@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/propagation/install/joi/ref.test.js

@@ -1,607 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { DataflowTag } = require('@contrast/common');
-
-describe('assess dataflow propagation joi string and ref', function() {
-  let core, joi, tracker, trackString, simulateRequestScope;
-
-  beforeEach(function() {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/types/string.js', version: '>=17 <18' }).yields(require('joi-17/lib/types/string'));
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/types/keys.js', version: '>=17 <18' }).yields(require('joi-17/lib/types/keys'));
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/validator', version: '>=17 <18' }).yields(require('joi-17/lib/validator'));
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/values.js', version: '>=17 <18' }).yields(require('joi-17/lib/values'));
-
-    require('./index')(core).install();
-    joi = require('joi-17');
-  });
-
-  afterEach(function() {
-    Object.keys(require.cache).forEach((key) => {
-      if (key.includes('joi')) {
-        delete require.cache[key];
-      }
-    });
-  });
-
-  describe('Validator tests for joi/lib/ref.js', function() {
-    const schemaMethods = ['object', 'object.keys'];
-
-    /**
-     * Builds a schema to be used in tests. Returns joi.object(data) or
-     * object().keys(data) based on `methods` arg.
-     * @param {string} methods dot-delimited path e.g. object or object.keys
-     * @param {object} schemaData data used to make schema
-     * @returns {object} the schema instance
-     */
-    function getSchema(methods, schemaData) {
-      return methods
-        .split('.')
-        .reduce(
-          (acc, method, i, arr) =>
-            acc[method](i === arr.length - 1 ? schemaData : undefined),
-          joi
-        );
-    }
-
-    schemaMethods.forEach((methods) => {
-      it(`untracked refs of tracked values will not be tracked (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.string().guid(),
-            b: joi.ref('a'),
-          });
-          const data = {
-            a: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            b: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
-          };
-
-          const result = schema.validate(data, { convert: false });
-          // result
-          makeAssertions(tracker.getData(result.value.a));
-          expect(tracker.getData(result.value.b)).to.be.null;
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a));
-          // validation outcome
-          expect(result.errors).to.be.undefined;
-        });
-      });
-
-      it(`untracked refs of tracked values will not be tracked (nested) (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: { aa: joi.string().guid() },
-            b: joi.ref('a.aa'),
-            c: { cc: { ccc: joi.ref('....a.aa') } },
-          });
-          const data = {
-            a: { aa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265') },
-            b: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
-            c: { cc: { ccc: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265' } },
-          };
-
-          const result = schema.validate(data, { convert: false });
-
-          // validation outcome
-          expect(result.errors).to.be.undefined;
-          // result
-          expect(tracker.getData(result.value.b)).to.be.null;
-          expect(tracker.getData(result.value.c.cc.ccc)).to.be.null;
-          makeAssertions(tracker.getData(result.value.a.aa));
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a.aa));
-        });
-      });
-
-      it(`tracked refs of tracked values should not be tracked when convert: true and mapped value is untracked (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.string().guid(),
-            b: joi.ref('a', {
-              map: [['fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265', 'foo']],
-            }),
-          });
-          const data = {
-            a: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            b: trackString('foo'),
-          };
-
-          const result = schema.validate(data, { convert: true });
-
-          // validation outcome
-          expect(result.errors).to.be.undefined;
-          // result
-          makeAssertions(tracker.getData(result.value.a));
-          expect(tracker.getData(result.value.b)).to.be.null;
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a));
-          // orig 'b' value's untracked as it's equal to an untracked value
-          expect(tracker.getData(data.b)).to.be.null;
-        });
-      });
-
-      it(`tracked refs of tracked values should not be tracked when convert: false and mapped value is untracked (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.string().guid(),
-            b: joi.ref('a', {
-              map: [['fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265', 'foo']],
-            }),
-          });
-          const data = {
-            a: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
-            b: trackString('foo'),
-          };
-
-          const result = schema.validate(data, { convert: false });
-
-          // result
-          expect(tracker.getData(result.value.a)).to.be.null;
