@contrast/assess 1.47.0 → 1.49.0

package/lib/dataflow/propagation/install/contrast-methods/add.js

@@ -15,6 +15,7 @@
 
 'use strict';
 
+const { isString } = require('@contrast/common');
 const { createAppendTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
@@ -40,7 +41,11 @@ module.exports = function(core) {
         // first get result, then following logic acts as post-hook in patcher speak
         const result = add(...args);
 
-        if (!result || !getPropagatorContext()) return result;
+        if (
+          !result ||
+          !isString(result) ||
+          !getPropagatorContext()
+        ) return result;
 
         const rInfo = tracker.getData(result);
         if (rInfo) {

package/lib/dataflow/propagation/install/fastify-send.js

@@ -21,26 +21,40 @@ module.exports = function (core) {
   const {
     depHooks,
     patcher,
-    assess: { getPropagatorContext }
   } = core;
 
   return core.assess.dataflow.propagation.fastifySend = {
     install() {
-      depHooks.resolve({ name: '@fastify/send', version: '<4', file: 'lib/SendStream.js' }, (_SendStream) => {
-        patcher.patch(_SendStream.prototype, 'sendFile', {
+      depHooks.resolve({ name: '@fastify/send', version: '<3', file: 'lib/SendStream.js' }, (SendStream) => {
+        patcher.patch(SendStream.prototype, 'sendFile', {
           name: '@fastify/send/lib/SendStream.js',
           patchType,
           usePerf: 'sync',
           pre(data) {
             const { args } = data;
-
-            if (!getPropagatorContext()) return;
-
+            // (†) This is a minimal propagator that just untracks the argument. There are
+            // no propagation events generated and no expensive tag range computations. We
+            // don't get the propagator context before proceeding since it could lead to false
+            // positives e.g. if the number of propagation events exceeds the configured limit.
             const untrackedPath = StringPrototypeSlice.call(` ${args[0]}`, 1);
             args[0] = untrackedPath;
           },
         });
       });
+
+      depHooks.resolve({ name: '@fastify/send', version: '>=3 <5', file: 'lib/send.js' }, (send) => {
+        patcher.patch(send, 'send', {
+          name: '@fastify/send/lib/send.js',
+          patchType,
+          usePerf: 'sync',
+          pre(data) {
+            const { args } = data;
+            // (†)
+            const untrackedPath = StringPrototypeSlice.call(` ${args[1]}`, 1);
+            args[1] = untrackedPath;
+          },
+        });
+      });
     }
   };
 };

package/lib/dataflow/propagation/install/send.js

@@ -21,7 +21,6 @@ module.exports = function (core) {
   const {
     depHooks,
     patcher,
-    assess: { getPropagatorContext }
   } = core;
 
   const send = {};
@@ -38,8 +37,10 @@ module.exports = function (core) {
           patchType,
           pre(data) {
             const { args } = data;
-            if (!getPropagatorContext()) return;
-
+            // This is a minimal propagator that just untracks the argument. There are
+            // no propagation events generated and no expensive tag range computations. We
+            // don't get the propagator context before proceeding since it could lead to false
+            // positives e.g. if the number of propagation events exceeds the configured limit.
             const untrackedPath = StringPrototypeSlice.call(` ${args[0]}`, 1);
             args[0] = untrackedPath;
           },

package/lib/dataflow/propagation/install/string/concat.js

@@ -32,30 +32,48 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.stringInstrumentation.concat = {
     install() {
       const name = 'String.prototype.concat';
+      const store = { name: `${name}:${patchType}`, lock: true };
 
       patcher.patch(String.prototype, 'concat', {
         name,
         patchType,
         usePerf: 'sync',
+        around(next, data) {
+          let hasArray = false;
+          for (let i = 0; i < data.args.length; i++) {
+            if (Array.isArray(data.args[i])) {
+              hasArray = true;
+              break;
+            }
+          }
+
+          // prevent propagation from happening in original concat method
+          // if arg is Array, since arg.join will be called on it.
+          if (hasArray && !core.scopes.instrumentation.isLocked())
+            return core.scopes.instrumentation.run(store, next);
+
+          return next();
+        },
         post(data) {
-          const { obj, result, hooked, orig } = data;
-          if (!result || !getPropagatorContext()) return;
+          if (!data.result || !getPropagatorContext()) return;
 
