',
-      arr: [1, 2, 'test3'],
-      nested: {
-        obj: 'prop',
-      },
-    };
-
-    simulateRequestScope(() => {
-      objWithTrackedStr = {
-        prop1: trackString('test'),
-        prop2: trackString('test2'),
-        arr: [1, 2, trackString('test3')],
-        nested: {
-          obj: trackString('prop'),
-        },
-      };
-    });
-
-    standardEvent = {
-      object: {
-        tracked: false,
-        value: 'JSON',
-      },
-      args: [{ tracked: false, value: 'Object' }],
-      context: `JSON.stringify(${origStringify(objWithTrackedStr)})`,
-      name: 'JSON.stringify',
-      moduleName: 'JSON',
-      methodName: 'stringify',
-      source: 'P0',
-      target: 'R',
-      result: {
-        tracked: true,
-        value: origStringify(objWithTrackedStr),
-      },
-      value: origStringify(objWithTrackedStr),
-      tags: {
-        [UNTRUSTED]: [10, 13, 25, 29, 44, 48, 69, 72],
-      },
-    };
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.jsonInstrumentation.stringify.uninstall();
-  });
-
-  it('results in an untracked string when the object is with all strings untracked ', function () {
-    simulateRequestScope(() => {
-      const ret = JSON.stringify(objWithoutTrackedStr);
-      expect(ret).to.equal(origStringify(objWithoutTrackedStr));
-      expect(tracker.getData(ret)).to.be.null;
-    });
-  });
-
-  it('results in an untracked string when there is no Assess policy in request scope', function () {
-    simulateRequestScope(() => {
-      const ret = JSON.stringify(objWithTrackedStr);
-      expect(ret).to.equal(origStringify(objWithTrackedStr));
-      expect(tracker.getData(ret)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('results in an untracked string when instrumentation is locked', function () {
-    simulateRequestScope(() => {
-      core.scopes.instrumentation.run({ lock: true }, () => {
-        const ret = JSON.stringify(objWithTrackedStr);
-        expect(ret).to.equal(origStringify(objWithTrackedStr));
-        expect(tracker.getData(ret)).to.be.null;
-      });
-    });
-  });
-
-  it('propagates correctly all kinds of string properties in a generic JSON.stringify call', function () {
-    simulateRequestScope(() => {
-      const ret = JSON.stringify(objWithTrackedStr);
-      expect(ret).to.equal(standardEvent.value);
-      expect(tracker.getData(ret)).to.be.like(standardEvent);
-    });
-  });
-
-  it('propagates correctly all kinds of string properties in a JSON.stringify call with predefined spaces', function () {
-    simulateRequestScope(() => {
-      const stringifyArgs = [objWithTrackedStr, (_k, v) => v, 's'];
-      const ret = JSON.stringify(...stringifyArgs);
-      expect(ret).to.equal(origStringify(...stringifyArgs));
-      expect(tracker.getData(ret)).to.be.like({
-        ...standardEvent,
-        context: `JSON.stringify(${origStringify(...stringifyArgs)})`,
-        args: [
-          {
-            tracked: false,
-            value: 'Object'
-          },
-          {
-            tracked: false,
-            value: 'Function',
-          },
-          {
-            tracked: false,
-            value: 'String',
-          }
-        ],
-        value: origStringify(...stringifyArgs),
-        result: {
-          tracked: true,
-          value: origStringify(...stringifyArgs),
-        },
-        tags: {
-          [UNTRUSTED]: [13, 16, 31, 35, 62, 66, 96, 99],
-        },
-      });
-    });
-  });
-
-  it('propagates correctly a JSON.stringify call with untrusted specified spaces', function () {
-    simulateRequestScope(() => {
-      const stringifyArgs = [
-        objWithoutTrackedStr,
-        (_k, v) => v,
-        trackString('user'),
-      ];
-      const ret = JSON.stringify(...stringifyArgs);
-
-      expect(ret).to.equal(origStringify(...stringifyArgs));
-      expect(tracker.getData(ret)).to.be.like({
-        ...standardEvent,
-        context: `JSON.stringify(${origStringify(...stringifyArgs)})`,
-        args: [
-          {
-            tracked: false,
-            value: 'Object',
-          },
-          {
-            tracked: false,
-            value: 'Function',
-          },
-          {
-            tracked: true,
-            value: UtilInspect(stringifyArgs[2]),
-          },
-        ],
-        value: origStringify(...stringifyArgs),
-        source: 'P2',
-        result: {
-          tracked: true,
-          value: origStringify(...stringifyArgs),
-        },
-        tags: {
-          [UNTRUSTED]: [
-            2, 5, 23, 26, 45, 48, 58, 65, 69, 76, 80, 87, 96, 99, 103, 106, 119,
-            126, 141, 144,
-          ],
-        },
-      });
-    });
-  });
-
-  it('propagates correctly all kind of string properties in a JSON.stringify call with untrusted specified spaces', function () {
-    simulateRequestScope(() => {
-      const stringifyArgs = [
-        objWithTrackedStr,
-        (_k, v) => v,
-        trackString('user'),
-      ];
-      const ret = JSON.stringify(...stringifyArgs);
-      expect(ret).to.equal(origStringify(...stringifyArgs));
-      expect(tracker.getData(ret)).to.be.like({
-        ...standardEvent,
-        context: `JSON.stringify(${origStringify(...stringifyArgs)})`,
-        args: [
-          {
-            tracked: false,
-            value: 'Object',
-          },
-          {
-            tracked: false,
-            value: 'Function',
-          },
-          {
-            tracked: true,
-            value: UtilInspect(stringifyArgs[2]),
-          },
-        ],
-        value: origStringify(...stringifyArgs),
-        source: 'P',
-        result: {
-          tracked: true,
-          value: origStringify(...stringifyArgs),
-        },
-        tags: {
-          [UNTRUSTED]: [
-            2, 5, 16, 19, 23, 26, 37, 41, 45, 48, 58, 65, 69, 76, 80, 87, 89,
-            93, 96, 99, 103, 106, 119, 126, 135, 138, 141, 144,
-          ],
-        },
-      });
-    });
-  });
-
-  describe('some edge cases', function () {
-    it('handles cases when the second argument is an array', function () {
-      simulateRequestScope(() => {
-        const stringifyArgs = [objWithTrackedStr, ['arr', 'nested', 'obj']];
-        const ret = JSON.stringify(...stringifyArgs);
-        expect(ret).to.equal(origStringify(...stringifyArgs));
-        expect(tracker.getData(ret).tags).to.deep.equal({
-          [UNTRUSTED]: [13, 17, 38, 41],
-        });
-      });
-    });
-
-    it('handles cases when the third argument is not entirely tagged', function () {
-      simulateRequestScope(() => {
-        const concatSpaces = 'd'.concat(
-          trackString('us'),
-          'd',
-          trackString('us')
-        );
-        const stringifyArgs = [
-          objWithoutTrackedStr,
-          (_k, v) => v,
-          concatSpaces,
-        ];
-        const ret = JSON.stringify(...stringifyArgs);
-        expect(ret).to.equal(origStringify(...stringifyArgs));
-        expect(tracker.getData(ret).tags).to.deep.equal({
-          [UNTRUSTED]: [
-            3, 4, 6, 7, 26, 27, 29, 30, 50, 51, 53, 54, 65, 66, 68, 69, 71, 72,
-            74, 75, 80, 81, 83, 84, 86, 87, 89, 90, 95, 96, 98, 99, 101, 102,
-            104, 105, 115, 116, 118, 119, 124, 125, 127, 128, 142, 143, 145,
-            146, 148, 149, 151, 152, 168, 169, 171, 172,
-          ],
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/array-prototype-join.test.js

