@contrast/assess 1.53.0 → 1.54.0

package/lib/crypto-analysis/install/math.js

@@ -52,7 +52,6 @@ module.exports = function (core) {
           if (!getSinkContext(ruleId)) return;
 
           const event = eventFactory.createCryptoAnalysisEvent({
-            args: [],
             context: 'Math.random()',
             methodName: 'random',
             moduleName: 'global.Math',

package/lib/dataflow/propagation/common.js

@@ -15,12 +15,12 @@
 
 'use strict';
 
+const globalObject = {
+  value: 'global',
+  tracked: false
+};
+
 module.exports = {
   patchType: 'assess-dataflow-propagator',
-  createModuleLabel(name, version = '1.0.0') {
-    return `Module<${name}@${version}>`;
-  },
-  createObjectLabel(name, id = '0001') {
-    return `Object<${name}@${id}>`;
-  }
+  globalObject
 };

package/lib/dataflow/propagation/install/JSON/parse.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { isString } = require('@contrast/common');
-const { createSubsetTags } = require('../../../tag-utils');
+const { createSubsetTags, truncateStringValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 const { getKeyValueIndices } = require('./parse-fn');
 
@@ -68,8 +68,13 @@ module.exports = function (core) {
       }
     ].filter(Boolean);
 
+    if (!data.truncatedArg0)
+      data.truncatedArg0 = truncateStringValue(data.args[0]);
+
     return createPropagationEvent({
-      context: `${method}(${eventArgs.map((arg) => `'${arg.value}'`)})`,
+      get context() {
+        return `${method}(${eventArgs.map((arg, i) => i == 0 ? data.truncatedArg0 : `'${arg.value}'`)})`;
+      },
       name: method,
       history: [strInfo],
       moduleName: 'JSON',
@@ -87,7 +92,6 @@ module.exports = function (core) {
       tags: newTags,
       stacktraceOpts: {
         constructorOpt: data.hooked,
-        prependFrames: [data.orig],
       },
       source: 'P0',
       target: 'R',

package/lib/dataflow/propagation/install/JSON/stringify.js

@@ -26,7 +26,7 @@ const {
   }
 } = require('@contrast/common');
 const crypto = require('crypto');
-const { createMergedTags, getAdjustedUntrackedValue } = require('../../../tag-utils');
+const { createMergedTags, getAdjustedUntrackedValue, truncateStringValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
 
 function makeCanary() {
@@ -227,7 +227,7 @@ module.exports = function(core) {
           let tags = {};
           const vulnerableSources = [];
           if (!data.metadata?.propagate) {
-            return data.result;
+            return;
           }
 
           const { metadata } = data;
@@ -243,10 +243,12 @@ module.exports = function(core) {
           }
 
           data.result = ret;
-
+          const truncatedResult = truncateStringValue(ret);
           const method = 'JSON.stringify';
           const event = createPropagationEvent({
-            context: `${method}(${ret})`,
+            get context() {
+              return `${method}(${truncatedResult})`;
+            },
             name: method,
             moduleName: 'JSON',
             methodName: 'stringify',
@@ -272,13 +274,12 @@ module.exports = function(core) {
               })
             ].filter(Boolean),
             result: {
-              value: ret,
+              value: truncatedResult,
               tracked: true
             },
             tags,
             stacktraceOpts: {
               constructorOpt: data.hooked,
-              prependFrames: [data.orig]
             },
             source: vulnerableSources.length === 1 ? vulnerableSources[0] : 'P',
             target: 'R',

package/lib/dataflow/propagation/install/array-prototype-join.js

@@ -23,7 +23,6 @@ module.exports = function(core) {
   const {
     patcher,
     assess: {
-      inspect,
       getPropagatorContext,
       eventFactory: { createPropagationEvent },
       dataflow: { tracker }
@@ -70,7 +69,7 @@ module.exports = function(core) {
         patchType,
         usePerf: 'sync',
         post(data) {
-          const { args: origArgs, obj, result, hooked, orig } = data;
+          const { args: origArgs, obj, result, hooked } = data;
           if (!result || !getPropagatorContext()) return;
 
