@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/sources/install/koa/koa-multer.test.js

@@ -1,197 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const koaMulter = require('./koa-multer');
-const { InputType } = require('@contrast/common');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow sources Koa multer', function () {
-  let core,
-    koaMulterMock,
-    patchedKoaMulter,
-    simulateRequestScope;
-
-  ['koa-multer', '@koa/multer'].forEach((name) => {
-    describe(name, function() {
-      beforeEach(function () {
-        ({ core, simulateRequestScope } = initAssessFixture());
-
-        sinon.spy(core.patcher, 'patch');
-
-        core.assess.dataflow.sources.handle = sinon.stub();
-
-        koaMulterMock = function() {
-          const multer = {
-            _makeMiddleware() {
-              return function(req, res, next) {
-                next();
-              };
-            }
-          };
-
-          multer.any = function() {
-            const middleware = multer._makeMiddleware();
-
-            return (ctx, next) =>
-              new Promise((resolve, reject) => {
-                middleware(ctx.req, ctx.res, (err) => {
-                  err ? reject(err) : resolve(ctx);
-                });
-              }).then(next);
-          };
-
-          return multer;
-        };
-
-        koaMulter(core).install();
-
-        [patchedKoaMulter] = core.depHooks.resolve
-          .withArgs(sinon.match({ name }))
-          .yield(koaMulterMock);
-
-      });
-
-      it('skip instrumentation if it is our of scope', async function () {
-        const ctx = {
-          req: {},
-          res: {}
-        };
-        const next = sinon.stub();
-        const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
-
-        await middleware(ctx, next);
-        expect(next).to.have.been.called;
-        expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      });
-
-      it('skip instrumentation if there are no files ', function () {
-        simulateRequestScope(async () => {
-          const ctx = {
-            req: {},
-            res: {}
-          };
-          const next = sinon.stub();
-          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
-
-          await middleware(ctx, next);
-          expect(next).to.have.been.called;
-          expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-        });
-      });
-
-      it('handle sources (file)', function () {
-        simulateRequestScope(async () => {
-          const ctx = {
-            req: {
-              file: {
-                property: 'file'
-              }
-            },
-            res: {}
-          };
-          const next = sinon.stub();
-          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
-
-          await middleware(ctx, next);
-          expect(next).to.have.been.called;
-          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-            context: 'req',
-            data: ctx.req,
-            keys: ['file'],
-            name: 'multer',
-            inputType: InputType.BODY,
-          });
-        });
-      });
-
-      it('handle sources (files)', function () {
-        simulateRequestScope(async () => {
-          const ctx = {
-            req: {
-              files: [
-                {
-                  property: 'file0'
-                },
-                {
-                  property: 'file1'
-                }
-              ]
-            },
-            res: {}
-          };
-
-          const next = sinon.stub();
-          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
-
-          await middleware(ctx, next);
-          expect(next).to.have.been.called;
-          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-            context: 'req.files',
-            data: ctx.req.files[0],
-            keys: [0],
-            name: 'multer',
-            inputType: InputType.BODY,
-          });
-          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-            context: 'req.files',
-            data: ctx.req.files[1],
-            keys: [1],
-            name: 'multer',
-            inputType: InputType.BODY,
-          });
-        });
-      });
-
-      it('handle sources (body)', function () {
-        simulateRequestScope(async () => {
-          const ctx = {
-            req: {
-              body: {
-                name: 'John'
-              }
-            },
-            res: {}
-          };
-
-          const next = sinon.stub();
-          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
-
-          await middleware(ctx, next);
-          expect(next).to.have.been.called;
-          expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-            context: 'req',
-            data: ctx.req,
-            keys: ['body'],
-            name: 'multer',
-            inputType: InputType.BODY,
-          });
-        });
-      });
-
-      it('should log error if there is an issue handling sources', function () {
-        simulateRequestScope(async () => {
-          const err = new Error();
-          const ctx = {
-            req: {
-              file: {
-                property: 'file'
-              }
-            },
-            res: {}
-          };
-          core.assess.dataflow.sources.handle.callsFake(() => {
-            throw err;
-          });
-
-          const next = sinon.stub();
-          const middleware = patchedKoaMulter({ dest: '/uploads' }).any('file');
-
-          await middleware(ctx, next);
-          expect(next).to.have.been.called;
-          expect(core.logger.error).to.have.been.calledWith({ err }, 'error handling Koa multer Assess dataflow %s.%s source', 'req', 'file');
-        });
-      });
-    });
-  });
-});

