@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/sources/handler.test.js

@@ -1,501 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const {
-  DataflowTag,
-  InputType
-} = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow sources handler', function () {
-  let core, simulateRequestScope, sources, tracker;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    core.config.assess.max_context_source_events = 100;
-
-    // we want to remove previous calls to `logger` methods from before these tests.
-    sinon.reset();
-
-    sources = core.assess.dataflow.sources;
-    tracker = core.assess.dataflow.tracker;
-
-    sinon.spy(tracker, 'track');
-    core.assess.dataflow.propagation.bufferInstrumentation.install();
-  });
-
-  it('composes methods on core correctly', function () {
-    expect(sources.createTags).to.be.a('function');
-    expect(sources.handle).to.be.a('function');
-  });
-
-  describe('createTags', function () {
-    [
-      {
-        arg: {
-          value: ''
-        },
-        expected: null,
-      },
-      {
-        arg: {
-          value: undefined
-        },
-        expected: null,
-      },
-      {
-        arg: {
-          inputType: InputType.QUERYSTRING,
-          name: 'foo',
-          value: 'a',
-        },
-        expected: {
-          [DataflowTag.UNTRUSTED]: [0, 0]
-        }
-      },
-      {
-        arg: {
-          inputType: InputType.QUERYSTRING,
-          fieldName: 'foo',
-          value: 'ab',
-        },
-        expected: {
-          [DataflowTag.UNTRUSTED]: [0, 1]
-        }
-      },
-      {
-        arg: {
-          inputType: InputType.HEADER,
-          fieldName: 'foo',
-          value: 'abcd',
-        },
-        expected: {
-          [DataflowTag.UNTRUSTED]: [0, 3]
-        }
-      },
-      {
-        arg: {
-          inputType: InputType.HEADER,
-          fieldName: 'referer',
-          value: 'abcd',
-          tagNames: ['excluded:sql-injection'],
-        },
-        expected: {
-          [DataflowTag.HEADER]: [0, 3],
-          [DataflowTag.UNTRUSTED]: [0, 3],
-          ['excluded:sql-injection']: [0, 3],
-        }
-      }
-    ].forEach(({ arg, expected }) => {
-      it('creates expected tags based on name, value, and input type', function () {
-        const result = sources.createTags(arg);
-        expect(result).to.deep.equal(expected);
-      });
-    });
-  });
-
-  describe('handle', function () {
-    it('does not handle when no assess source context is active', function () {
-      const result = sources.handle({
-        name: 'test-source-name',
-        inputType: InputType.QUERYSTRING,
-        data: {
-          prop1: 'foo',
-        }
-      });
-      expect(result).to.be.null;
-    });
-
-    it('does nothing when async store\'s assess policy is null', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const trackedObj = sources.handle({
-          name: 'test-source-name',
-          inputType: InputType.QUERYSTRING,
-          sourceContext
-        });
-
-        expect(trackedObj).to.be.undefined;
-        expect(core.logger.trace).not.to.have.been.called;
-        expect(core.logger.warn).not.to.have.been.called;
-        expect(tracker.track).not.to.have.been.called;
-      }, { assess: { policy: null } });
-    });
-
-    it('does nothing when no data is passed', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const trackedObj = sources.handle({
-          name: 'test-source-name',
-          inputType: InputType.QUERYSTRING,
-          sourceContext
-        });
-
-        expect(trackedObj).to.be.undefined;
-        expect(core.logger.trace).not.to.have.been.called;
-        expect(core.logger.warn).not.to.have.been.called;
-        expect(tracker.track).not.to.have.been.called;
-      });
-    });
-
-    ['SINK', 'NONE'].forEach((option) => {
-      it(`does not capture stacktrace for assess.stacktraces=${option}`, function() {
-        simulateRequestScope(() => {
-          const sourceContext = core.scopes.sources.getStore()?.assess;
-          core.config.assess.stacktraces = option;
-          const trackedObj = sources.handle({
-            name: 'test-source-name',
-            inputType: InputType.QUERYSTRING,
-            data: { prop1: 'foo' },
-            sourceContext
-          });
-
-          const trackData = tracker.getData(trackedObj.prop1);
-          expect(trackData.stack).to.deep.equal([]);
-        });
-      });
-    });
-