           const resultInfo = tracker.getData(result);
@@ -80,10 +79,9 @@ module.exports = function(core) {
           const initHistory = delimiterInfo ? new Set([delimiterInfo]) : new Set();
           const { newTags, newHistory: history } = accumulateTags(obj, {}, 0, initHistory, delimiterLength, delimiterInfo?.tags);
           const object = {
-            value: obj && ArrayPrototypeJoin.call(obj),
+            value: ArrayPrototypeJoin.call(obj),
             tracked: false
           };
-
           const args = [{
             value: delimiterInfo ? delimiterInfo.value : delimiter,
             tracked: !!delimiterInfo
@@ -94,7 +92,9 @@ module.exports = function(core) {
               name,
               moduleName: 'Array',
               methodName: 'prototype.join',
-              context: `${object.value}.join('${inspect(args[0].value) || ''})`,
+              get context() {
+                return `${object.value}.join('${args[0].value || ','}'})`;
+              },
               object,
               result: {
                 value: resultInfo ? resultInfo.value : result,
@@ -107,10 +107,8 @@ module.exports = function(core) {
               target: 'R',
               stacktraceOpts: {
                 constructorOpt: hooked,
-                prependFrames: [orig]
               },
             });
-
             if (!event) return;
 
             if (resultInfo) {
@@ -118,7 +116,6 @@ module.exports = function(core) {
             }
 
             const { extern } = resultInfo || tracker.track(result, event);
-
             if (extern) {
               data.result = extern;
             }

package/lib/dataflow/propagation/install/buffer.js

@@ -36,7 +36,7 @@ module.exports = function(core) {
         patchType,
         name,
         post(data) {
-          const { hooked, obj, orig, result } = data;
+          const { hooked, obj, result } = data;
 
           if (!result || !getPropagatorContext()) return;
 
@@ -49,7 +49,9 @@ module.exports = function(core) {
             args: data.args.map((a) => ({ tracked: false, value: a })),
             moduleName: 'Buffer',
             methodName: 'prototype.toString',
-            context: 'buffer.toString()',
+            get context() {
+              return 'buffer.toString()';
+            },
             object: { tracked: true, value: 'Buffer' },
             history: [bufferInfo],
             name,
@@ -61,7 +63,6 @@ module.exports = function(core) {
             tags: bufferInfo.tags,
             stacktraceOpts: {
               constructorOpt: hooked,
-              prependFrames: [orig]
             },
             target: 'R',
           });
@@ -122,7 +123,6 @@ module.exports = function(core) {
               tags: trkInfo.tags,
               stacktraceOpts: {
                 constructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
               target: 'R',
             });

package/lib/dataflow/propagation/install/contrast-methods/add.js

@@ -37,6 +37,7 @@ module.exports = function(core) {
       // patch for it, so we don't have to worry about managing patch execution order
       // (which patcher would do).
       const { add } = global.ContrastMethods;
+
       global.ContrastMethods.add = function(...args) {
         // first get result, then following logic acts as post-hook in patcher speak
         const result = add(...args);
@@ -56,6 +57,8 @@ module.exports = function(core) {
         const leftStringInfo = tracker.getData(args[0]);
         const rightStringInfo = tracker.getData(args[1]);
 
+        if (!leftStringInfo && !rightStringInfo) return result;
+
         let newTags = {};
         const history = [];
 
@@ -69,49 +72,50 @@ module.exports = function(core) {
           newTags = createAppendTags(newTags, rightStringInfo.tags, args[0].length);
         }
 