package/lib/dataflow/sources/install/koa/koa-routers.test.js

@@ -1,146 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const koaRouters = require('./koa-routers');
-
-describe('assess dataflow sources koa-router and @koa/router', function () {
-  let core,
-    simulateRequestScope,
-    routerMock,
-    legacyRouterMock,
-    params,
-    sources;
-
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sources = core.assess.dataflow.sources;
-    sinon.spy(sources, 'handle');
-    sinon.spy(core.patcher, 'patch');
-
-    params = { parameter: 'parsed-param' };
-    routerMock = {
-      prototype: {
-        params: (parameters) => parameters || {}
-      }
-    };
-
-    legacyRouterMock = {
-      prototype: {
-        params: (parameters) => parameters || {}
-      }
-    };
-    const mockDict = {
-      ['koa-router']: legacyRouterMock,
-      ['@koa/router']: routerMock,
-    };
-
-    core.depHooks.resolve.callsFake(function (desc, cb) {
-      const cbArg = mockDict[desc.name];
-      if (cbArg) {
-        cb(cbArg);
-      }
-    });
-
-    koaRouters(core).install();
-    core.patcher.patch.resetHistory();
-  });
-
-  it('calls patcher for every necessary instrumentation', function () {
-    koaRouters(core).install();
-    expect(core.patcher.patch).to.have.been.calledTwice;
-    expect(core.patcher.patch).to.have.been.calledWithMatch(legacyRouterMock.prototype, 'params', {
-      name: '[koa-router].layer.prototype',
-      patchType: 'assess-dataflow-source',
-      post: sinon.match.func
-    });
-    expect(core.patcher.patch).to.have.been.calledWithMatch(routerMock.prototype, 'params', {
-      name: '[@koa/router].layer.prototype',
-      patchType: 'assess-dataflow-source',
-      post: sinon.match.func
-    });
-  });
-
-  describe('koa routers post hook', function () {
-    let getParamsFn;
-    this.beforeEach(function () {
-      getParamsFn = function (routerName) {
-        return routerName == 'koa-router' ? legacyRouterMock.prototype.params : routerMock.prototype.params;
-      };
-    });
-    ['koa-router', '@koa/router'].forEach((router) => {
-      it(`[${router}] calls \`.handle\` when parsing is successful and in the right context`, function () {
-        const paramsFn = getParamsFn(router);
-        let sourceContext;
-
-        simulateRequestScope(() => {
-          paramsFn(params);
-
-          sourceContext = core.scopes.sources.getStore()?.assess;
-        });
-
-        expect(sources.handle).to.have.been.calledOnce;
-        expect(sources.handle).to.have.been.calledWithMatch({
-          context: 'ctx.params',
-          name: `[${router}].layer.prototype`,
-          stacktraceOpts: {
-            constructorOpt: sinon.match.func,
-            prependFrames: [sinon.match.func]
-          },
-          inputType: InputType.URL_PARAMETER,
-          data: { parameter: 'parsed-param' },
-          sourceContext
-        });
-      });
-
-      it(`[${router}] does not call \`.handle\` when there is no assess policy in request context`, function () {
-        const paramsFn = getParamsFn(router);
-
-        simulateRequestScope(() => {
-          paramsFn(params);
-        }, { assess: { policy: null } });
-
-        expect(sources.handle).not.to.have.been.called;
-      });
-
-      it('does not call `.handle` when the values are already tracked', function () {
-        const paramsFn = getParamsFn(router);
-
-        simulateRequestScope(() => {
-          const sourceContext = core.scopes.sources.getStore()?.assess;
-          sourceContext.parsedParams = true;
-
-          paramsFn(params);
-        });
-
-        expect(sources.handle).not.to.have.been.called;
-        expect(core.logger.trace).to.have.been.calledWith(
-          { inputType: InputType.URL_PARAMETER, funcKey: `assess-dataflow-source:[${router}].layer.prototype` },
-          'values already tracked',
-        );
-      });
-
-      it('handles a case with an error in the `.handle` method', function () {
-        const paramsFn = getParamsFn(router);
-        const err = new Error('test');
-
-        core.assess.dataflow.sources.handle = () => {
-          throw err;
-        };
-
-        simulateRequestScope(() => {
-          paramsFn(params);
-        });
-
-        expect(core.logger.error).to.have.been.calledWith(
-          { err, inputType: InputType.URL_PARAMETER, funcKey: `assess-dataflow-source:[${router}].layer.prototype` },
-          'unable to handle Koa source',
-        );
-      });
-    });
-  });
-});

