@contrast/assess 1.46.1 → 1.46.3

package/lib/dataflow/propagation/install/string/substring.test.js

@@ -1,251 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation string substring', function () {
-  let core, tracker, trackString, simulateRequestScope;
-  const allPatcher = new Map();
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-    tracker = core.assess.dataflow.tracker;
-
-    core.assess.dataflow.propagation.stringInstrumentation.substring.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.stringInstrumentation.substring.uninstall();
-    sinon.resetHistory();
-  });
-
-  // eslint-disable-next-line mocha/no-sibling-hooks
-  afterEach(function() {
-    core.Perf.fromAllToMap('patcher', allPatcher);
-  });
-
-  after(function() {
-    const stats = core.Perf.getStats(allPatcher);
-    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
-      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
-    }
-  });
-
-  [
-    {
-      desc: 'below',
-      str: 'xx-----',
-      tags: {
-        untrusted: [0, 1]
-      },
-      args: [2],
-      expectedResult: '-----',
-    },
-    {
-      desc: 'above',
-      str: '-----xx',
-      tags: {
-        untrusted: [5, 6]
-      },
-      args: [0, 3],
-      result: '---',
-    },
-    {
-      desc: 'highspan',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: [1, 3],
-      expected: {
-        untrusted: [1, 2]
-      },
-      expectedResult: '-xx',
-    },
-    {
-      desc: 'within',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: [1],
-      expected: {
-        untrusted: [1, 3]
-      },
-      result: '-xxx--',
-    },
-    {
-      desc: 'fullSpan',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: [2, 2],
-      expected: {
-        untrusted: [0, 1]
-      },
-      result: 'xx',
-    },
-    {
-      desc: 'lowspan',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: [3, 3],
-      expected: {
-        untrusted: [0, 1]
-      },
-    },
-  ].forEach(({ desc, str, tags, args, expected }) => {
-    it(desc, function () {
-      simulateRequestScope(function () {
-        const extern = trackString(str, { tags });
-        const result = extern.substr(...args);
-        const strInfo = tracker.getData(result);
-
-        if (expected) {
-          expect(strInfo.tags).to.deep.equal(expected);
-        } else {
-          expect(strInfo).to.be.null;
-        }
-      });
-    });
-  });
-
-  [
-    {
-      desc: 'not tracked',
-      str: '-----------',
-      args: [0, 2],
-    },
-    {
-      desc: 'below',
-      str: 'xx-----',
-      tags: {
-        untrusted: [0, 1]
-      },
-      args: [2],
-    },
-    {
-      desc: 'above',
-      str: '-----xx',
-      tags: {
-        untrusted: [5, 6]
-      },
-      args: [0, 3],
-    },
-    {
-      desc: 'highspan',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: {
-        substring: [1, 3],
-        substr: [1, 2],
-      },
-      expected: {
-        untrusted: [1, 1]
-      },
-    },
-    {
-      desc: 'within',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: [1],
-      expected: {
-        untrusted: [1, 3]
-      },
-    },
-    {
-      desc: 'fullSpan',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: {
-        substring: [2, 4],
-        substr: [2, 2],
-      },
-      expected: {
-        untrusted: [0, 1]
-      },
-    },
-    {
-      desc: 'lowspan',
-      str: '--xxx--',
-      tags: {
-        untrusted: [2, 4]
-      },
-      args: [3, 6],
-      expected: {
-        untrusted: [0, 1]
-      },
-    },
-    {
-      desc: 'lowspan',
-      str: 'xxx--xx',
-      tags: {
-        untrusted: [0, 2, 5, 6]
-      },
-      args: {
-        substring: [3, 1], // reversed work the same
-        substr: [1, 3], // but not for substr method
-      },
-      expected: {
-        untrusted: [0, 1]
-      },
-    },
-  ].forEach(({ desc, str, tags, args, expected }) => {
-    ['substring', 'substr'].forEach((method) => {
-      it(`${method} ${desc}`, function () {
-        simulateRequestScope(function () {
-          const extern = desc !== 'not tracked' ? trackString(str, { tags }) : str;
-          const methodArgs = args[method] || args;
-          const result = extern[method](...methodArgs);
-          const strInfo = tracker.getData(result);
-
-          if (expected) {
-            expect(strInfo.tags).to.deep.equal(expected);
-          } else {
-            expect(strInfo).to.be.null;
-          }
-        });
-      });
-    });
-  });
-
-  it('won\'t do anything if the result is the same or not in proper scope', function () {
-    const extern = trackString('foo');
-
-    let result;
-
-    core.scopes.sources.run({}, function () {
-      result = extern.substring(5);
-    });
-
-    expect(tracker.getData(result)).to.be.null;
-
-    core.scopes.sources.run(null, function () {
-      result = extern.substr(0, 2);
-    });
-
-    expect(tracker.getData(result)).to.be.null;
-
-    core.scopes.instrumentation.run({ lock: true }, function () {
-      core.scopes.sources.run({}, function () {
-        result = extern.substring(0, 2);
-      });
-    });
-
-    expect(tracker.getData(result)).to.be.null;
-  });
-});