-    ['SOME', 'ALL'].forEach((option) => {
-      it(`captures stacktrace for assess.stacktraces=${option}`, function() {
-        simulateRequestScope(() => {
-          const sourceContext = core.scopes.sources.getStore()?.assess;
-          core.config.assess.stacktraces = option;
-          const trackedObj = sources.handle({
-            name: 'test-source-name',
-            inputType: InputType.QUERYSTRING,
-            data: { prop1: 'foo' },
-            sourceContext
-          });
-
-          const trackData = tracker.getData(trackedObj.prop1);
-          expect(trackData.stack).to.be.instanceOf(Array);
-          expect(trackData.stack.length).to.be.greaterThan(0);
-        });
-      });
-    });
-
-
-    it('traverses objects and tracks string values', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const trackedObj = sources.handle({
-          name: 'test-source-name',
-          inputType: InputType.QUERYSTRING,
-          data: {
-            prop1: 'foo',
-            prop2: ['bar', 'bugs'],
-          },
-          sourceContext
-        });
-
-        expect(tracker.getData(trackedObj.prop1)).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop1',
-          result: { tracked: true, value: 'foo' },
-          inputType: InputType.QUERYSTRING,
-          stack: [],
-          value: 'foo',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 2],
-          },
-        });
-
-        expect(tracker.getData(trackedObj.prop2[0])).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop2.0',
-          result: { tracked: true, value: 'bar' },
-          inputType: InputType.QUERYSTRING,
-          stack: [],
-          value: 'bar',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 2],
-          },
-        });
-
-        expect(tracker.getData(trackedObj.prop2[1])).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop2.1',
-          result: { tracked: true, value: 'bugs' },
-          inputType: InputType.QUERYSTRING,
-          stack: [],
-          value: 'bugs',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 3],
-          },
-        });
-
-        core.config.assess.stacktraces = 'ALL';
-        const anotherTrackedObj = sources.handle({
-          name: 'test-source-name',
-          inputType: InputType.QUERYSTRING,
-          data: { prop1: 'foo' },
-          sourceContext
-        });
-
-        const trackData = tracker.getData(anotherTrackedObj.prop1);
-        expect(trackData).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop1',
-          result: { tracked: true, value: 'foo' },
-          inputType: InputType.QUERYSTRING,
-          value: 'foo',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 2],
-          }
-        });
-
-        const pathSep = process.platform === 'win32' ? '\\' : '/';
-
-        expect(trackData.stack.some((entry) => entry.file?.includes(`core${pathSep}lib${pathSep}capture-stacktrace.js`))).to.be.true;
-        expect(trackData.stack.some((entry) => entry.method?.includes('core.createSnapshot'))).to.be.true;
-        expect(trackData.stack.some((entry) => entry.file?.includes(`assess${pathSep}lib${pathSep}dataflow${pathSep}sources${pathSep}handler.js`))).to.be.true;
-        expect(trackData.stack.some((entry) => entry.method?.includes('sources.handle'))).to.be.true;
-      });
-    });
-
-    it('traverses objects and tracks string values by specific keys', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const trackedObj = sources.handle({
-          name: 'test-source-name',
-          keys: ['prop1', 'prop3'],
-          inputType: InputType.QUERYSTRING,
-          data: {
-            prop1: 'foo',
-            prop2: ['bar', 'bugs'],
-            prop3: {
-              foo: 'yellow'
-            }
-          },
-          sourceContext
-        });
-
-        expect(tracker.getData(trackedObj.prop1)).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop1',
-          result: { tracked: true, value: 'foo' },
-          inputType: InputType.QUERYSTRING,
-          stack: [],
-          value: 'foo',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 2],
-          },
-        });
-        expect(tracker.getData(trackedObj.prop2[0])).to.be.null;
-        expect(tracker.getData(trackedObj.prop2[1])).to.be.null;
-        expect(tracker.getData(trackedObj.prop3.foo)).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop3.foo',
-          result: { tracked: true, value: 'yellow' },