@@ -1,106 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation array join', function () {
-  let core, trackString, simulateRequestScope, tracker;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.arrayJoin.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.arrayJoin.uninstall();
-    sinon.resetHistory();
-  });
-
-  [
-    {
-      expected: { untrusted: [12, 18, 38, 51] }
-    },
-    {
-      separator: 'not-tracked',
-      expected: { untrusted: [22, 28, 68, 81] }
-    },
-    {
-      separator: 'tracked-sep',
-      tags: {
-        untrusted: [0, 10]
-      },
-      expected: { untrusted: [11, 39, 57, 81] }
-    }
-  ].forEach(({ separator, tags, expected }) => {
-    it('propagates correctly', function () {
-      simulateRequestScope(function () {
-        const arr = [
-          'not-tracked',
-          trackString('tracked', { tags: { untrusted: [0, 6] } }),
-          'another-untracked',
-          trackString('another-tracked', { tags: { untrusted: [0, 13] } })
-        ];
-        let source = 'O';
-
-        if (tags) {
-          separator = trackString(separator, { tags });
-          source = 'A';
-        }
-
-        const result = arr.join(separator);
-        const strInfo = tracker.getData(result);
-        expect(strInfo?.tags).to.deep.equal(expected);
-        expect(strInfo?.source).to.equal(source);
-      });
-    });
-  });
-
-  it('propagates correctly nested arrays', function () {
-    simulateRequestScope(function () {
-      const str = trackString('tracked', { tags: { untrusted: [0, 6] } });
-      const arr = [
-        'not-tracked',
-        [
-          'not-tracked',
-          str
-        ],
-        [
-          'not-tracked',
-          [
-            'not-tracked',
-            str
-          ]
-        ]
-      ];
-
-      const result = arr.join();
-      const resultInfo = tracker.getData(result);
-      expect(resultInfo?.tags).to.deep.equal({ untrusted: [24, 30, 56, 62] });
-    });
-  });
-
-  it('will not propagate if there is no assess policy in source context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('foo');
-      const result = ['not-tracked', value].join();
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('foo');
-        const result = ['not-tracked', value].join();
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/buffer.test.js

