@contrast/assess 1.5.0 → 1.7.0

package/lib/dataflow/event-factory.js

@@ -166,17 +166,22 @@ module.exports = function(core) {
 
     const sourceContext = sources.getStore()?.assess;
     if (!sourceContext) {
-      logger.debug('No sourceContext found during Sink event creation');
+      logger.debug('no sourceContext found during sink event creation');
       return null;
     }
-
     const signature = signatures.get(name);
+    if (!signature) {
+      logger.debug({ name }, 'no signature found for sink event name');
+      return null;
+    }
+    if (!history.length) {
+      logger.debug({ data }, 'empty history for sink event');
+      return null;
+    }
     if (
-      !signature ||
-      !history.length ||
       ((source && !source.match(annotationRegExp)) || (!source && !signature.source))
     ) {
-      logger.debug({ data }, 'Wrong sink event data submited. Sink event not created');
+      logger.debug({ data }, 'malformed or missing sink event source field');
       return null;
     }
 

package/lib/dataflow/propagation/index.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
   require('./install/sql-template-strings')(core);
   require('./install/unescape')(core);
   require('./install/querystring')(core);
+  require('./install/sequelize')(core);
 
   propagation.install = function() {
     callChildComponentMethodsSync(propagation, 'install');

package/lib/dataflow/propagation/install/contrast-methods/string.js

@@ -22,7 +22,9 @@ module.exports = function(core) {
     scopes: { sources, instrumentation },
     patcher,
     assess: {
-      dataflow: { tracker }
+      dataflow: {
+        tracker
+      },
     }
   } = core;
 
@@ -36,6 +38,7 @@ module.exports = function(core) {
 
           const arg = data.args[0];
           let argInfo = tracker.getData(arg);
+          if (tracker.getData(data.result)) return;
 
           if (data.obj && !argInfo) {
             argInfo = tracker.getData(data.result.toString());
@@ -46,6 +49,7 @@ module.exports = function(core) {
           }
 
           const { extern } = tracker.track(data.result, argInfo);
+
           if (extern) {
             data.result = extern;
           }

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { URL_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
@@ -47,7 +50,7 @@ module.exports = function(core) {
           // the result is not tracked, so we don't need to check for that
           const history = [argInfo];
           const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
-          delete newTags['url-encoded'];
+          delete newTags[URL_ENCODED];
 
           if (!Object.keys(newTags).length) return;
 
@@ -64,7 +67,7 @@ module.exports = function(core) {
             args: [{ value: argInfo.value, tracked: true }],
             tags: newTags,
             history,
-            removedTags: ['url-encoded'],
+            removedTags: [URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,
               prependFrames: [orig]

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { WEAK_URL_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../../tag-utils');
@@ -48,7 +51,7 @@ module.exports = function(core) {
             const history = [argInfo];
             const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-            newTags['weak-url-encoded'] = [0, result.length - 1];
+            newTags[WEAK_URL_ENCODED] = [0, result.length - 1];
 
             const event = createPropagationEvent({
               name: 'ejs.utils.escapeXML',
@@ -62,7 +65,7 @@ module.exports = function(core) {
               },
               args: [{ value: argInfo.value, tracked: true }],
               tags: newTags,
-              addedTags: ['weak-url-encoded'],
+              addedTags: [WEAK_URL_ENCODED],
               history,
               stacktraceOpts: {
                 constructorOpt: hooked,

package/lib/dataflow/propagation/install/encode-uri-component.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { URL_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
@@ -48,7 +51,7 @@ module.exports = function(core) {
           const history = [argInfo];
           const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-          newTags['url-encoded'] = [0, result.length - 1];
+          newTags[URL_ENCODED] = [0, result.length - 1];
 
           const event = createPropagationEvent({
             name: 'global.encodeURIComponent',
@@ -63,7 +66,7 @@ module.exports = function(core) {
             args: [{ value: argInfo.value, tracked: true }],
             tags: newTags,
             history,
-            addedTags: ['url-encoded'],
+            addedTags: [URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,
               prependFrames: [orig]

package/lib/dataflow/propagation/install/escape-html.js

@@ -15,10 +15,13 @@
 
 'use strict';
 