-          inputType: InputType.QUERYSTRING,
-          stack: [],
-          value: 'yellow',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 5],
-          },
-        });
-      });
-    });
-
-    it('traverses objects and tracks Buffer values', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const event = {
-          name: 'test-source-name',
-          inputType: InputType.QUERYSTRING,
-          data: {
-            prop1: Buffer.from('foo'),
-            prop2: Buffer.from('ascii', 'ascii'),
-            prop3: Buffer.from('base64', 'base64'),
-            prop4: Buffer.from('binary', 'binary'),
-            prop5: {
-              foo: Buffer.from('yellow'),
-            },
-            prop6: 'a string value',
-          },
-          sourceContext
-        };
-
-        sources.handle(event);
-
-        expect(tracker.getData(event.data.prop1.toString())).to.be.ok;
-        expect(tracker.getData(event.data.prop2.toString())).to.be.ok;
-        expect(tracker.getData(event.data.prop3.toString())).to.be.ok;
-        expect(tracker.getData(event.data.prop4.toString())).to.be.ok;
-        expect(tracker.getData(event.data.prop5.foo.toString())).to.be.ok;
-        expect(tracker.getData(event.data.prop6)).to.be.ok;
-        // we don't cache metadata since buffer's content can change
-        expect(
-          tracker.getData(event.data.prop1.toString())
-        ).not.to.equal(
-          tracker.getData(event.data.prop1.toString())
-        );
-      });
-    });
-
-    it('appropriately tracks when data param is Buffer instance', function () {
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const event = {
-          name: 'test-source-name',
-          inputType: InputType.QUERYSTRING,
-          data: Buffer.from('foo'),
-          sourceContext
-        };
-
-        sources.handle(event);
-
-        expect(tracker.getData(event.data)).to.be.ok;
-      });
-    });
-
-    it('exits source handling when configured max source events is reached', function () {
-      core.config.assess.max_context_source_events = 1;
-      simulateRequestScope(() => {
-        const name = 'test-source-name';
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        const trackedObj = sources.handle({
-          name,
-          inputType: InputType.QUERYSTRING,
-          data: {
-            prop1: 'foo',
-            prop2: ['bar', 'bugs'],
-          },
-          sourceContext
-        });
-
-        expect(tracker.getData(trackedObj.prop1)).to.be.like({
-          name: 'test-source-name',
-          pathName: 'prop1',
-          result: { tracked: true, value: 'foo' },
-          inputType: InputType.QUERYSTRING,
-          stack: [],
-          value: 'foo',
-          tags: {
-            [DataflowTag.UNTRUSTED]: [0, 2],
-          },
-        });
-
-        expect(tracker.getData(trackedObj.prop2[0])).to.be.null;
-        expect(tracker.getData(trackedObj.prop2[1])).to.be.null;
-        expect(core.logger.trace).to.have.been.calledWith(
-          { sourceName: name, inputType: InputType.QUERYSTRING },
-          'exiting assess source handling - %s max events exceeded',
-          1
-        );
-      });
-    });
-
-    it('logs an error when cannot create an event', function () {
-      simulateRequestScope(() => {
-        const name = 'test-source-name';
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        sources.handle({
-          name,
-          inputType: 'wrong-input-type',
-          data: {
-            prop1: 'foo',
-          },
-          sourceContext
-        });
-
-        expect(tracker.track).not.to.have.been.called;
-        expect(core.logger.trace).not.to.have.been.called;
-        expect(core.logger.warn).to.have.been.calledOnceWith(
-          { inputType: 'wrong-input-type', sourceName: 'test-source-name', pathName: 'prop1', value: 'foo' },
-          'unable to create source event',
-        );
-      });
-    });
-  });
-
-  describe('traversal', function () {
-    const { traverse } = require('./handler');
-    let visitorSpy;
-
-    beforeEach(function () {
-      visitorSpy = sinon.stub();
-    });
-
-    it('doesn\'t revist seen references', function () {
-      const obj = {
-        prop1: 'foo',
-        prop2: { foo: 'bar' },
-        prop3: [
-          'hello',
-          ['world'],
-          { key: 'val' },
-        ]
-      };
-
-      obj.circ = obj;
-
-      traverse(obj, (path, key, value) => {
-        // copy path, otherwise it will be empty by assertion time