package/lib/dataflow/sources/install/koa/koa2.test.js

@@ -1,145 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const koaInstr = require('./koa2');
-
-describe('assess dataflow  koa v2.x', function () {
-  let core,
-    simulateRequestScope,
-    koaMock,
-    nextStub,
-    query,
-    sources;
-
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sources = core.assess.dataflow.sources;
-    sinon.spy(sources, 'handle');
-    sinon.spy(core.patcher, 'patch');
-
-    query = { parameter: 'parsed-query' };
-    koaMock = {
-      prototype: {
-        middleware: [],
-        use: (newMiddleware) => {
-          newMiddleware && koaMock.prototype.middleware && koaMock.prototype.middleware.push(newMiddleware);
-        },
-      }
-    };
-
-    nextStub = sinon.stub();
-
-    koaInstr(core).install();
-    core.depHooks.resolve.yield(koaMock);
-    core.patcher.patch.resetHistory();
-  });
-
-  it('calls patcher for every necessary instrumentation', function () {
-    core.depHooks.resolve.yield(koaMock);
-
-    expect(core.patcher.patch).to.have.been.calledOnce;
-    expect(core.patcher.patch).to.have.been.calledWithMatch(koaMock.prototype, 'use', {
-      name: 'Koa.Application',
-      patchType: 'assess-dataflow-source',
-      pre: sinon.match.func
-    });
-  });
-
-  describe('contrastStartMiddleware', function () {
-    it('successfully injects contrastMiddleware', function () {
-      koaMock.prototype.use('test');
-
-      expect(koaMock.prototype.middleware.length).to.equal(2);
-      expect(koaMock.prototype.middleware[0]._isContrastStartMiddleware).to.be.true;
-    });
-
-    it('does not inject contrastMiddleware if there is one already injected', function () {
-      koaMock.prototype.middleware.push({ _isContrastStartMiddleware: true });
-      koaMock.prototype.use();
-
-      expect(koaMock.prototype.middleware.length).to.equal(1);
-    });
-
-    it('calls `.handle` if there is query on the ctx for `contrastStartMiddleware`', function () {
-      koaMock.prototype.use();
-
-      const contrastStartMiddleware = koaMock.prototype.middleware[0];
-      let sourceContext;
-
-      simulateRequestScope(() => {
-        contrastStartMiddleware({ query }, nextStub);
-
-        sourceContext = core.scopes.sources.getStore()?.assess;
-      });
-
-      expect(nextStub).to.have.been.calledOnce;
-      expect(sources.handle).to.have.been.calledOnce;
-      expect(sources.handle).to.have.been.calledWithMatch({
-        context: 'ctx.query',
-        name: 'Koa.Application',
-        stacktraceOpts: {
-          constructorOpt: sinon.match.func,
-        },
-        inputType: InputType.QUERYSTRING,
-        data: { parameter: 'parsed-query' },
-        sourceContext
-      });
-    });
-
-    it('does not call `.handle` if there is query on the ctx for `contrastStartMiddleware`, but we have already analyzed it', function () {
-      koaMock.prototype.use();
-
-      const contrastStartMiddleware = koaMock.prototype.middleware[0];
-
-      simulateRequestScope(() => {
-        const sourceContext = core.scopes.sources.getStore()?.assess;
-        sourceContext.parsedQuery = 'analyzed-query';
-        contrastStartMiddleware({ query }, nextStub);
-      });
-
-      expect(nextStub).to.have.been.calledOnce;
-      expect(sources.handle).not.to.have.been.called;
-    });
-
-    it('does not call `.handle` if there is no context', function () {
-      koaMock.prototype.use();
-
-      const contrastStartMiddleware = koaMock.prototype.middleware[0];
-
-      simulateRequestScope(() => {
-        contrastStartMiddleware({ query }, nextStub);
-      }, { assess: { policy: null } });
-
-      expect(nextStub).to.have.been.calledOnce;
-      expect(sources.handle).not.to.have.been.called;
-    });
-
-    it('handles a case with an error in the `.handle` method', function () {
-      koaMock.prototype.use();
-
-      const err = new Error('test');
-      const contrastStartMiddleware = koaMock.prototype.middleware[0];
-
-      core.assess.dataflow.sources.handle = () => {
-        throw err;
-      };
-
-      simulateRequestScope(() => {
-        contrastStartMiddleware({ query }, nextStub);
-      });
-
-      expect(core.logger.error).to.have.been.called;
-      expect(core.logger.error).to.have.been.calledWith(
-        { err, inputType: InputType.QUERYSTRING, funcKey: 'assess-dataflow-source:Koa.Application' },
-        'unable to handle Koa source',
-      );
-      expect(nextStub).to.have.been.calledOnce;
-      expect(nextStub).not.to.have.been.calledWith(err);
-    });
-  });
-});