package/lib/dataflow/propagation/install/string/trim.test.js

@@ -1,135 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation string trim', function () {
-  let core, tracker, trackString, simulateRequestScope;
-  const allPatcher = new Map();
-
-  beforeEach(function () {
-    ({
-      core,
-      trackString,
-      simulateRequestScope,
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.stringInstrumentation.trim.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.stringInstrumentation.trim.uninstall();
-    sinon.resetHistory();
-  });
-
-  // eslint-disable-next-line mocha/no-sibling-hooks
-  afterEach(function() {
-    core.Perf.fromAllToMap('patcher', allPatcher);
-  });
-
-  after(function() {
-    const stats = core.Perf.getStats(allPatcher);
-    for (const [key, { n, totalMicros, mean }] of stats.entries()) {
-      console.log(key, n, totalMicros, 'nsec', mean, 'mean');
-    }
-  });
-
-  [
-    {
-      str: 'not-tracked',
-      expected: {
-        trim: undefined,
-        trimStart: undefined,
-        trimEnd: undefined,
-      }
-    },
-    {
-      str: '  foo  ',
-      tags: {},
-      expected: {
-        trim: undefined,
-        trimStart: undefined,
-        trimEnd: undefined,
-      }
-    },
-    {
-      str: '  foo  ',
-      tags: {
-        untrusted: [0, 6]
-      },
-      expected: {
-        trim: { untrusted: [0, 2] },
-        trimStart: { untrusted: [0, 4] },
-        trimEnd: { untrusted: [0, 4] },
-      }
-    },
-    {
-      str: '  foo',
-      tags: {
-        untrusted: [0, 4]
-      },
-      expected: {
-        trim: { untrusted: [0, 2] },
-        trimStart: { untrusted: [0, 2] },
-        trimEnd: { untrusted: [0, 4] },
-      }
-    },
-    {
-      str: 'foo  ',
-      tags: {
-        untrusted: [0, 4]
-      },
-      expected: {
-        trim: { untrusted: [0, 2] },
-        trimStart: { untrusted: [0, 4] },
-        trimEnd: { untrusted: [0, 2] },
-      }
-    },
-    {
-      str: '  foo  ',
-      tags: {
-        untrusted: [2, 4]
-      },
-      expected: {
-        trim: { untrusted: [0, 2] },
-        trimStart: { untrusted: [0, 2] },
-        trimEnd: { untrusted: [2, 4] },
-      }
-    },
-  ].forEach(({ str, tags, expected = null }) => {
-    [
-      'trim',
-      'trimStart',
-      'trimEnd',
-    ].forEach((method) => {
-      it(method, function () {
-        simulateRequestScope(function () {
-          const extern = str !== 'not-tracked' ? trackString(str, { tags }) : str;
-          const result = extern[method]();
-          expect(tracker.getData(result)?.tags).to.deep.equal(expected[method]);
-        });
-
-      });
-    });
-  });
-
-  it('won\'t do anything if not in proper scope', function () {
-    let result;
-    const extern = trackString('  foo', { tags: { untrusted: [0, 2] } });
-
-    core.scopes.sources.run(null, function () {
-      expect(tracker.getData(extern.trim())).to.be.null;
-    });
-
-
-    core.scopes.instrumentation.run({ lock: true }, function () {
-      core.scopes.sources.run({}, function () {
-        expect(tracker.getData(extern.trim())).to.be.null;
-      });
-    });
-
-    expect(tracker.getData(result)).to.be.null;
-  });
-});