-        if (history.length) {
-          const leftArg = leftStringInfo ? leftStringInfo.value : args[0];
-          const rightArg = rightStringInfo ? rightStringInfo.value : args[1];
-          const event = createPropagationEvent({
-            args: [
-              {
-                tracked: !!leftStringInfo,
-                value: leftArg
-              },
-              {
-                tracked: !!rightStringInfo,
-                value: rightArg,
-              }
-            ],
-            context: `${inspect(leftArg)} + ${inspect(rightArg)}`,
-            moduleName: 'global',
-            methodName: 'ContrastMethods.add',
-            history,
-            object: {
-              value: 'String Addition',
-              tracked: false
-            },
-            name: 'ContrastMethods.add',
-            result: {
-              value: result,
-              tracked: true
+        const leftArg = leftStringInfo ? leftStringInfo.value : args[0];
+        const rightArg = rightStringInfo ? rightStringInfo.value : args[1];
+        const event = createPropagationEvent({
+          args: [
+            {
+              tracked: !!leftStringInfo,
+              value: leftArg
             },
-            source: 'P',
-            stacktraceOpts: {
-              constructorOpt: add,
-            },
-            tags: newTags,
-            target: 'R',
-          });
-
-          if (event) {
-            const { extern } = tracker.track(result, event);
-            if (extern) return extern;
-          }
+            {
+              tracked: !!rightStringInfo,
+              value: rightArg,
+            }
+          ],
+          get context() {
+            return `${inspect(leftArg)} + ${inspect(rightArg)}`;
+          },
+          moduleName: 'global',
+          methodName: 'ContrastMethods.add',
+          history,
+          object: {
+            value: 'String Addition',
+            tracked: false
+          },
+          name: 'ContrastMethods.add',
+          result: {
+            value: result,
+            tracked: true
+          },
+          source: 'P',
+          stacktraceOpts: {
+            constructorOpt: add,
+          },
+          tags: newTags,
+          target: 'R',
+        });
+
+        if (event) {
+          const { extern } = tracker.track(result, event);
+          if (extern) return extern;
         }
 
         return result;
       };
+
       global.ContrastMethods.add[origSym] = add;
     },
     uninstall() {

package/lib/dataflow/propagation/install/contrast-methods/string.js

@@ -66,7 +66,9 @@ module.exports = function(core) {
             name,
             moduleName: 'global',
             methodName: 'ContrastMethods.String',
-            context: `${name}('${argInfo.value}')`,
+            get context() {
+              return `${name}('${argInfo.value}')`;
+            },
             history,
             object: {
               tracked: !!objInfo,
@@ -80,7 +82,7 @@ module.exports = function(core) {
             },
             target: 'R',
             stacktraceOpts: {
-              prependFrames: [data.orig],
+              constructorOpt: data.hooked,
             },
             result: {
               value: data.result,

package/lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -73,7 +73,9 @@ module.exports = function(core) {
             resultData,
             createPropagationEvent({
               args,
-              context: `\`${context}\``,
+              get context() {
+                return `\`${context}\``;
+              },
               moduleName: 'global',
               methodName: 'ContrastMethods.tag',
               history: Array.from(history),

package/lib/dataflow/propagation/install/decode-uri-component.js

@@ -17,7 +17,7 @@
 
 const { DataflowTag: { URL_ENCODED } } = require('@contrast/common');
 const { createFullLengthCopyTags } = require('../../tag-utils');
-const { patchType, createObjectLabel } = require('../common');
+const { patchType, globalObject: object } = require('../common');
 
 module.exports = function(core) {
   const {
@@ -38,7 +38,7 @@ module.exports = function(core) {
         patchType,
         usePerf: 'sync',
         post(data) {
-          const { args, result, hooked, orig } = data;
+          const { args, result, hooked } = data;
           if (!result || !args[0] || !getPropagatorContext()) return;
 