-          const rInfo = tracker.getData(result);
+          const rInfo = tracker.getData(data.result);
           if (rInfo) {
             // this may happen w/ trackedStr.concat('') => trackedStr
             return;
           }
 
-          const objInfo = tracker.getData(obj);
+          const objInfo = tracker.getData(data.obj);
           const history = objInfo ? new Set([objInfo]) : new Set();
-          let globalOffset = typeof obj !== 'function' ? obj.length : 0;
+
+          let globalOffset = typeof data.obj !== 'function' ? data.obj.length : 0;
           const args = [];
           let tags = objInfo?.tags;
 
           for (const arg of data.args) {
+            const isArray = Array.isArray(arg);
+            // TODO NODE-3748: handle tag ranges when arg is an Array
             const strInfo = tracker.getData(arg);
-
             if (strInfo) {
               args.push({ tracked: true, value: arg });
               history.add(strInfo);
@@ -64,12 +82,12 @@ module.exports = function(core) {
               args.push({ tracked: false, value: getAdjustedUntrackedValue(arg) });
             }
 
-            globalOffset += `${arg}`.length;
+            // if arg is an Array, then `${arg}` causes arg.join to get called and cause unwanted propagation
+            globalOffset += isArray ? ArrayPrototypeJoin.call(arg).length : `${arg}`.length;
           }
 
-
           if (history.size) {
-            const objVal = objInfo ? `'${objInfo.value}'` : getAdjustedUntrackedValue(obj);
+            const objVal = objInfo ? `'${objInfo.value}'` : getAdjustedUntrackedValue(data.obj);
             const context = `${objVal}.concat(${ArrayPrototypeJoin.call(args.map((a) => a.value))})`;
             const event = createPropagationEvent({
               name,
@@ -77,11 +95,11 @@ module.exports = function(core) {
               methodName: 'prototype.concat',
               context,
               object: {
-                value: objInfo?.value ?? getAdjustedUntrackedValue(obj),
+                value: objInfo?.value ?? getAdjustedUntrackedValue(data.obj),
                 tracked: !!objInfo
               },
               result: {
-                value: result,
+                value: data.result,
                 tracked: true
               },
               args,
@@ -90,19 +108,19 @@ module.exports = function(core) {
               source: objInfo ? (history.size > 1 ? 'A' : 'O') : 'P',
               target: 'R',
               stacktraceOpts: {
-                constructorOpt: hooked,
-                prependFrames: [orig]
+                constructorOpt: data.hooked,
+                prependFrames: [data.orig]
               },
             });
 
             if (!event) return;
-            const { extern } = tracker.track(result, event);
+            const { extern } = tracker.track(data.result, event);
 
             if (extern) {
               data.result = extern;
             }
           }
-        },
+        }
       });
     },
     uninstall() {

package/lib/dataflow/sources/install/hapi/hapi.js

@@ -31,7 +31,7 @@ module.exports = function (core) {
 
   const source = sources.hapiInstrumentation.hapi = {
     install() {
-      return depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <22' }, (hapi) => {
+      depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <22' }, (hapi) => {
         ['server', 'Server'].forEach((server) => {
           patcher.patch(hapi, server, {
             name: `hapi.${server}`,
@@ -40,7 +40,7 @@ module.exports = function (core) {
 
               server.ext('onRequest', (req, h) => {
                 const sourceContext = getSourceContext();
-                if (!sourceContext) return;
+                if (!sourceContext) return h.continue;
 
                 [
                   { key: 'query', inputType: InputType.QUERYSTRING, trackedFlag: 'parsedQuery' },
@@ -70,9 +70,10 @@ module.exports = function (core) {
                 });
                 return h.continue;
               });
+
               server.ext('onPostAuth', (req, h) => {
                 const sourceContext = core.scopes.sources.getStore()?.assess;
-                if (!sourceContext) return;
+                if (!sourceContext) return h.continue;
 
                 [
                   { key: 'state', inputType: InputType.COOKIE_VALUE, trackedFlag: 'parsedCookies' },

package/lib/dataflow/tag-utils.js

@@ -14,7 +14,7 @@
  */
 'use strict';
 
-const { primordials: { StringPrototypeSplit } } = require('@contrast/common');
+const { empties, primordials: { StringPrototypeSplit } } = require('@contrast/common');
 