package/lib/dataflow/propagation/install/unescape.test.js

@@ -1,78 +0,0 @@
-
-'use strict';
-
-const {
-  DataflowTag: { UNTRUSTED, WEAK_URL_ENCODED }
-} = require('@contrast/common');
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation unescape', function () {
-  let core, trackString, simulateRequestScope, tracker;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.unescape.install();
-  });
-
-  afterEach(function () {
-    core.assess.dataflow.propagation.unescape.uninstall();
-    sinon.resetHistory();
-  });
-
-  [
-    {
-      str: '%3Ftest%3Dstr',
-      tags: {
-        [UNTRUSTED]: [0, 12],
-        [WEAK_URL_ENCODED]: [0, 12]
-      },
-      expected: { [UNTRUSTED]: [0, 8] }
-    },
-    {
-      str: '?test=str',
-      tags: {
-        [UNTRUSTED]: [0, 8]
-      },
-      expected: { [UNTRUSTED]: [0, 8] }
-    },
-    {
-      str: 'not-tracked',
-    }
-  ].forEach(({ str, tags, expected }) => {
-    it('propagates correctly', function () {
-      simulateRequestScope(function () {
-        const value = tags ? trackString(str, { tags }) : str;
-
-        const result = unescape(value);
-        const strInfo = tracker.getData(result);
-        expect(strInfo?.tags).to.deep.equal(expected);
-      });
-    });
-  });
-
-  it('will not propagate if there is no assess policy in request context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('%3Ftest%3Dstr');
-      const result = unescape(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('%3Ftest%3Dstr');
-        const result = unescape(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-});

package/lib/dataflow/propagation/install/url/domain-parsers.test.js

@@ -1,63 +0,0 @@
-'use strict';
-
-const url = require('url');
-const { expect } = require('chai');
-const sinon = require('sinon');
-const { initAssessFixture } = require('@contrast/test/fixtures');
-
-describe('assess dataflow propagation url domain-parsers', function () {
-  let core, trackString, simulateRequestScope, tracker;
-
-  beforeEach(function () {
-    ({
-      core,
-      simulateRequestScope,
-      trackString
-    } = initAssessFixture());
-
-
-    tracker = core.assess.dataflow.tracker;
-    core.assess.dataflow.propagation.urlInstrumentation.domainParsers.install();
-    core.depHooks.resolve.yield(url);
-  });
-
-  afterEach(function () {
-    sinon.resetHistory();
-  });
-
-  ['domainToASCII', 'domainToUnicode'].forEach((method) => {
-    it(method, function () {
-      simulateRequestScope(function () {
-        const notTrackedValue = 'español.com';
-        const trackedValue = trackString('español.com', { tags: { untrusted: [0, 2] } });
-
-        const notTrackedResult = url[method](notTrackedValue);
-        const notTrackedStrInfo = tracker.getData(notTrackedResult);
-
-        const trackedResult = url[method](trackedValue);
-        const trackedStrInfo = tracker.getData(trackedResult);
-
-        expect(notTrackedStrInfo).to.be.null;
-        expect(trackedStrInfo?.tags).to.deep.equal({ untrusted: [0, trackedStrInfo?.value.length - 1] });
-      });
-    });
-  });
-
-  it('will not propagate if there is no assess store in request context', function () {
-    simulateRequestScope(function () {
-      const value = trackString('foo');
-      const result = url.domainToASCII(value);
-      expect(tracker.getData(result)).to.be.null;
-    }, { assess: { policy: null } });
-  });
-
-  it('will not propagate if there instrumentation is locked', function () {
-    simulateRequestScope(function () {
-      core.scopes.instrumentation.run({ lock: true }, function () {
-        const value = trackString('foo');
-        const result = url.domainToUnicode(value);
-        expect(tracker.getData(result)).to.be.null;
-      });
-    });
-  });
-});