           const argInfo = tracker.getData(args[0]);
@@ -61,11 +61,10 @@ module.exports = function(core) {
             name,
             moduleName: 'global',
             methodName: 'decodeURIComponent',
-            context: `decodeURIComponent('${argInfo.value}')`,
-            object: {
-              value: createObjectLabel('global'),
-              tracked: false
+            get context() {
+              return `decodeURIComponent('${argInfo.value}')`;
             },
+            object,
             result: {
               value: result,
               tracked: true
@@ -78,7 +77,6 @@ module.exports = function(core) {
             removedTags: [URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,
-              prependFrames: [orig]
             },
           });
 

package/lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -39,7 +39,7 @@ module.exports = function(core) {
           patchType,
           usePerf: 'sync',
           post(data) {
-            const { args, result, hooked, orig } = data;
+            const { args, result, hooked } = data;
             if (!result || !args[0] || !getPropagatorContext()) return;
 
             const argInfo = tracker.getData(args[0]);
@@ -54,7 +54,9 @@ module.exports = function(core) {
 
             const event = createPropagationEvent({
               name,
-              context: `ejs.utils.escapeXML('${argInfo.value}')`,
+              get context() {
+                return `ejs.utils.escapeXML('${argInfo.value}')`;
+              },
               moduleName: 'ejs',
               methodName: 'escapeXML',
               object: {
@@ -71,7 +73,6 @@ module.exports = function(core) {
               history,
               stacktraceOpts: {
                 constructorOpt: hooked,
-                prependFrames: [orig]
               },
               source: 'P',
               target: 'R',

package/lib/dataflow/propagation/install/ejs/template.js

@@ -37,7 +37,7 @@ module.exports = function (core) {
   } = core;
 
   /** @type {import('@contrast/rewriter').RewriteOpts} */
-  const REWRITE_OPTS = { isModule: false, inject: false, wrap: false };
+  const REWRITE_OPTS = { isModule: false, inject: false, wrap: false, minify: false };
   const WRAPPER_PREFIX = ArrayPrototypeJoin.call([
     'function tempWrapper() {',
     'function __append(s) { if (s !== undefined && s !== null) __output += s }'

package/lib/dataflow/propagation/install/encode-uri.js

@@ -19,7 +19,7 @@ const {
   DataflowTag: { URL_ENCODED, WEAK_URL_ENCODED }
 } = require('@contrast/common');
 const { createEscapeTagRanges } = require('../../tag-utils');
-const { patchType, createObjectLabel } = require('../common');
+const { patchType, globalObject: object } = require('../common');
 
 module.exports = function(core) {
   const {
@@ -49,7 +49,7 @@ module.exports = function(core) {
           patchType,
           usePerf: 'sync',
           post(data) {
-            const { args, result, hooked, orig } = data;
+            const { args, result, hooked } = data;
             if (!result || !args[0] || !getPropagatorContext()) return;
 
             const argInfo = tracker.getData(args[0]);
@@ -68,11 +68,10 @@ module.exports = function(core) {
               name,
               moduleName: 'global',
               methodName,
-              context: `${methodName}('${argInfo.value}')`,
-              object: {
-                value: createObjectLabel('global'),
-                tracked: false
+              get context() {
+                return `${methodName}('${argInfo.value}')`;
               },
+              object,
               result: {
                 value: result,
                 tracked: true
@@ -85,7 +84,6 @@ module.exports = function(core) {
               addedTags: [tag],
               stacktraceOpts: {
                 constructorOpt: hooked,
-                prependFrames: [orig]
               },
             });
 

package/lib/dataflow/propagation/install/escape-html.js

@@ -40,7 +40,7 @@ module.exports = function(core) {
           patchType,
           usePerf: 'sync',
           post(data) {
-            const { args, result, hooked, orig } = data;
+            const { args, result, hooked } = data;
             if (!result || !args[0] || !getPropagatorContext()) return;
 