+const {
+  DataflowTag: { HTML_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
-const { patchType, createModuleLabel } = require('../common');
+const { patchType } = require('../common');
 
 module.exports = function(core) {
   const {
@@ -48,12 +51,12 @@ module.exports = function(core) {
             const history = [argInfo];
             const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-            newTags['html-encoded'] = [0, result.length - 1];
+            newTags[HTML_ENCODED] = [0, result.length - 1];
 
             const event = createPropagationEvent({
               name: 'escape-html',
               object: {
-                value: createModuleLabel('escape-html', version),
+                value: 'escape-html',
                 tracked: false
               },
               result: {
@@ -63,7 +66,7 @@ module.exports = function(core) {
               args: [{ value: argInfo.value, tracked: true }],
               tags: newTags,
               history,
-              addedTags: ['html-encoded'],
+              addedTags: [HTML_ENCODED],
               stacktraceOpts: {
                 constructorOpt: hooked,
                 prependFrames: [orig]

package/lib/dataflow/propagation/install/escape.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { WEAK_URL_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
@@ -46,7 +49,7 @@ module.exports = function(core) {
           const history = [argInfo];
           const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-          newTags['weak-url-encoded'] = [0, result.length - 1];
+          newTags[WEAK_URL_ENCODED] = [0, result.length - 1];
 
           const event = createPropagationEvent({
             name: 'global.escape',
@@ -61,7 +64,7 @@ module.exports = function(core) {
             args: [{ value: argInfo.value, tracked: true }],
             tags: newTags,
             history,
-            addedTags: ['weak-url-encoded'],
+            addedTags: [WEAK_URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,
               prependFrames: [orig]

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { HTML_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
@@ -48,7 +51,7 @@ module.exports = function(core) {
             const history = [argInfo];
             const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-            newTags['html-encoded'] = [0, result.length - 1];
+            newTags[HTML_ENCODED] = [0, result.length - 1];
 
             const event = createPropagationEvent({
               name: 'handlebars.Utils.escapeExpression',
@@ -62,7 +65,7 @@ module.exports = function(core) {
               },
               args: [{ value: argInfo.value, tracked: true }],
               tags: newTags,
-              addedTags: ['html-encoded'],
+              addedTags: [HTML_ENCODED],
               history,
               stacktraceOpts: {
                 constructorOpt: hooked,

package/lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { SQL_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
@@ -43,7 +46,7 @@ module.exports = function(core) {
       const history = [argInfo];
       const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-      newTags['sql-encoded'] = [0, result.length - 1];
+      newTags[SQL_ENCODED] = [0, result.length - 1];
 
       const event = createPropagationEvent({
         name: eventName,
@@ -57,7 +60,7 @@ module.exports = function(core) {
         },
         args: [{ value: argInfo.value, tracked: true }],
         tags: newTags,
-        addedTags: ['sql-encoded'],
+        addedTags: [SQL_ENCODED],
         history,
         stacktraceOpts: {
           constructorOpt: hooked,

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { WEAK_URL_ENCODED }
+} = require('@contrast/common');
 const {
   createFullLengthCopyTags
 } = require('../../tag-utils');
@@ -48,7 +51,7 @@ module.exports = function(core) {
             const history = [argInfo];
             const newTags = createFullLengthCopyTags(argInfo.tags, result.length);
 
-            newTags['weak-url-encoded'] = [0, result.length - 1];
+            newTags[WEAK_URL_ENCODED] = [0, result.length - 1];
 
             const event = createPropagationEvent({
               name: 'pug-runtime.escape',
@@ -62,7 +65,7 @@ module.exports = function(core) {
               },
               args: [{ value: argInfo.value, tracked: true }],
               tags: newTags,
-              addedTags: ['weak-url-encoded'],
+              addedTags: [WEAK_URL_ENCODED],
               history,
               stacktraceOpts: {
                 constructorOpt: hooked,

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -14,8 +14,13 @@
  */
 
 'use strict';
+
 const util = require('util');
 const querystring = require('querystring');
+const {
+  DataflowTag: { URL_ENCODED }
+} = require('@contrast/common');
+
 const { patchType } = require('../../common');
 const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
@@ -73,9 +78,9 @@ module.exports = function(core) {
           event.tags = createAppendTags(event.tags, resultInfo.tags, 0);
           Object.assign(resultInfo, event);
         }
-        if (event.tags['url-encoded']) {
-          delete event.tags['url-encoded'];
-          event.removedTags = ['url-encoded'];
+        if (event.tags[URL_ENCODED]) {
+          delete event.tags[URL_ENCODED];
+          event.removedTags = [URL_ENCODED];
         }
         const { extern } = resultInfo || tracker.track(result, event);
         if (extern) {