-        visitorSpy(Array.from(path), key, value);
-      });
-
-      const visitorArgs = [
-        [['prop1'], 'prop1', 'foo'],
-        [['prop2', 'foo'], 'foo', 'bar'],
-        [['prop3', '0'], '0', 'hello'],
-        [['prop3', '1', '0'], '0', 'world'],
-        [['prop3', '2', 'key'], 'key', 'val'],
-        [['circ', 'prop1'], 'prop1', 'foo'],
-      ];
-
-      visitorArgs.forEach((args) => {
-        expect(visitorSpy).to.have.been.calledWithMatch(...args);
-      });
-      expect(visitorSpy).to.have.callCount(visitorArgs.length);
-    });
-
-    it('will not recurse into buffers or visit numbers, null, Maps, Sets, or undefined', function () {
-      const b = Buffer.from('buffer content');
-
-      traverse({
-        b,
-        numberThree: 3,
-        numberNine: Number('9'),
-        null: null,
-        undefined,
-        set: new Set(['frog', 'beetle']),
-        map: new Map([['k', 'v']])
-      }, (path, key, value) => {
-        visitorSpy(Array.from(path), key, value);
-      });
-
-      expect(visitorSpy).to.have.been.calledWithMatch(['b'], 'b', b).and.have.callCount(1);
-    });
-
-    it('visits and traverses objects created by Object.create(null)', function () {
-      const o = Object.create(null);
-      o.foo = 'bar';
-      o.x = Object.assign(Object.create(null), { abc: 'xyz' });
-
-      traverse(o, (path, key, value) => {
-        visitorSpy(Array.from(path), key, value);
-      });
-
-      [
-        [['foo'], 'foo', 'bar'],
-        [['x'], 'x', { abc: 'xyz' }],
-        [['x', 'abc'], 'abc', 'xyz']
-      ].forEach((args) => {
-        expect(visitorSpy).to.have.been.calledWithMatch(...args);
-      });
-    });
-
-
-    it('halts when callback returns `false`', function () {
-      traverse({ values: ['one', 'two'] }, (path, key, value, obj) => {
-        visitorSpy();
-        return false;
-      });
-
-      expect(visitorSpy).to.have.callCount(1);
-    });
-  });
-});

package/lib/dataflow/sources/index.test.js

@@ -1,60 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const proxyquire = require('proxyquire');
-const mocks = require('@contrast/test/mocks');
-
-const moduleMock = (moduleName, mock) => (deps) => {
-  deps.assess.dataflow.sources[moduleName] = mock[moduleName];
-};
-
-describe('assess dataflow sources', function () {
-  let core, sourcesMock, sourcesModule, modulesWithInstall;
-
-  beforeEach(function () {
-    core = mocks.core();
-    core.assess = mocks.assess();
-    core.logger = mocks.logger();
-    sourcesMock = core.assess.dataflow.sources;
-    sourcesModule = proxyquire('.', {
-      './install/http': moduleMock('httpSourcesInstr', sourcesMock),
-      './install/express': moduleMock('expressInstrumentation', sourcesMock),
-      './install/fastify': moduleMock('fastifyInstrumentation', sourcesMock),
-      './install/hapi': moduleMock('hapiInstrumentation', sourcesMock),
-      './install/koa': moduleMock('koaInstrumentation', sourcesMock),
-      './install/restify': moduleMock('restifyInstrumentation', sourcesMock),
-      './install/body-parser1': moduleMock('bodyParser1Instrumentation', sourcesMock),
-      './install/cookie-parser1': moduleMock('cookieParser1Instrumentation', sourcesMock),
-      './install/busboy': moduleMock('busboyInstrumentation', sourcesMock),
-      './install/multer1': moduleMock('multer1Instrumentation', sourcesMock),
-      './install/formidable1': moduleMock('formidable1Instrumentation', sourcesMock),
-      './install/graphql-http': moduleMock('graphqlHttpInstrumentation', sourcesMock),
-      './install/qs6': moduleMock('qs6Instrumentation', sourcesMock),
-      './install/querystring': moduleMock('querystringInstrumentation', sourcesMock),
-    });
-    modulesWithInstall = [
-      'httpSourcesInstr',
-      'expressInstrumentation',
-      'fastifyInstrumentation',
-      'hapiInstrumentation',
-      'koaInstrumentation',
-      'restifyInstrumentation',
-      'bodyParser1Instrumentation',
-      'busboyInstrumentation',
-      'multer1Instrumentation',
-      'cookieParser1Instrumentation',
-      'formidable1Instrumentation',
-      'graphqlHttpInstrumentation',
-      'qs6Instrumentation',
-      'querystringInstrumentation',
-    ];
-  });
-
-  it('installs the components', function () {
-    sourcesModule(core).install();
-    modulesWithInstall.forEach((module) => {
-      expect(sourcesMock[module].install).to.have.been.calledOnce;
-    });
-  });
-});
-