@contrast/assess 1.46.1 → 1.46.2

package/lib/dataflow/propagation/install/joi/string-schema.test.js

@@ -1,513 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-const { DataflowTag } = require('@contrast/common');
-
-describe('assess dataflow propagation joi string', function() {
-  let core, joi, tracker, trackString, simulateRequestScope, strInstr;
-
-  beforeEach(function() {
-    ({ core, simulateRequestScope, trackString } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/types/string.js', version: '>=17 <18' }).yields(require('joi-17/lib/types/string'));
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/types/keys.js', version: '>=17 <18' }).yields(require('joi-17/lib/types/keys'));
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/validator', version: '>=17 <18' }).yields(require('joi-17/lib/validator'));
-    core.depHooks.resolve.withArgs({ name: 'joi', file: 'lib/values.js', version: '>=17 <18' }).yields(require('joi-17/lib/values'));
-
-    require('./index')(core).install();
-    strInstr = require('../string')(core);
-    strInstr.install();
-    joi = require('joi-17');
-  });
-
-  afterEach(function() {
-    Object.keys(require.cache).forEach((key) => {
-      if (key.includes('joi')) {
-        delete require.cache[key];
-      }
-    });
-    strInstr.uninstall();
-  });
-
-  describe('Joi string-schema validator tests', function() {
-    const stringValidatorExamples = [
-      {
-        ruleNames: ['base64'],
-        validInput: 'VE9PTUFOWVNFQ1JFVFM=',
-        invalidInput: 'VE9PTUFOWVNFQ1JFVFM',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['guid'],
-        validInput: '8594cc30-171E-4a21-99ce-BC0DC55EDEE8',
-        invalidInput: '1',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['alphanum'],
-        validInput: 'abc123ABC',
-        invalidInput: '_&*"a',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['hex'],
-        validInput: '54455354',
-        invalidInput: 'z',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['isoDate'],
-        validInput: '2018-11-28T18:25:32.000Z',
-        invalidInput: '2018-28-11',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['isoDuration'],
-        validInput: 'P3Y6M4DT12H30M5S',
-        invalidInput: '2020/10/03',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['isoDuration'],
-        validInput: 'P3Y6M4DT12H30M5S',
-        invalidInput: 'P2020-08-06T12:30:00', // valid ISO 8061 format, but not supported in Joi
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['creditCard'],
-        validInput: '4111111111111111',
-        invalidInput: '0000000000000000',
-        expectedTags: DataflowTag.LIMITED_CHARS,
-      },
-      {
-        ruleNames: ['ip'],
-        validInput: '0.0.0.0',
-        invalidInput: '256.258.301.1',
-        expectedTags: DataflowTag.LIMITED_CHARS,
-      },
-      {
-        ruleNames: ['token'],
-        validInput: '_azAZ09',
-        invalidInput: '(-.-)Zzz...',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['hostname'],
-        validInput: 'www.contrastsecurity.com',
-        invalidInput: 'localhost:8000',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-      {
-        ruleNames: ['domain'],
-        validInput: 'www.contrastsecurity.com',
-        invalidInput: 'localhost:8000',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-    ];
-
-    // Testing individually rules and expected tags here, but keeping array structure for consistency
-    stringValidatorExamples.forEach(
-      ({ validInput, invalidInput = 'foo', expectedTags, ruleNames }) => {
-        const methodNames = ruleNames.map((n) => `${n}()`).join('.');
-
-        it(`tracked values passing validation for ${methodNames} will be tagged with ${expectedTags}`, function(done) {
-          simulateRequestScope(() => {
-            const tracked = trackString(validInput);
-            let schema = joi.string();
-            schema = schema[ruleNames[0]]();
-
-            // One check with validateAsync to make sure it works too
-            schema.validateAsync(tracked)
-              .then((validated) => {
-                const data = tracker.getData(validated);
-
-                expect(validInput).to.equal(validated);
-
-                expect(data.tags).to.deep.equal({
-                  [DataflowTag.UNTRUSTED]: [0, validInput.length - 1],
-                  [DataflowTag.STRING_TYPE_CHECKED]: [0, validInput.length - 1],
-                  [expectedTags]: [0, validInput.length - 1]
-                });
-
-                expect(data.moduleName).to.equal('joi');
-                expect(data.methodName).to.equal(`string.${ruleNames[0]}`);
-                done();
-              })
-              .catch(err => done(err));
-          });
-        });
-
-        it(`tracked values for ${methodNames} should not be tagged if not validated`, function() {
-          simulateRequestScope(() => {