-          expect(tracker.getData(result.value.b)).to.be.null;
-          // orig
-          expect(tracker.getData(data.b)).to.be.null;
-          // validation outcome
-          expect(result.errors).to.be.undefined;
-        });
-      });
-
-      it(`tracked refs of tracked values should also be validated (${methods})`, function(done) {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.string().guid(),
-            b: joi.ref('a'),
-          });
-          const data = {
-            a: trackString(
-              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'
-            ),
-            b: trackString(
-              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
-              {
-                tags: {
-                  [DataflowTag.UNTRUSTED]: [0, 35],
-                  [DataflowTag.CUSTOM]: [0, 35]
-                }
-              }
-            ),
-          };
-
-          // Check with validateAsync to make sure it works too
-          schema.validateAsync(data, {
-            convert: true,
-            abortEarly: false,
-          })
-            .then((result) => {
-              // result
-              makeAssertions(tracker.getData(result.a));
-              makeAssertions(tracker.getData(result.b));
-              // orig (target: A)
-              makeAssertions(tracker.getData(data.a));
-              makeAssertions(tracker.getData(data.b), {
-                tags: {
-                  [DataflowTag.UNTRUSTED]: [0, 35],
-                  [DataflowTag.CUSTOM]: [0, 35],
-                  [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 35],
-                  [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-                },
-              });
-              done();
-            })
-            .catch(err => done(err));
-        });
-      });
-
-      it(`tracked refs of tracked values should also be partially validated even if overall validation fails, { convert: true } (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.string().guid(),
-            b: joi.ref('a'),
-          });
-          // The last character of these guids are invalid, BUT the string() schema
-          // validation should still apply the string-type-checked tag
-          const data = {
-            a: trackString(
-              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-'
-            ),
-            b: trackString(
-              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-',
-              {
-                tags: {
-                  [DataflowTag.UNTRUSTED]: [0, 35],
-                  [DataflowTag.CUSTOM]: [0, 35]
-                }
-              }
-            ),
-          };
-
-          // We need abortEarly in order to have joi continue to validate ref,
-          // although the full validation of the target key fails
-          const result = schema.validate(data, {
-            convert: true,
-            abortEarly: false,
-          });
-
-          const overrides = {
-            name: 'Joi.string.validate',
-            tags: {
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-            },
-            methodName: 'string.validate'
-          };
-
-          // validation outcome
-          expect(result.error.details[0].message).to.equal(
-            '"a" must be a valid GUID'
-          );
-          // result
-          makeAssertions(tracker.getData(result.value.a), overrides);
-          makeAssertions(tracker.getData(result.value.b), overrides);
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a), overrides);
-          makeAssertions(tracker.getData(data.b), {
-            ...overrides,
-            tags: {
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.CUSTOM]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-            },
-          });
-        });
-      });
-
-      it(`tracked refs of tracked values should also be partially validated even if overall validation fails, { convert: false } (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.string().guid(),
-            b: joi.ref('a'),
-          });
-          // The last character of these guids are invalid, BUT the string() schema
-          // validation should still apply the string-type-checked tag
-          const data = {
-            a: trackString(
-              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-'
-            ),
-            b: trackString(
-              'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b2326-',
-              {
-                tags: {
-                  [DataflowTag.UNTRUSTED]: [0, 35],
-                  [DataflowTag.CUSTOM]: [0, 35]
-                }
-              }
-            ),
-          };
-
-          // We need abortEarly in order to have joi continue to validate ref,
-          // although the full validation of the target key fails
-          const result = schema.validate(data, {
-            convert: false,
-            abortEarly: false,
-          });
-
-          const overrides = {
-            name: 'Joi.string.validate',
-            tags: {
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-            },
-            methodName: 'string.validate'
-          };
-
-          // validation outcome
-          expect(result.error.details[0].message).to.equal(