 //
 // This module implements tag range manipulation functions. There are generally
@@ -295,7 +295,7 @@ function createMergedTags(firstTags, secondTags) {
 
 function mergeCore(firstTagRanges, secondTagRanges) {
   if (!firstTagRanges && !secondTagRanges) {
-    return [];
+    return empties.ARRAY;
   } else if (!firstTagRanges) {
     return [...secondTagRanges];
   } else if (!secondTagRanges) {
@@ -463,7 +463,7 @@ function createAdjustedQueryTags(path, tags, value, argString) {
       break;
     }
   }
-  return idx >= 0 ? createAppendTags([], tags, idx) : { ...tags };
+  return idx >= 0 ? createAppendTags(empties.OBJECT, tags, idx) : { ...tags };
 }
 
 /**

package/lib/event-factory.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { InputType, primordials: { StringPrototypeMatch } } = require('@contrast/common');
+const { InputType, empties, primordials: { StringPrototypeMatch } } = require('@contrast/common');
 const ANNOTATION_REGEX = /^(A|O|R|P|P\d+)$/;
 const SOURCE_EVENT_MSG = 'Source event not created: %s';
 const PROPAGATION_EVENT_MSG = 'Propagation event not created: %s';
@@ -33,37 +33,24 @@ module.exports = function (core) {
   eventFactory.createdEvents = new WeakSet();
 
   eventFactory.createSourceEvent = function (data = {}) {
-    const {
-      name,
-      result = { value: null, tracked: false },
-      tags,
-      inputType,
-      stack,
-    } = data;
-
-    if (!result.value) {
-      logger.debug({ name }, SOURCE_EVENT_MSG, 'invalid result');
+    if (!data.result?.value) {
+      logger.debug(SOURCE_EVENT_MSG, `invalid result: ${data.name}`);
       return null;
     }
-
-    if (!name) {
-      logger.debug({ name }, SOURCE_EVENT_MSG, 'invalid name');
+    if (!data.name) {
+      logger.debug(SOURCE_EVENT_MSG, `invalid name: ${data.name}`);
       return null;
     }
-
-    if (!(inputType in InputType)) {
-      logger.debug({ name }, SOURCE_EVENT_MSG, 'invalid inputType');
+    if (!(data.inputType in InputType)) {
+      logger.debug(SOURCE_EVENT_MSG, `invalid inputType: ${data.name}`);
       return null;
     }
-
-    if (!tags) {
-      logger.debug({ name }, SOURCE_EVENT_MSG, 'event has no tags');
+    if (!data.tags) {
+      logger.debug(SOURCE_EVENT_MSG, `event has no tags: ${data.name}`);
       return null;
     }
-
-
-    if (!stack || !Array.isArray(stack)) {
-      logger.debug({ name }, SOURCE_EVENT_MSG, 'invalid stack');
+    if (!data.stack || !Array.isArray(data.stack)) {
+      logger.debug(SOURCE_EVENT_MSG, `invalid stack: ${data.name}`);
       return null;
     }
 
@@ -74,205 +61,121 @@ module.exports = function (core) {
   };
 
   eventFactory.createPropagationEvent = function (data) {
-    const {
-      name = '',
-      moduleName,
-      methodName,
-      history = [],
-      object = { value: null, tracked: false },
-      args = [],
-      context,
-      result = { value: null, tracked: false },
-      tags = {},
-      addedTags = [],
-      removedTags = [],
-      source,
-      target,
-      stacktraceOpts
-    } = data;
-
     const sourceContext = sources.getStore()?.assess;
 