@@ -1,112 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation Buffer', function () {
-  let core, simulateRequestScope, tracker, trackString, createSourceEvent;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    createSourceEvent = core.assess.eventFactory.createSourceEvent;
-    core.assess.dataflow.propagation.bufferInstrumentation.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.arrayJoin.uninstall();
-    sinon.resetHistory();
-  });
-
-  describe('Buffer.prototype.toString', function () {
-    [
-      'utf8',
-      'latin1',
-      'ascii',
-      // todo
-    ].forEach((encoding) => {
-      const value = 'foo';
-
-      it(`value when buffer is tracked (${encoding})`, function () {
-        simulateRequestScope(() => {
-          const b = Buffer.from(value, encoding);
-          const event = createSourceEvent({
-            name: 'body-parser-mock',
-            result: { tracked: true, value: b },
-            inputType: 'BODY',
-            tags: {
-              UNTRUSTED: [0, 2],
-            },
-            stack: [],
-          });
-
-          tracker.track(b, event);
-          expect(tracker.getData(b.toString(encoding))).to.deep.include({
-            addedTags: [],
-            args: [{ tracked: false, value: encoding }],
-            moduleName: 'Buffer',
-            methodName: 'prototype.toString',
-            context: 'buffer.toString()',
-            name: 'global.Buffer.prototype.toString',
-            object: { tracked: true, value: 'Buffer' },
-            removedTags: [],
-            result: { tracked: true, value },
-            source: 'O',
-            stack: [],
-            tags: {
-              UNTRUSTED: [0, 2]
-            },
-            target: 'R',
-            value,
-          });
-        });
-      });
-    });
-  });
-
-  describe('Buffer.from', function () {
-    // todo: implementation for other types. see https://nodejs.org/api/buffer.html
-
-    const trkInfoCommon = {
-      object: { tracked: true, value: 'Buffer' },
-      source: 'P0',
-      target: 'R',
-      tags: { UNTRUSTED: [0, 7] },
-      name: 'global.Buffer.from',
-      moduleName: 'Buffer',
-      methodName: 'from',
-    };
-
-    [
-      {
-        getArgs: () => trackString('a string'),
-        argType: 'string',
-        expected: {
-          ...trkInfoCommon,
-          context: 'Buffer.from(a string)',
-          args: [{ tracked: true, value: 'a string' }],
-        }
-      },
-      {
-        getArgs: () => Buffer.from(trackString('a buffer')),
-        argType: 'buffer',
-        expected: {
-          ...trkInfoCommon,
-          context: 'Buffer.from(a buffer)',
-          args: [{ tracked: true, value: 'a buffer' }],
-        }
-      },
-
-    ].forEach(({ argType, getArgs, expected }) => {
-      it(`tracks result when argument is tracked (arg type ${argType})`, function () {
-        simulateRequestScope(() => {
-          const b = Buffer.from(getArgs());
-          const trkInfo = tracker.getData(b);
-          expect(trkInfo).to.deep.include(expected);
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/contrast-methods/add.test.js