package/lib/dataflow/sources/install/multer1.test.js

@@ -1,143 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { InputType } = require('@contrast/common');
-const multer = require('./multer1');
-
-describe('assess dataflow sources multer', function () {
-  let core,
-    simulateRequestScope,
-    multerMakeMiddlewareMock,
-    multerMiddlewareMock;
-
-  beforeEach(function () {
-    ({ core, simulateRequestScope } = initAssessFixture());
-
-    sinon.spy(core.patcher, 'patch');
-
-    core.assess.dataflow.sources.handle = sinon.stub();
-
-    multerMakeMiddlewareMock = function () {
-      return multerMiddlewareMock;
-    };
-
-    multerMiddlewareMock = function (req, res, next) {
-      next();
-    };
-
-    multer(core).install();
-
-    const [patchedFunction] = core.depHooks.resolve.yield(multerMakeMiddlewareMock);
-    multerMakeMiddlewareMock = patchedFunction;
-  });
-
-  it('skip instrumentation if it is out of scope', function () {
-    multerMakeMiddlewareMock()({}, {}, () => ({}));
-    expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-  });
-
-  it('skip instrumentation if there are no files ', function () {
-    simulateRequestScope(() => {
-      const nextFunction = sinon.stub();
-      const req = {};
-      const res = {};
-
-      multerMakeMiddlewareMock()(req, res, nextFunction);
-      expect(core.assess.dataflow.sources.handle).not.to.have.been.called;
-      expect(nextFunction).to.have.been.called;
-    });
-  });
-
-  it('handle sources', function () {
-    simulateRequestScope(() => {
-      const nextFunction = sinon.stub();
-      const file = {
-        property: 'file',
-      };
-      const files = [
-        {
-          property: 'files.0',
-        },
-        {
-          property: 'files.1',
-        },
-      ];
-
-      const body = {
-        name: 'John'
-      };
-
-      const req = {
-        file,
-        files,
-        body,
-      };
-      const res = {};
-
-      multerMakeMiddlewareMock()(req, res, nextFunction);
-
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-        context: 'req',
-        data: req,
-        keys: ['file'],
-        name: 'multer',
-        inputType: InputType.BODY,
-      });
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-        context: 'req.files',
-        data: files[0],
-        keys: [0],
-        name: 'multer',
-        inputType: InputType.BODY,
-      });
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-        context: 'req.files',
-        data: files[1],
-        keys: [1],
-        name: 'multer',
-        inputType: InputType.BODY,
-      });
-      expect(core.assess.dataflow.sources.handle).to.have.been.calledWithMatch({
-        context: 'req',
-        data: req,
-        keys: ['body'],
-        name: 'multer',
-        inputType: InputType.BODY,
-      });
-      expect(nextFunction).to.have.been.called;
-    });
-  });
-
-  it('should log error if there is an issue handling sources', function () {
-    simulateRequestScope(() => {
-      const nextFunction = sinon.stub();
-      const file = {
-        property: 'foo',
-      };
-      const req = { file };
-      const res = {};
-      const err = new Error();
-
-      core.assess.dataflow.sources.handle.callsFake(() => {
-        throw err;
-      });
-
-      multerMakeMiddlewareMock()(req, res, nextFunction);
-
-      expect(
-        core.assess.dataflow.sources.handle,
-      ).to.have.been.calledWithMatch({
-        context: 'req',
-        data: { file },
-        keys: ['file'],
-        name: 'multer',
-        inputType: InputType.BODY,
-      });
-
-      expect(core.logger.error).to.have.been.calledWith({ err }, 'error handling multer Assess dataflow %s.%s source', 'req', 'file');
-      expect(nextFunction).to.have.been.called;
-    });
-  });
-});