-            const tracked = trackString(invalidInput);
-            let schema = joi.string();
-            schema = schema[ruleNames[0]]();
-
-            const validated = schema.validate(tracked);
-            const data = tracker.getData(validated.value);
-
-            expect(data.tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, invalidInput.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, invalidInput.length - 1],
-            });
-          });
-        });
-
-        it(`should not track the result of ${methodNames} if value is not tracked`, function() {
-          simulateRequestScope(() => {
-            let schema = joi.string();
-            schema = schema[ruleNames[0]]();
-
-            const validated = schema.validate(validInput);
-            const data = tracker.getData(validated.value);
-
-            expect(data).to.be.null;
-          });
-        });
-      }
-    );
-
-    ['custom', 'external'].forEach((method) => {
-      it(`should custom validate the result when ${method} validation passes with the same value`, function(done) {
-        simulateRequestScope(() => {
-          core.config.assess.trust_custom_validators = true;
-          const joiSchema = joi.string()[method](() => trackString('1234'));
-
-          const value = trackString('1234');
-
-          joiSchema.validateAsync(value)
-            .then((data) => {
-              const argInfo = tracker.getData(value);
-              const resInfo = tracker.getData(data);
-              expect(argInfo.methodName).to.include(`string.${method}`);
-              expect(argInfo.tags).to.deep.equal({
-                [DataflowTag.UNTRUSTED]: [0, 3],
-                [DataflowTag.STRING_TYPE_CHECKED]: [0, 3],
-                [DataflowTag.CUSTOM_VALIDATED]: [0, 3],
-              });
-              // with .external() the result is the original
-              // arg string instance when they are equal
-              if (method === 'external') {
-                expect(tracker.getData(data)).to.equal(argInfo);
-              } else {
-                expect(resInfo.methodName).to.include(`string.${method}`);
-                expect(resInfo.tags).to.deep.equal({
-                  [DataflowTag.UNTRUSTED]: [0, 3],
-                  [DataflowTag.CUSTOM_VALIDATED]: [0, 3],
-                });
-              }
-              done();
-            })
-            .catch(err => done(err));
-        });
-      });
-
-      it(`should custom validate only the result if it passes ${method} validation with a different value`, function(done) {
-        simulateRequestScope(() => {
-          core.config.assess.trust_custom_validators = true;
-          const joiSchema = joi.string()[method](() => trackString('5'));
-
-          const value = trackString('1234');
-
-          joiSchema.validateAsync(value)
-            .then((result) => {
-              const argInfo = tracker.getData(value);
-              const resultInfo = tracker.getData(result);
-
-              expect(argInfo.methodName).to.equal('string.validate');
-              expect(argInfo.tags).to.deep.equal({
-                [DataflowTag.UNTRUSTED]: [0, 3],
-                [DataflowTag.STRING_TYPE_CHECKED]: [0, 3],
-              });
-              expect(resultInfo.methodName).to.include(`string.${method}`);
-              expect(resultInfo.tags).to.deep.equal({
-                [DataflowTag.UNTRUSTED]: [0, 0],
-                [DataflowTag.CUSTOM_VALIDATED]: [0, 0],
-              });
-              done();
-            })
-            .catch(err => done(err));
-        });
-      });
-
-      it('should not propagate if the result is not tracked and different', function(done) {
-        simulateRequestScope(() => {
-          core.config.assess.trust_custom_validators = true;
-          const joiSchema = joi.string()[method](() => '5');
-
-          const value = trackString('1234');
-
-          joiSchema.validateAsync(value)
-            .then((result) => {
-              const argInfo = tracker.getData(value);
-              const resultInfo = tracker.getData(result);
-
-              expect(argInfo.methodName).to.equal('string.validate');
-              expect(argInfo.tags).to.deep.equal({
-                [DataflowTag.UNTRUSTED]: [0, 3],
-                [DataflowTag.STRING_TYPE_CHECKED]: [0, 3],
-              });
-              expect(resultInfo).to.be.null;
-              done();
-            })
-            .catch(err => done(err));
-        });
-      });
-    });
-
-    const stringCoercingExamples = [
-      {
-        ruleNames: ['lowercase'],
-        validInput: 'lorem ipsum',
-        invalidInput: 'Lorem Ipsum',
-        expectedTags: DataflowTag.UNTRUSTED,
-      },
-      {
-        ruleNames: ['uppercase'],
-        validInput: 'LOREM IPSUM',
-        invalidInput: 'Lorem Ipsum',
-        expectedTags: DataflowTag.UNTRUSTED,
-      },
-      {
-        ruleNames: ['isoDate'],