-            '"a" must be a valid GUID'
-          );
-          // result
-          makeAssertions(tracker.getData(result.value.a), overrides);
-          makeAssertions(tracker.getData(result.value.b), {
-            ...overrides,
-            tags: {
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.CUSTOM]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-            },
-          });
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a), overrides);
-          makeAssertions(tracker.getData(data.b), {
-            ...overrides,
-            tags: {
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.CUSTOM]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-            },
-          });
-        });
-      });
-
-      it(`object refs where both target and ref are tracked - ref gets same validation tags (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.object({
-              aa: joi.object({
-                aaa: joi.string().guid(),
-              }),
-              foo: joi.string().guid(),
-            }),
-            b: joi.ref('a'),
-          });
-          const data = {
-            a: {
-              aa: {
-                aaa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-              },
-              foo: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            },
-            b: {
-              aa: {
-                aaa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-              },
-              foo: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            },
-          };
-
-          const result = schema.validate(data, { convert: false });
-
-          // validation outcome
-          expect(result.error).to.be.undefined;
-          //result
-          makeAssertions(tracker.getData(result.value.a.foo));
-          makeAssertions(tracker.getData(result.value.b.foo));
-
-          makeAssertions(tracker.getData(result.value.a.aa.aaa));
-          makeAssertions(tracker.getData(result.value.b.aa.aaa));
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a.foo));
-          makeAssertions(tracker.getData(data.b.foo));
-
-          makeAssertions(tracker.getData(data.a.aa.aaa));
-          makeAssertions(tracker.getData(data.b.aa.aaa));
-        });
-      });
-
-      it(`should tag the refs even when the target is not - (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: { aa: joi.string().guid() },
-            b: joi.ref('a.aa'),
-            c: { cc: { ccc: joi.ref('....a.aa') } },
-            d: { dd: { ddd: joi.ref('....a.aa') } },
-          });
-
-          const data = {
-            a: { aa: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265' },
-            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            c: { cc: { ccc: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265') } },
-            d: { dd: { ddd: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265' } },
-          };
-
-          const result = schema.validate(data, { convert: false });
-
-          // validation outcome
-          expect(result.error).to.be.undefined;
-          expect(tracker.getData(result.value.a)).to.be.null;
-          expect(tracker.getData(result.value.d.dd.ddd)).to.be.null;
-
-          makeAssertions(tracker.getData(result.value.b));
-          makeAssertions(tracker.getData(result.value.c.cc.ccc));
-        });
-      });
-
-      Object.entries({
-        base64: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: 'aGVsbG8=',
-        },
-        guid: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265',
-        },
-        alphanum: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: 'rtgtr2342',
-        },
-        hex: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: '54455354',
-        },
-        isoDate: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: '2018-11-28T18:25:32.000Z',
-        },
-        isoDuration: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: 'P3Y6M4DT12H30M5S',
-        },
-        token: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: '_azAZ09',
-        },
-        creditCard: {
-          tag: DataflowTag.LIMITED_CHARS,
-          value: '4111111111111111',
-        },
-        ip: {
-          tag: DataflowTag.LIMITED_CHARS,
-          value: '0.0.0.0',
-        },
-        hostname: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: 'www.contrastsecurity.com',
-        },
-        domain: {
-          tag: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-          value: 'www.contrastsecurity.com',
-        },
-      }).forEach(([key, { value, tag }]) => {
-        it(`should tag the refs even when the target is not - string schemas(${key}) (${methods})`, function() {
-          simulateRequestScope(() => {
-            const schema = getSchema(methods, {
-              a: { [key]: joi.string()[key]() },
-              [key]: joi.ref(`a.${key}`),
-            });
-
-            const data = {
-              a: { [key]: value },
-              [key]: trackString(value),
-            };
-
-            const result = schema.validate(data, { convert: false });
-
-            // validation outcome
-            expect(result.error).to.be.undefined;
-
-            expect(tracker.getData(result.value.a[key])).to.be.null;
