@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/sources/install/body-parser1.test.js

@@ -1,244 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-
-describe('assess dataflow sources body-parser v1', function () {
-  let core, simulateRequestScope, req, res, next, bodyParser;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    req = {};
-    res = {};
-    next = sinon.stub();
-
-    sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    const bodyParserMock = (body) => (req, res, next) => {
-      req.body = body;
-      next();
-    };
-    bodyParserMock.json = (body) => (req, res, next) => {
-      req.body = body;
-      next();
-    };
-    bodyParserMock.raw = (body) => (req, res, next) => {
-      req.body = body;
-      next();
-    };
-    bodyParserMock.text = (body) => (req, res, next) => {
-      req.body = body;
-      next();
-    };
-    bodyParserMock.urlencoded = (body) => (req, res, next) => {
-      req.body = body;
-      next();
-    };
-
-    require('./body-parser1')(core).install();
-    bodyParser = core.depHooks.resolve.yield(bodyParserMock)[0];
-  });
-
-  // tests are not properly patching the default function
-  describe('bodyParser', function () {
-    it('handles a json request body as expected', function () {
-      const body = { foo: 'bar' };
-      const middleware = bodyParser(body);
-      req.headers = { 'content-type': 'application/json' };
-
-      simulateRequestScope(() => {
-        middleware(req, res, next);
-
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-          context: 'req.body',
-          name: 'body-parser.bodyParser',
-          inputType: InputType.JSON_VALUE,
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-          },
-          data: body,
-          sourceContext: core.scopes.sources.getStore().assess
-        });
-      });
-    });
-
-    it('handles a urlencoded request body as expected', function () {
-      const body = { foo: 'bar' };
-      const middleware = bodyParser(body);
-      req.headers = { 'content-type': 'application/x-www-form-urlencoded' };
-
-      simulateRequestScope(() => {
-        middleware(req, res, next);
-
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-          context: 'req.body',
-          name: 'body-parser.bodyParser',
-          inputType: InputType.PARAMETER_VALUE,
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-          },
-          data: body,
-          sourceContext: core.scopes.sources.getStore().assess
-        });
-      });
-    });
-
-    it('handles an unknown format request body as expected', function () {
-      const body = 'text';
-      const middleware = bodyParser(body);
-
-      simulateRequestScope(() => {
-        middleware(req, res, next);
-
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-          context: 'req',
-          name: 'body-parser.bodyParser',
-          inputType: InputType.BODY,
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-          },
-          data: { body },
-          sourceContext: core.scopes.sources.getStore().assess
-        });
-      });
-    });
-
-    it('does not handle the request when there is no assess policy in request context', function () {
-      const middleware = bodyParser('text');
-
-      simulateRequestScope(() => {
-        middleware(req, res, next);
-
-        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        expect(core.logger.trace.callCount).greaterThan(0);
-        expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
-      }, { assess: { policy: null } });
-    });
-
-    it('does not handle the request when already tracked', function () {
-      const middleware = bodyParser('text');
-
-      simulateRequestScope(() => {
-        // run twice
-        middleware(req, res, next);
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledOnce;
-        middleware(req, res, next);
-
-        expect(core.assess.dataflow.sources.handle).to.have.been.calledOnce;
-        expect(core.logger.trace).to.have.been.calledWith(
-          { funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
-          'values already tracked',
-        );
-      });
-    });
-
-    it('logs errors in the handle method', function () {
-      const middleware = bodyParser('text');
-      const err = new Error('yikes!');
-      core.assess.dataflow.sources.handle.throws(err);
-      simulateRequestScope(() => {
-        middleware(req, res, next);
-
-        expect(core.logger.error).to.have.been.calledWith(
-          { err, funcKey: 'assess-dataflow-source:body-parser.bodyParser' },
-          'unable to handle source',
-        );
-      });
-    });
-  });
-
-  [
-    {
-      method: 'json',
-      body: { json: 'body' },
-      inputType: InputType.JSON_VALUE,
-      context: 'req.body',
-      data: { json: 'body' },
-    },
-    {
-      method: 'raw',
-      body: Buffer.from('raw'),
-      inputType: InputType.BODY,
-      context: 'req',
-      data: { body: Buffer.from('raw') }
-    },
-    {
-      method: 'text',