-        validInput: '2018-11-28T18:25:32.000Z',
-        invalidInput: '2018-28-11',
-        expectedTags: DataflowTag.ALPHANUM_SPACE_HYPHEN,
-      },
-    ];
-
-    stringCoercingExamples.forEach(
-      ({ validInput, invalidInput = 'foo', expectedTags, ruleNames }) => {
-        const methodNames = ruleNames.map((n) => `${n}()`).join('.');
-
-        it(`tracked values passing validation for ${methodNames} with coercion will be tagged with ${expectedTags}`, function() {
-          simulateRequestScope(() => {
-            const tracked = trackString(validInput);
-            let schema = joi.string();
-            schema = schema[ruleNames[0]]();
-
-            const validated = schema.validate(tracked, { convert: true });
-            const data = tracker.getData(validated.value);
-
-            expect(validated.value).to.equal(validInput);
-            expect(data.tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, validInput.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, validInput.length - 1],
-              [expectedTags]: [0, validInput.length - 1]
-            });
-          });
-        });
-
-        it(`tracked values passing validation for ${methodNames} without coercion will be tagged with ${expectedTags}`, function() {
-          simulateRequestScope(() => {
-            const tracked = trackString(validInput);
-            let schema = joi.string();
-            schema = schema[ruleNames[0]]();
-
-            const validated = schema.validate(tracked, { convert: false });
-            const data = tracker.getData(validated.value);
-
-            expect(validInput).to.equal(validated.value);
-            expect(data.tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, validInput.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, validInput.length - 1],
-              [expectedTags]: [0, validInput.length - 1]
-            });
-          });
-        });
-
-        it(`tracked values for ${methodNames} without coercion should not be tagged if not valid`, function() {
-          simulateRequestScope(() => {
-            const tracked = trackString(invalidInput);
-            let schema = joi.string();
-            schema = schema[ruleNames[0]]();
-
-            const validated = schema.validate(tracked, { convert: false });
-            const data = tracker.getData(validated.value);
-
-            expect(data.tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, invalidInput.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, invalidInput.length - 1],
-            });
-          });
-        });
-
-        it(`should not track the result of ${methodNames} if input value is not tracked`, function() {
-          simulateRequestScope(() => {
-            const schema = joi.string();
-
-            const validated = schema.validate(validInput);
-            const data = tracker.getData(validated.value);
-
-            expect(data).to.be.null;
-          });
-        });
-      }
-    );
-
-    [
-      {
-        ruleNames: ['isoDate'],
-        validInput: '2018-11-28T18:25:32.000Z',
-        invalidInput: '2018-28-11',
-      },
-      {
-        ruleNames: ['isoDate'],
-        validInput: '2018-11-28T18:25:32',
-        invalidInput: '002013-06-07T14:21:46.295Z',
-      },
-      {
-        ruleNames: ['isoDate'],
-        validInput: '2013-06-07T14:21:46.295+07:00',
-        invalidInput: '+2013-06-07T14:21:46.295Z',
-      },
-      {
-        ruleNames: ['isoDate'],
-        validInput: '+002013-06-07T14:21:46.295Z',
-        invalidInput: '2018-28-11T',
-      },
-      {
-        ruleNames: ['isoDate'],
-        validInput: '2013-06-07T24:00',
-        invalidInput: '2013-06-07T24:21',
-      },
-    ].forEach(({ validInput, invalidInput }) => {
-      it('should track isoDate when coercing', function() {
-        simulateRequestScope(() => {
-          const tracked = trackString(validInput);
-          let schema = joi.string();
-          schema = schema.isoDate();
-
-          const validated = schema.validate(tracked, { convert: true });
-          const data = tracker.getData(validated.value);
-
-          expect(data.tags).to.deep.equal({
-            [DataflowTag.UNTRUSTED]: [0, 23], // coerced isoDate has fixed size
-            [DataflowTag.STRING_TYPE_CHECKED]: [0, 23],
-            [DataflowTag.ALPHANUM_SPACE_HYPHEN]: [0, 23]
-          });
-        });
-      });
-
-      it('should not track, nor tag isoDate values if not validated', function() {
-        simulateRequestScope(() => {
-          const tracked = trackString(invalidInput);
-          let schema = joi.string();
-          schema = schema.isoDate();
-
-          const validated = schema.validate(tracked);
-          const data = tracker.getData(validated.value);
-
-          expect(data.tags).to.deep.equal({
-            [DataflowTag.UNTRUSTED]: [0, validated.value.length - 1], // coerced isoDate has fixed size