     if (!sourceContext) {
-      logger.debug({ name }, 'No sourceContext found during Propagation event creation');
+      logger.debug('No sourceContext found during Propagation event creation: %s', data.name);
       return null;
     }
-
     if (sourceContext.propagationEventsCount >= config.assess.max_propagation_events) {
-      logger.debug({ name }, 'Maximum number of Propagation events reached. Event not created');
+      logger.debug('Maximum number of Propagation events reached. Event not created: %s', data.name);
       return null;
     }
-
-    if (!name) {
-      logger.debug({ name }, PROPAGATION_EVENT_MSG, 'invalid name');
+    if (!data.name) {
+      logger.debug(PROPAGATION_EVENT_MSG, `invalid name (${data.name})`);
       return null;
     }
-
-    if (!history.length) {
-      logger.debug({ name }, PROPAGATION_EVENT_MSG, 'invalid history');
+    if (!data.history.length) {
+      logger.debug(PROPAGATION_EVENT_MSG, `invalid history (${data.name})`);
       return null;
     }
-
-    if (!source || !StringPrototypeMatch.call(source, ANNOTATION_REGEX)) {
-      logger.debug({ name }, PROPAGATION_EVENT_MSG, 'invalid source');
+    if (!data.source || !StringPrototypeMatch.call(data.source, ANNOTATION_REGEX)) {
+      logger.debug(PROPAGATION_EVENT_MSG, `invalid source (${data.name})`);
       return null;
     }
-
-    if (!target || !StringPrototypeMatch.call(target, ANNOTATION_REGEX)) {
-      logger.debug({ name }, PROPAGATION_EVENT_MSG, 'invalid target');
+    if (!data.target || !StringPrototypeMatch.call(data.target, ANNOTATION_REGEX)) {
+      logger.debug(PROPAGATION_EVENT_MSG, `invalid target (${data.name})`);
       return null;
     }
 
-    let stack;
     if (config.assess.stacktraces === 'ALL') {
-      stack = createSnapshot(stacktraceOpts)();
+      data.stack = createSnapshot(data.stacktraceOpts)();
     } else {
-      stack = [];
+      data.stack = empties.ARRAY;
     }
 
-    const event = {
-      addedTags,
-      args,
-      context,
-      history,
-      name,
-      moduleName,
-      methodName,
-      object,
-      removedTags,
-      result,
-      source,
-      stack,
-      tags,
-      target,
-      time: Date.now(),
-    };
+    data.args ??= empties.ARRAY;
+    data.addedTags ??= empties.ARRAY;
+    data.history ??= empties.ARRAY;
+    data.object ??= empties.UNTRACKED_VALUE_OBJ;
+    data.result ??= empties.UNTRACKED_VALUE_OBJ;
+    data.removedTags ??= empties.ARRAY;
+    data.time = Date.now();
 
-    eventFactory.createdEvents.add(event);
+    eventFactory.createdEvents.add(data);
     sourceContext.propagationEventsCount++;
 
-    return event;
+    return data;
   };
 
   eventFactory.createSinkEvent = function (data) {
-    const {
-      context,
-      name = '',
-      moduleName,
-      methodName,
-      history = [],
-      object = { value: null, tracked: false },
-      args = [],
-      result = { value: null, tracked: false },
-      tags = {},
-      source,
-      stacktraceOpts
-    } = data;
-
     const sourceContext = sources.getStore()?.assess;
+
     if (!sourceContext) {
-      logger.debug({ name }, 'no sourceContext found during sink event creation');
+      logger.debug('no sourceContext found during sink event creation: %s', data.name);
       return null;
     }
-    if (!name) {
-      logger.debug({ name }, 'no sink event name');
+    if (!data.name) {
+      logger.debug('no sink event name: %s', data.name);
       return null;
     }
-    if (!history.length) {
-      logger.debug({ name }, 'empty history for sink event');
+    if (!data.history.length) {
+      logger.debug('empty history for sink event: %s', data.name);
       return null;
     }
     if (
-      (!source || !StringPrototypeMatch.call(source, ANNOTATION_REGEX))
+      (!data.source || !StringPrototypeMatch.call(data.source, ANNOTATION_REGEX))
     ) {
-      logger.debug({ name }, 'malformed or missing sink event source field');
+      logger.debug('malformed or missing sink event source field: %s', data.name);
       return null;
     }
 
-    let stack;
     if (config.assess.stacktraces !== 'NONE') {
-      stack = createSnapshot(stacktraceOpts)();
+      data.stack = createSnapshot(data.stacktraceOpts)();
     } else {
-      stack = [];
+      data.stack = empties.ARRAY;
     }
 
-    const event = {
-      args,
-      context,
-      history,
-      name,
-      moduleName,
-      methodName,
-      object,
-      result,
-      source,
-      stack,
-      tags,
-      time: Date.now(),
-    };
+    data.args ??= empties.ARRAY;
+    data.history ??= empties.ARRAY;
+    data.object ??= empties.ARRAY;
+    data.result ??= empties.UNTRACKED_VALUE_OBJ;
+    data.time = Date.now();
 
-    eventFactory.createdEvents.add(event);
+    eventFactory.createdEvents.add(data);
 