-      body: 'text',
-      inputType: InputType.BODY,
-      context: 'req',
-      data: { body: 'text' }
-    },
-    {
-      method: 'urlencoded',
-      body: { urlencoded: 'yes' },
-      inputType: InputType.PARAMETER_VALUE,
-      context: 'req.body',
-      data: { urlencoded: 'yes' }
-    },
-  ].forEach(({ method, body, inputType, context, data }) => {
-    describe(`bodyParser.${method}`, function () {
-      let middleware;
-
-      beforeEach(function () {
-        middleware = bodyParser[method](body);
-      });
-
-      it('handles the request body as expected', function () {
-        simulateRequestScope(() => {
-          middleware(req, res, next);
-
-          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-            context,
-            name: `body-parser.${method}.${method}Parser`,
-            inputType,
-            stacktraceOpts: {
-              constructorOpt: sinon.match.func,
-            },
-            data,
-            sourceContext: core.scopes.sources.getStore().assess
-          });
-        });
-      });
-
-      it('does not handle the request when there is  in context', function () {
-        simulateRequestScope(() => {
-          middleware(req, res, next);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-          expect(core.logger.trace.callCount).greaterThan(0);
-          expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
-        }, { assess: { policy: null } });
-      });
-
-      it('does not handle the request when already tracked', function () {
-        simulateRequestScope(() => {
-          core.scopes.sources.getStore().assess.parsedBody = true;
-          middleware(req, res, next);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-          expect(core.logger.trace).to.have.been.calledWith(
-            { funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
-            'values already tracked',
-          );
-        });
-      });
-
-      it('logs errors in the handle method', function () {
-        const err = new Error('yikes!');
-        core.assess.dataflow.sources.handle.throws(err);
-
-        simulateRequestScope(() => {
-          middleware(req, res, next);
-
-          expect(core.logger.error).to.have.been.calledWith(
-            { err, funcKey: `assess-dataflow-source:body-parser.${method}.${method}Parser` },
-            'unable to handle source',
-          );
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/sources/install/busboy.test.js

@@ -1,152 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const busboyInstr = require('./busboy');
-
-describe('assess dataflow sources busboy', function () {
-  let core, simulateRequestScope, mockBusboy0, mockBusboy1, sources, emitMethodVersions;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    mockBusboy0 = function () { };
-    mockBusboy0.prototype.emit = function () { };
-
-    mockBusboy1 = function () {
-      return {
-        emit() { }
-      };
-    };
-    sinon.spy(mockBusboy0.prototype, 'emit');
-    sinon.spy(core.patcher, 'patch');
-
-    sources = core.assess.dataflow.sources;
-    sinon.spy(sources, 'handle');
-
-    busboyInstr(core).install();
-    core.depHooks.resolve.withArgs({ name: 'busboy', version: '<1' }).yield(mockBusboy0);
-    core.depHooks.resolve.withArgs({ name: 'busboy', version: '1' }).yield(mockBusboy1);
-    const patchedBusboy1 = core.patcher.patch.getCall(1).returnValue;
-
-    emitMethodVersions = {
-      'v0': mockBusboy0.prototype.emit,
-      'v1': patchedBusboy1().emit
-    };
-  });
-
-  it('calls patcher on the `.emit` method', function () {
-    expect(core.patcher.patch).to.have.been.calledWithMatch(mockBusboy0.prototype, 'emit', {
-      name: 'busboy.prototype.emit',
-      patchType: 'assess-dataflow-source',
-      pre: sinon.match.func
-    });
-
-    expect(core.patcher.patch).to.have.been.calledWithMatch(mockBusboy1, {
-      name: 'busboy',
-      patchType: 'assess-dataflow-source',
-      post: sinon.match.func
-    });
-  });
-
-  [
-    { version: 'v0', finalEvent: 'finish' },
-    { version: 'v1', finalEvent: 'close' }
-  ].forEach(({ version, finalEvent }) => {
-    describe(version, function () {
-      it('calls `.handle` when there are fields of data to be tracked and it is in right context', function () {
-        let sourceContext;
-
-        simulateRequestScope(() => {
-          emitMethodVersions[version]('field', 'field1', 'value1');
-          emitMethodVersions[version]('field', 'field2', 'value2');
-          emitMethodVersions[version](finalEvent);
-
-          sourceContext = core.scopes.sources.getStore()?.assess;
-        });
-
-        expect(sources.handle).to.have.been.calledTwice;
-        expect(sources.handle).to.have.been.calledWithMatch({
-          context: 'req.body',
-          name: 'busboy',
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-            prependFrames: [sinon.match.func],
-          },
-          inputType: InputType.MULTIPART_VALUE,
-          data: { field1: 'value1' },