package/lib/dataflow/propagation/install/sequelize.js

@@ -0,0 +1,310 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  isString,
+  DataflowTag: { SQL_ENCODED },
+} = require('@contrast/common');
+const { patchType, createModuleLabel } = require('../common');
+
+module.exports = function (core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    depHooks,
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+  } = core;
+
+  function getFormatPostions(str) {
+    const positions = [];
+    let index = -1;
+
+    while ((index = str.indexOf('?', index + 1)) !== -1) {
+      positions.push(index);
+    }
+
+    return positions;
+  }
+
+  function getFormatNamedParametersPositions(str) {
+    const regex = /:(\w+)(?=[\s,;)]|$)/g;
+    const matches = str.matchAll(regex);
+
+    return Array.from(matches, (match) => ({ [match[1]]: match.index }));
+  }
+
+  return (core.assess.dataflow.propagation.sequelizeInstrumentation = {
+    install() {
+      depHooks.resolve(
+        { name: 'sequelize', file: 'lib/sql-string.js' },
+        (sqlString, version) => {
+          const origEscape = sqlString.escape;
+
+          patcher.patch(sqlString, 'escape', {
+            name: 'sequelize.escape',
+            patchType,
+            post(data) {
+              const { args, result, hooked, orig } = data;
+
+              if (
+                !result ||
+                !args[0] ||
+                !isString(args[0]) ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              ) return;
+
+              const argInfo = tracker.getData(args[0]);
+
+              if (!argInfo) return;
+
+              const resultInfo = tracker.getData(result);
+              if (!resultInfo) return;
+              const history = [argInfo];
+              const newTags = { ...resultInfo.tags };
+
+              newTags[SQL_ENCODED] = [0, result.length - 1];
+
+              const event = createPropagationEvent({
+                context: 'sequelize.escape',
+                name: 'sequelize/lib/sql-string.escape',
+                object: {
+                  value: createModuleLabel('sequelize/lib/sql-string.escape', version),
+                  tracked: false,
+                },
+                result: {
+                  value: resultInfo.value,
+                  tracked: true,
+                },
+                args: [{ value: argInfo.value, tracked: true }],
+                tags: newTags,
+                addedTags: [SQL_ENCODED],
+                source: 'P',
+                target: 'R',
+                history,
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              Object.assign(resultInfo, event);
+            },
+          });
+
+          patcher.patch(sqlString, 'format', {
+            name: 'Sequelize.Utils.format',
+            patchType,
+            post(data) {
+              const { args, result, hooked, orig } = data;
+              if (
+                !result ||
+                !args[0] ||
+                !isString(args[0]) ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const resultInfo = tracker.getData(result);
+              if (!resultInfo) {
+                return;
+              }
+
+              const positions = getFormatPostions(data.args[0]);
+              const firstArgInfo = tracker.getData(data.args[0]);
+
+              if (!positions.length) {
+                return;
+              }
+
+              const replacements = [].concat(data.args[1]);
+              let replacementsTrakced = false;
+              const [, , timezone, dialect] = data.args;
+              const len = positions.length;
+
+              const history = new Set();
+              const newTags = { ...resultInfo.tags };
+
+              for (let i = 0; i < len; i++) {
+                const replacementInfo = tracker.getData(replacements[i]);
+                // we don't need to run in a no instrumentation scope here since
+                // patcher will do so automatically since we're in a post hook
+                const escapedVal = origEscape(
+                  replacements[i],
+                  timezone,
+                  dialect,
+                  true // true is required to get format function behavior.
+                );
+
+                if (replacementInfo) {
+                  history.add(replacementInfo);
+                  newTags[SQL_ENCODED] = newTags[SQL_ENCODED] || [];
+                  replacementsTrakced = replacementsTrakced || true;
+                  newTags[SQL_ENCODED].push(positions[i], positions[i] + escapedVal.length - 1);
+                }
+                //update the string replacement poisitions based on current val length - it's replacing a ? in the origional string
+                if (i < len - 1) {
+                  for (let j = i + 1; j < len; j++) {
+                    positions[j] = positions[j] + escapedVal.length - 1;
+                  }
+                }
+              }
+
+              const event = createPropagationEvent({
+                context: 'Sequelize.Utils.format',
+                name: 'sequelize/lib/sql-string.format',
+                object: {
+                  value: createModuleLabel('sequelize/lib/sql-string.format', version),
+                  tracked: false,
+                },
+                result: {
+                  value: resultInfo.value,
+                  tracked: true,
+                },
+                args: [
+                  { value: firstArgInfo ? firstArgInfo.value : args[0], tracked: !!firstArgInfo },
+                  { value: replacements, tracked: replacementsTrakced },
+                  { value: timezone, tracked: false },
+                  { value: dialect, tracked: false }
+                ],
+                tags: newTags,
+                source: 'P1',
+                target: 'R',
+                addedTags: [SQL_ENCODED],
+                history: Array.from(history),
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              Object.assign(resultInfo, event);
+            },
+          });
+
+          patcher.patch(sqlString, 'formatNamedParameters', {
+            name: 'Sequelize.Utils.formatNamedParameters',
+            patchType,
+            post(data) {
+              const { args, result, hooked, orig } = data;
+
+              if (
+                !result ||
+                !args[0] ||
+                !isString(args[0]) ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const resultInfo = tracker.getData(result);
+              if (!resultInfo) {
+                return;
+              }
+
+              const positions = getFormatNamedParametersPositions(data.args[0]);
+              const firstArgInfo = tracker.getData(data.args[0]);
+
+              if (!positions.length) {
+                return;
+              }
+
+              const replacements = Object.assign({}, data.args[1]);
+              let replacementsTrakced = false;
+              const [, , timezone, dialect] = data.args;
+              const len = positions.length;
+
+              const history = new Set();
+              const newTags = { ...resultInfo.tags };
+
+              for (let i = 0; i < len; i++) {
+                const replacementKey = Object.keys(positions[i])[0];
+                const replacementInfo = tracker.getData(replacements[replacementKey]);
+                const escapedVal = origEscape(
+                  replacements[replacementKey],
+                  timezone,
+                  dialect,
+                  true // true is required to get format function behavior.
+                );
+
+                if (replacementInfo) {
+                  history.add(replacementInfo);
+                  newTags[SQL_ENCODED] = newTags[SQL_ENCODED] || [];
+                  replacementsTrakced = replacementsTrakced || true;
+                  newTags[SQL_ENCODED].push(Object.values(positions[i])[0], Object.values(positions[i])[0] + escapedVal.length - 1);
+                }
+
+                //update the string replacement poisitions based on current val length - it's replacing a :key with the string
+                if (i < len - 1) {
+                  for (let j = i + 1; j < len; j++) {
+                    const nextKey = Object.keys(positions[j])[0];
+                    positions[j] = {
+                      [nextKey]:
+                        positions[j][nextKey] - (replacementKey.length + 1) + escapedVal.length // add 1 for the ':'
+                    };
+                  }
+                }
+              }
+
+              const event = createPropagationEvent({
+                context: 'Sequelize.Utils.formatNamedParameters',
+                name: 'sequelize/lib/sql-string.formatNamedParameters',
+                object: {
+                  value: createModuleLabel('sequelize/lib/sql-string.formatNamedParameters', version),
+                  tracked: false,
+                },
+                result: {
+                  value: resultInfo.value,
+                  tracked: true,
+                },
+                args: [
+                  { value: firstArgInfo ? firstArgInfo.value : args[0], tracked: !!firstArgInfo },
+                  { value: replacements, tracked: replacementsTrakced },
+                  { value: timezone, tracked: false },
+                  { value: dialect, tracked: false }
+                ],
+                tags: newTags,
+                source: 'P1',
+                target: 'R',
+                addedTags: [SQL_ENCODED],
+                history: Array.from(history),
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) return;
+
+              Object.assign(resultInfo, event);
+            },
+          });
+        }
+      );
+    },
+  });
+};