-            const { tags } = tracker.getData(result.value[key]);
-            expect(tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, value.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, value.length - 1],
-              [tag]: [0, value.length - 1]
-            }
-            );
-          });
-        });
-      });
-
-      it(`ref used with adjust() option does merge the tags with the adjusted value (if any), { convert: true } (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema('object', {
-            a: joi.string().guid(),
-            b: joi.ref('a', {
-              adjust: (v) => v
-            }),
-          });
-          const data = {
-            a: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265', {
-              tags: {
-                [DataflowTag.UNTRUSTED]: [0, 35],
-                [DataflowTag.CUSTOM]: [0, 35]
-              }
-            }),
-          };
-
-          const result = schema.validate(data);
-
-          // validation result
-          expect(result.error).to.be.undefined;
-
-          const override = {
-            name: 'Joi.values.get',
-            methodName: 'values.get',
-            tags: {
-              [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35],
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.CUSTOM]: [0, 35]
-            }
-          };
-          // result
-          makeAssertions(tracker.getData(result.value.a), override);
-          makeAssertions(tracker.getData(result.value.b), override);
-          // orig
-          makeAssertions(tracker.getData(data.a), override);
-          makeAssertions(tracker.getData(data.b), override);
-        });
-      });
-
-      it(`tracked ref of tracked value gets validation tags using { in: true } (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi.array().items(joi.string().guid()),
-            b: joi.ref('a', { in: true }),
-            c: joi.string().guid(),
-            d: joi.ref('c', { in: true }),
-          });
-
-          const data = {
-            a: ['fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267', trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'), 'fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23263'],
-            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-            c: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
-            d: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
-          };
-
-          const result = schema.validate(data);
-
-          // validation result
-          expect(result.error).to.be.undefined;
-          // result
-          makeAssertions(tracker.getData(result.value.a[1]));
-          makeAssertions(tracker.getData(result.value.b));
-          makeAssertions(tracker.getData(result.value.c));
-          makeAssertions(tracker.getData(result.value.d));
-          // orig
-          makeAssertions(tracker.getData(data.a[1]));
-          makeAssertions(tracker.getData(data.b));
-          makeAssertions(tracker.getData(data.c));
-          makeAssertions(tracker.getData(data.d));
-        });
-      });
-
-      it(`tracked ref of tracked value gets validation tags using { iterables: true } (${methods})`, function() {
-        simulateRequestScope(() => {
-          const schema = getSchema(methods, {
-            a: joi
-              .object({
-                aa: joi.string().guid(),
-                bb: joi.string()
-              })
-              .cast('map'),
-            b: joi.ref('a.bb', { iterables: true }),
-          });
-          const data = {
-            a: {
-              aa: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23265'),
-              bb: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
-            },
-            b: trackString('fa2cdd9e-7eb0-4bb0-a37d-ddd4d9b23267'),
-          };
-
-          const result = schema.validate(data);
-
-          const overrides = {
-            name: 'Joi.string.validate',
-            methodName: 'string.validate',
-            tags: {
-              [DataflowTag.UNTRUSTED]: [0, 35],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, 35],
-            }
-          };
-          // validation outcome
-          expect(result.error).to.be.undefined;
-          // result
-          makeAssertions(tracker.getData(result.value.a.get('aa')));
-          makeAssertions(tracker.getData(result.value.b), overrides);
-          // orig (target: A)
-          makeAssertions(tracker.getData(data.a.aa));
-          makeAssertions(tracker.getData(data.b), overrides);
-        });
-      });
-    });
-  });
-
-  function makeAssertions(trackData, overrides = {}) {
-    const assertionValues = {
-      name: 'Joi.string.guid',
-      tags: {
-        [DataflowTag.UNTRUSTED]: [0, 35],
-        [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 35],
-        [DataflowTag.STRING_TYPE_CHECKED]: [0, 35]
-      },
-      moduleName: 'joi',
-      methodName: 'string.guid',
-      ...overrides
-    };
-    expect(trackData.name).to.equal(assertionValues.name);
-    expect(trackData.tags).to.deep.equal(assertionValues.tags);
-    expect(trackData.moduleName).to.equal(assertionValues.moduleName);
-    expect(trackData.methodName).to.equal(assertionValues.methodName);
-  }
-});
-
-