-          sourceContext
-        });
-        expect(sources.handle).to.have.been.calledWithMatch({
-          context: 'req.body',
-          name: 'busboy',
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-            prependFrames: [sinon.match.func],
-          },
-          inputType: InputType.MULTIPART_VALUE,
-          data: { field2: 'value2' },
-          sourceContext
-        });
-      });
-
-      it('logs an error when `.handle` throws one', function () {
-        const err = new Error('test');
-
-        core.assess.dataflow.sources.handle = () => {
-          throw err;
-        };
-
-        simulateRequestScope(() => {
-          emitMethodVersions[version]('field', 'field1', 'value1');
-          emitMethodVersions[version](finalEvent);
-        });
-
-        expect(core.logger.error).to.have.been.calledOnceWith(
-          { err, inputType: InputType.MULTIPART_VALUE, funcKey: sinon.match.string },
-          'unable to handle source'
-        );
-      });
-
-      it('does not call `.handle` when there is no assess policy in request context', function () {
-        simulateRequestScope(() => {
-          emitMethodVersions[version]('field', 'field1', 'value1');
-          emitMethodVersions[version]('field', 'field2', 'value2');
-          emitMethodVersions[version](finalEvent);
-        }, { assess: { policy: null } });
-
-        expect(sources.handle).not.to.have.been.called;
-      });
-
-      it('does not call `.handle` when the values are already tracked', function () {
-        simulateRequestScope(() => {
-          const sourceContext = core.scopes.sources.getStore()?.assess;
-          sourceContext.parsedBody = true;
-
-          emitMethodVersions[version]('field', 'field1', 'value1');
-          emitMethodVersions[version]('field', 'field2', 'value2');
-          emitMethodVersions[version](finalEvent);
-        });
-
-        expect(sources.handle).not.to.have.been.called;
-        expect(core.logger.trace).to.have.been.calledWith(
-          { inputType: InputType.MULTIPART_VALUE, funcKey: sinon.match.string },
-          'values already tracked');
-      });
-
-      it('does not call `.handle` when `.emit` call does not contain field name or data', function () {
-        simulateRequestScope(() => {
-          emitMethodVersions[version]('field', null, 'value1');
-          emitMethodVersions[version]('field', 'field2', null);
-          emitMethodVersions[version](finalEvent);
-        }, {});
-
-        expect(sources.handle).not.to.have.been.called;
-        expect(core.logger.debug).not.to.have.been.called;
-      });
-    });
-  });
-});
-

package/lib/dataflow/sources/install/cookie-parser1.test.js

@@ -1,141 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-
-describe('assess dataflow sources cookie-parser v1', function () {
-  let core, simulateRequestScope, req, res, next, cookieParser;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-    req = {};
-    res = {};
-    next = sinon.stub();
-
-    sinon.stub(core.assess.dataflow.sources, 'handle');
-
-    require('./cookie-parser1')(core).install();
-    cookieParser = core.depHooks.resolve.yield(
-      function cookieParser(props = {}) {
-        return function cookieParser(req, res, next) {
-          Object.assign(req, props);
-          next();
-        };
-      }
-    )[0];
-  });
-
-  it('handles cookies as expected', function () {
-    const cookies = { foo: 'bar' };
-    const middleware = cookieParser({ cookies });
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
-        context: 'req.cookies',
-        name: 'cookie-parser.cookieParser',
-        inputType: InputType.COOKIE_VALUE,
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        data: cookies,
-        sourceContext: core.scopes.sources.getStore().assess
-      });
-    });
-  });
-
-  it('handles signed cookies as expected', function () {
-    const cookies = { foo: 'bar' };
-    const middleware = cookieParser({ signedCookies: cookies });
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
-        context: 'req.signedCookies',
-        name: 'cookie-parser.cookieParser',
-        inputType: InputType.COOKIE_VALUE,
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        data: cookies,
-        sourceContext: core.scopes.sources.getStore().assess
-      });
-    });
-  });
-
-  it('does not handle when there is no assess policy in request context', function () {
-    const middleware = cookieParser();
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.trace.callCount).greaterThan(0);
-      expect(core.logger.trace.lastCall.args[0]).includes('Assess intentionally disabled');
-    }, { assess: { policy: null } });
-  });
-
-  it('does not handle the request when cookies already tracked', function () {
-    const middleware = cookieParser();
-
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedCookies = true;
-      middleware(req, res, next);
-
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
-        'cookies already tracked',
-      );
-    });