-    return event;
+    return data;
   };
 
   eventFactory.createSessionEvent = function (data) {
-    const {
-      context,
-      name = '',
-      moduleName,
-      methodName,
-      object = { value: null, tracked: false },
-      args = [],
-      result = { value: null, tracked: false },
-      source,
-      stacktraceOpts,
-      framework,
-      options
-    } = data;
-
-    if (!name) {
-      logger.debug({ name }, 'no sink event name');
+    if (!data.name) {
+      logger.debug('no sink event name: %s', data.name);
       return null;
     }
-
     if (
-      (!source || !StringPrototypeMatch.call(source, ANNOTATION_REGEX))
+      (!data.source || !StringPrototypeMatch.call(data.source, ANNOTATION_REGEX))
     ) {
-      logger.debug({ name }, 'malformed or missing sink event source field');
+      logger.debug('malformed or missing sink event source field: %s', data.name);
       return null;
     }
-
-    let stack;
     if (config.assess.stacktraces !== 'NONE') {
-      stack = createSnapshot(stacktraceOpts)();
+      data.stack = createSnapshot(data.stacktraceOpts)();
     } else {
-      stack = [];
+      data.stack = empties.ARRAY;
     }
 
-    const event = {
-      args,
-      context,
-      history: [],
-      name,
-      moduleName,
-      methodName,
-      object,
-      result,
-      source,
-      stack,
-      tags: {},
-      time: Date.now(),
-      framework,
-      options,
-    };
+    data.args ??= empties.ARRAY;
+    data.history ??= empties.ARRAY;
+    data.obj ??= empties.UNTRACKED_VALUE_OBJ;
+    data.result ??= empties.UNTRACKED_VALUE_OBJ;
+    data.tags ??= empties.OBJECT;
+    data.time = Date.now();
 
-    eventFactory.createdEvents.add(event);
+    eventFactory.createdEvents.add(data);
 
-    return event;
+    return data;
   };
 
-
   /**
    * @param {{
    *  context: string,
@@ -288,32 +191,21 @@ module.exports = function (core) {
    * @returns {any}
    */
   eventFactory.createCryptoAnalysisEvent = function (data) {
-    const {
-      name = '',
-      source,
-      stacktraceOpts,
-    } = data;
-
-    if (!name) {
-      logger.debug({ name }, 'no sink event name');
+    if (!data.name) {
+      logger.debug('no sink event name: %s', data.name);
       return null;
     }
-
-    if (!source || !StringPrototypeMatch.call(source, ANNOTATION_REGEX)) {
-      logger.debug({ name }, 'malformed or missing sink event source field');
+    if (!data.source || !StringPrototypeMatch.call(data.source, ANNOTATION_REGEX)) {
+      logger.debug('malformed or missing sink event source field: %s', data.name);
       return null;
     }
-
-    let stack;
     if (config.assess.stacktraces !== 'NONE') {
-      stack = createSnapshot(stacktraceOpts)();
+      data.stack = createSnapshot(data.stacktraceOpts)();
     } else {
-      stack = [];
+      data.stack = empties.ARRAY;
     }
 
-    data.stack = stack;
     data.time = Date.now();
-
     eventFactory.createdEvents.add(data);
 
     return data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.47.0",
+  "version": "1.49.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,17 +20,17 @@
     "test": "../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.29.1",
-    "@contrast/config": "1.40.2",
-    "@contrast/core": "1.45.2",
-    "@contrast/dep-hooks": "1.14.2",
+    "@contrast/common": "1.31.0",
+    "@contrast/config": "1.42.0",
+    "@contrast/core": "1.47.0",
+    "@contrast/dep-hooks": "1.16.0",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.24.2",
-    "@contrast/logger": "1.18.2",
-    "@contrast/patcher": "1.17.2",
-    "@contrast/rewriter": "1.21.4",
-    "@contrast/route-coverage": "1.35.2",
-    "@contrast/scopes": "1.15.2",
+    "@contrast/instrumentation": "1.26.0",
+    "@contrast/logger": "1.20.0",
+    "@contrast/patcher": "1.19.0",
+    "@contrast/rewriter": "1.23.0",
+    "@contrast/route-coverage": "1.37.0",
+    "@contrast/scopes": "1.17.0",
     "semver": "^7.6.0"
   }
 }