@@ -1,94 +0,0 @@
-'use strict';
-
-const {
-  DataflowTag: {
-    UNTRUSTED,
-  }
-} = require('@contrast/common');
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation contrast-methods add', function () {
-  let core, simulateRequestScope, trackString, tracker;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-
-    core.contrastMethods.install();
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.add.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.add.uninstall();
-  });
-
-  const foo = () => trackString('foo');
-  const bar = () => 'bar';
-
-  [
-    {
-      name: 'tracked A, untracked B',
-      args: [foo, bar],
-      expected: {
-        [UNTRUSTED]: [0, 2],
-      },
-    },
-    {
-      name: 'tracked A, tracked B',
-      args: [foo, foo],
-      expected: {
-        [UNTRUSTED]: [0, 5],
-      },
-    },
-    {
-      name: 'untracked A, tracked B',
-      args: [bar, foo],
-      expected: {
-        [UNTRUSTED]: [3, 5],
-      },
-    },
-    {
-      name: 'empty A, tracked B',
-      args: [() => '', foo],
-      expected: {
-        [UNTRUSTED]: [0, 2],
-      },
-    },
-  ].forEach(({ name, args, expected }) => {
-    it(`propagates ${name} correctly`, function () {
-      simulateRequestScope(function () {
-        const result = global.ContrastMethods.add(...args.map(Reflect.apply));
-
-        expect(tracker.getData(result))
-          .to.have.property('tags')
-          .that.deep.equals(expected);
-      });
-    });
-  });
-
-  it('will not propagate if there is no result or not in proper source scope', function () {
-    const { extern } = tracker.track('foo', { tags: { UNTRUSTED: [0, 2] } });
-
-    sinon.spy(tracker, 'track');
-    sinon.spy(tracker, 'getData');
-
-    core.scopes.sources.run({}, function () {
-      global.ContrastMethods.add('', '');
-    });
-
-    core.scopes.sources.run(null, function () {
-      global.ContrastMethods.add(extern, 'bar');
-    });
-
-    core.scopes.instrumentation.run({ lock: true }, function () {
-      core.scopes.sources.run({}, function () {
-        global.ContrastMethods.add(extern, 'bar');
-      });
-    });
-
-    expect(tracker.track).not.to.have.been.called;
-    expect(tracker.getData).not.to.have.been.called;
-  });
-});

package/lib/dataflow/propagation/install/contrast-methods/index.test.js

@@ -1,49 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation contrast-methods', function () {
-  let core, instr;
-
-  const propagators = ['add', 'tag', 'number'];
-
-  beforeEach(function () {
-    ({ core } = initAssessFixture());
-    instr = core.assess.dataflow.propagation.contrastMethodsInstrumentation;
-  });
-
-  it('composes different installers', function () {
-    propagators.forEach((name) => {
-      expect(instr[name]).to.have.property('install').and.be.a('function');
-      expect(instr[name]).to.have.property('uninstall').and.be.a('function');
-    });
-  });
-
-  it('dispatches installation to sub-components', function () {
-    const installs = [];
-    const uninstalls = [];
-    // stub these to prevent side effects
-    propagators.forEach((name) => {
-      const instr =
-        core.assess.dataflow.propagation.contrastMethodsInstrumentation;
-      installs.push(sinon.stub(instr[name], 'install'));
-      uninstalls.push(sinon.stub(instr[name], 'uninstall'));
-    });
-
-    instr.install();
-
-    expect(installs).to.have.lengthOf(propagators.length);
-    installs.forEach((installer) => {
-      expect(installer).to.have.been.called;
-    });
-
-    instr.uninstall();
-
-    expect(uninstalls).to.have.lengthOf(propagators.length);
-    uninstalls.forEach((installer) => {
-      expect(installer).to.have.been.called;
-    });
-  });
-});

package/lib/dataflow/propagation/install/contrast-methods/number.test.js

@@ -1,50 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation contrast-methods number', function () {
-  let core, simulateRequestScope, trackString, tracker;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-    core.contrastMethods.install();
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.number.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.contrastMethodsInstrumentation.number.uninstall();
-  });
-
-  it('will not sanitize if Number coercion fails', function () {
-    simulateRequestScope(() => {
-      const str = trackString('foo');
-      global.ContrastMethods.Number(str);
-      expect(tracker.getData(str)).to.deep.include({
-        context: 'UNKNOWN.val',
-        name: 'assess-dataflow-fixture',
-        fieldName: 'val',
-        pathName: 'val',
-        stack: [],
-        inputType: 'UNKNOWN',
-        tags: { UNTRUSTED: [0, 2] },
-        result: { tracked: true, value: 'foo' },
-      });
-    });
-  });
-
-  it('will untrack if Number coercion succeeds', function () {
-    simulateRequestScope(() => {
-      const str = trackString('30000');
-      global.ContrastMethods.Number(str);
-      expect(tracker.getData(str)).to.be.null;
-      expect(core.logger.trace).to.have.been.calledWithMatch({
-        funcKey: 'assess-dataflow-propagator:ContrastMethods.Number',
-        sanitizer: 'ContrastMethods.Number',
-        value: '30000',
-      }, 'untracked a string value');
-
-    });
-  });
-});