-  });
-
-  it('does not handle the request when signed cookies already tracked', function () {
-    const middleware = cookieParser();
-
-    simulateRequestScope(() => {
-      core.scopes.sources.getStore().assess.parsedSignedCookies = true;
-      middleware(req, res, next);
-
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(core.logger.trace).to.have.been.calledWith(
-        { funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
-        'signedCookies already tracked',
-      );
-    });
-  });
-
-  it('logs errors when handling cookies', function () {
-    const middleware = cookieParser({ cookies: {} });
-    const err = new Error('yikes!');
-    core.assess.dataflow.sources.handle.throws(err);
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
-        'unable to handle source',
-      );
-    });
-  });
-
-  it('logs errors when handling signed cookies', function () {
-    const middleware = cookieParser({ signedCookies: {} });
-    const err = new Error('yikes!');
-    core.assess.dataflow.sources.handle.throws(err);
-
-    simulateRequestScope(() => {
-      middleware(req, res, next);
-
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, funcKey: 'assess-dataflow-source:cookie-parser.cookieParser' },
-        'unable to handle source',
-      );
-    });
-  });
-});

package/lib/dataflow/sources/install/express/params.test.js

@@ -1,110 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-
-describe('assess dataflow sources express params', function () {
-  let core, simulateRequestScope, Layer, layer;
-
-  [
-    { name: 'express', version: '>=4 <5', file: 'lib/router/layer.js' },
-    { name: 'router', version: '>=2 <3', file: 'lib/layer.js' }
-  ].forEach((args) => {
-    describe(`Express${args.name === 'express' ? '4' : '5'}`, function() {
-      beforeEach(function () {
-        ({ core, simulateRequestScope } = initAssessFixture());
-
-        sinon.stub(core.assess.dataflow.sources, 'handle');
-
-        const LayerMock = sinon.stub();
-        LayerMock.prototype.match = sinon.stub().returns(true);
-
-        require('./params')(core).install();
-        [Layer] = core.depHooks.resolve.withArgs(args).yield(LayerMock);
-        layer = { keys: ['foo'], params: { foo: 'bar' } };
-      });
-
-      it('calls `.handle` when `match` adds params (and keys) to the Layer instance', function () {
-        simulateRequestScope(() => {
-          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-          expect(core.assess.dataflow.sources.handle).to.have.been.calledWith({
-            context: 'req.params',
-            name: 'Layer.prototype.match',
-            inputType: InputType.PARAMETER_VALUE,
-            stacktraceOpts: {
-              constructorOpt: sinon.match.func,
-              prependFrames: sinon.match.array,
-            },
-            data: layer.params,
-            sourceContext: core.scopes.sources.getStore().assess
-          });
-        });
-      });
-
-      it('does not call `.handle` when `match` returns false', function () {
-        Layer.prototype.match.returns(false);
-
-        simulateRequestScope(() => {
-          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        });
-      });
-
-      it('does not call `.handle` when the layer is missing the expected properties', function () {
-        simulateRequestScope(() => {
-          Reflect.apply(Layer.prototype.match, {}, ['/bar']);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        });
-      });
-
-      it('does not call `.handle` when `match` adds no params or keys', function () {
-        simulateRequestScope(() => {
-          Reflect.apply(Layer.prototype.match, { keys: [], params: {} }, ['/bar']);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        });
-      });
-
-      it('does not handle when there is no assess policy in request context', function () {
-        simulateRequestScope(() => {
-          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        }, { assess: { policy: null } });
-      });
-
-      it('does not call `.handle` when the values are already tracked', function () {
-        simulateRequestScope(() => {
-          core.scopes.sources.getStore().assess.parsedParams = true;
-
-          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-          expect(core.logger.trace).to.have.been.calledWith(
-            { funcKey: 'assess-dataflow-source:Layer.prototype.match' },
-            'values already tracked'
-          );
-        });
-      });
-
-      it('handles a case with an error in the `.handle` method', function () {
-        const err = new Error('test');
-        core.assess.dataflow.sources.handle.throws(err);
-
-        simulateRequestScope(() => {
-          Reflect.apply(Layer.prototype.match, layer, ['/bar']);
-
-          expect(core.logger.error).to.have.been.calledWith(
-            { err, funcKey: 'assess-dataflow-source:Layer.prototype.match' },
-            'unable to handle source'
-          );
-        });
-      });
-    });
-  });
-});