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -15,6 +15,9 @@
 
 'use strict';
 
+const {
+  DataflowTag: { SQL_ENCODED }
+} = require('@contrast/common');
 const { patchType, createModuleLabel } = require('../common');
 
 module.exports = function(core) {
@@ -48,10 +51,8 @@ module.exports = function(core) {
               const resultInfo = tracker.getData(resultValue);
               if (!resultInfo) return;
               const history = [argInfo];
-              // const newTags = createFullLengthCopyTags(argInfo.tags, resultValue.length);
               const newTags = { ...resultInfo.tags };
-
-              newTags['sql-encoded'] = [0, resultValue.length - 1];
+              newTags[SQL_ENCODED] = [0, resultValue.length - 1];
 
               const event = createPropagationEvent({
                 name: 'sql-template-strings.SQL',
@@ -65,7 +66,7 @@ module.exports = function(core) {
                 },
                 args: [{ value: argInfo.value, tracked: true }],
                 tags: newTags,
-                addedTags: ['sql-encoded'],
+                addedTags: [SQL_ENCODED],
                 history,
                 stacktraceOpts: {
                   constructorOpt: hooked,

package/lib/dataflow/propagation/install/string/match.js

@@ -87,7 +87,7 @@ module.exports = function(core) {
           const hasCaptureGroups = 'groups' in result;
           for (let i = 0; i < result.length; i++) {
             const res = result[i];
-            if (!res) continue;
+            if (!res || res === obj) continue;
             const start = obj.indexOf(res, idx);
             idx += hasCaptureGroups ? 0 : res.length;
             const event = getPropagationEvent(data, res, objInfo, start);
@@ -101,7 +101,7 @@ module.exports = function(core) {
           if (hasCaptureGroups && result.groups) {
             Object.keys(result.groups).forEach((key) => {
               const res = result.groups[key];
-              if (!res) return;
+              if (!res || res === obj) return;
               const start = obj.indexOf(res);
               const event = getPropagationEvent(data, res, objInfo, start);
               if (event) {