-            [DataflowTag.STRING_TYPE_CHECKED]: [0, validated.value.length - 1],
-          });
-        });
-      });
-    });
-
-    const chainedExamples = [
-      {
-        ruleNames: ['lowercase', 'guid'],
-        validInput: '8594cc30-171e-4a21-99ce-bc0dc55edee8',
-        invalidInput: '8594cc30',
-        expectedTags: [DataflowTag.ALPHANUM_SPACE_HYPHEN],
-      },
-      {
-        ruleNames: ['hex', 'alphanum'],
-        validInput: '8594cc30',
-        invalidInput: 'z~',
-        expectedTags: [DataflowTag.ALPHANUM_SPACE_HYPHEN],
-      },
-      {
-        ruleNames: ['creditCard', 'alphanum'],
-        validInput: '4111111111111111',
-        invalidInput: '0000000000000000',
-        expectedTags: [DataflowTag.LIMITED_CHARS, DataflowTag.ALPHANUM_SPACE_HYPHEN],
-      },
-      {
-        ruleNames: ['alphanum', 'creditCard'],
-        validInput: '4111111111111111',
-        invalidInput: '0000000000000000a',
-        expectedTags: [DataflowTag.LIMITED_CHARS, DataflowTag.ALPHANUM_SPACE_HYPHEN],
-        onFailureExpectedTags: [DataflowTag.ALPHANUM_SPACE_HYPHEN],
-      },
-      {
-        ruleNames: ['lowercase', 'token', 'alphanum'],
-        validInput: 'lowercharsonly',
-        invalidInput: 'valid_lowercase_alphanum_but_with_underscores',
-        expectedTags: [DataflowTag.ALPHANUM_SPACE_HYPHEN],
-        onFailureExpectedTags: [DataflowTag.ALPHANUM_SPACE_HYPHEN],
-      },
-      {
-        ruleNames: ['alphanum', 'lowercase', 'token'],
-        validInput: 'lowercharsonly',
-        invalidInput: 'valid_lowercase_alphanum_but_with_underscores',
-        expectedTags: [DataflowTag.ALPHANUM_SPACE_HYPHEN],
-      },
-    ];
-
-    chainedExamples.forEach(
-      ({
-        validInput,
-        invalidInput = 'foo',
-        expectedTags,
-        ruleNames,
-        onFailureExpectedTags = [],
-      }) => {
-        const methodNames = ruleNames.map((n) => `${n}()`).join('.');
-        const createTagsObj = (str, tags) => tags.reduce((acc, curr) => {
-          acc[curr] = [0, str.length - 1];
-
-          return acc;
-        }, {});
-
-        it(`tracked values passing validation for ${methodNames} chain will be tagged with ${expectedTags.join(', ')}`, function() {
-          simulateRequestScope(() => {
-            const tracked = trackString(validInput);
-            let schema = joi.string();
-
-            for (const name of ruleNames) {
-              schema = schema[name]();
-            }
-
-            const validated = schema.validate(tracked, { convert: false });
-            const data = tracker.getData(validated.value);
-
-            expect(validInput).to.equal(validated.value);
-
-            expect(data.tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, validated.value.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, validated.value.length - 1],
-              ...createTagsObj(validated.value, expectedTags)
-            });
-          });
-        });
-
-        it(`tracked values in ${methodNames} should not be tagged with failed chain validation`, function() {
-          simulateRequestScope(() => {
-            const tracked = trackString(invalidInput);
-            let schema = joi.string();
-
-            for (const name of ruleNames) {
-              schema = schema[name]();
-            }
-
-            const validated = schema.validate(tracked);
-            const data = tracker.getData(validated.value);
-
-            expect(data.tags).to.deep.equal({
-              [DataflowTag.UNTRUSTED]: [0, validated.value.length - 1],
-              [DataflowTag.STRING_TYPE_CHECKED]: [0, validated.value.length - 1],
-              ...createTagsObj(validated.value, onFailureExpectedTags)
-            });
-          });
-        });
-      }
-    );
-  });
-});
-
-

package/lib/dataflow/propagation/install/mongoose/index.test.js

@@ -1,42 +0,0 @@
-'use strict';
-
-const sinon = require('sinon');
-const { expect } = require('chai');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation mongoose', function () {
-  let core, instr;
-
-  beforeEach(function () {
-    ({ core } = initAssessFixture());
-    instr = core.assess.dataflow.propagation.mongooseInstrumentation;
-  });
-
-  const propagatorList = [
-    'schemaMap',
-    'schemaMixed',
-    'schemaString'
-  ];
-
-  it('composes different installers', function () {
-    propagatorList.forEach((name) => {
-      expect(instr[name]).to.have.property('install').and.be.a('function');
-    });
-  });
-
-  it('dispatches installation to sub-components', function () {
-    const installs = [];
-    propagatorList.forEach((name) => {
-      const instr = core.assess.dataflow.propagation.mongooseInstrumentation;
-      installs.push(sinon.stub(instr[name], 'install'));
-    });
-
-    instr.install();
-
-    expect(installs).to.have.lengthOf(propagatorList.length);
-    installs.forEach((installer) => {
-      expect(installer).to.have.been.called;
-    });
-  });
-});
-