             const argInfo = tracker.getData(args[0]);
@@ -57,7 +57,9 @@ module.exports = function(core) {
               name,
               moduleName: 'escape-html',
               methodName: '',
-              context: `escapeHtml(${argInfo.value})`,
+              get context() {
+                return `escapeHtml(${argInfo.value})`;
+              },
               object: {
                 value: 'escape-html',
                 tracked: false
@@ -74,7 +76,6 @@ module.exports = function(core) {
               addedTags: [HTML_ENCODED],
               stacktraceOpts: {
                 constructorOpt: hooked,
-                prependFrames: [orig]
               },
             });
 

package/lib/dataflow/propagation/install/escape.js

@@ -17,7 +17,7 @@
 
 const { DataflowTag: { WEAK_URL_ENCODED } } = require('@contrast/common');
 const { createFullLengthCopyTags } = require('../../tag-utils');
-const { patchType, createObjectLabel } = require('../common');
+const { patchType, globalObject: object } = require('../common');
 
 module.exports = function(core) {
   const {
@@ -38,7 +38,7 @@ module.exports = function(core) {
         patchType,
         usePerf: 'sync',
         post(data) {
-          const { args, result, hooked, orig } = data;
+          const { args, result, hooked } = data;
           if (!result || !args[0] || !getPropagatorContext()) return;
 
           const argInfo = tracker.getData(args[0]);
@@ -55,11 +55,10 @@ module.exports = function(core) {
             name,
             moduleName: 'global',
             methodName: 'escape',
-            context: `escape('${argInfo.value}')`,
-            object: {
-              value: createObjectLabel('global'),
-              tracked: false
+            get context() {
+              return `escape('${argInfo.value}')`;
             },
+            object,
             result: {
               value: resultInfo ? resultInfo.value : result,
               tracked: true
@@ -72,7 +71,6 @@ module.exports = function(core) {
             addedTags: [WEAK_URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,
-              prependFrames: [orig]
             },
           });
 

package/lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -40,7 +40,7 @@ module.exports = function(core) {
           patchType,
           usePerf: 'sync',
           post(data) {
-            const { args, result, hooked, orig } = data;
+            const { args, result, hooked } = data;
             if (!result || !args[0] || !getPropagatorContext()) return;
 
             const argInfo = tracker.getData(args[0]);
@@ -57,7 +57,9 @@ module.exports = function(core) {
               name,
               moduleName: 'handlebars',
               methodName: 'Utils.escapeExpression',
-              context: `${name}('${argInfo.value}')`,
+              get context() {
+                return `${name}('${argInfo.value}')`;
+              },
               object: {
                 value: 'handlebars.Utils',
                 tracked: false
@@ -74,7 +76,6 @@ module.exports = function(core) {
               target: 'R',
               stacktraceOpts: {
                 constructorOpt: hooked,
-                prependFrames: [orig]
               },
             });
 

package/lib/dataflow/propagation/install/joi/boolean.js

@@ -85,9 +85,7 @@ module.exports = function(core) {
             [ALPHANUM_SPACE_HYPHEN]: [0, argInfo.value.length - 1],
           },
           target: 'P0',
-          stacktraceOpts: {
-            prependFrames: [data.orig],
-          },
+          // todo: stacktraceOpts: {},
         });
 
         if (event) {

package/lib/dataflow/propagation/install/joi/expression.js

@@ -66,9 +66,7 @@ module.exports = function(core) {
               [HTML_ENCODED]: [0, argInfo.value.length - 1],
             },
             target: 'P0',
-            stacktraceOpts: {
-              prependFrames: [data.orig],
-            },
+            // stacktraceOpts: {},
           });
 
           if (event) {

package/lib/dataflow/propagation/install/joi/number.js

@@ -83,9 +83,7 @@ module.exports = function(core) {
             [LIMITED_CHARS]: [0, argInfo.value.length - 1],
           },
           target: 'P0',
-          stacktraceOpts: {
-            prependFrames: [data.orig],
-          },
+          // stacktraceOpts: {},
         });
 
         if (event) {

package/lib/dataflow/propagation/install/joi/string-schema.js

@@ -78,9 +78,7 @@ module.exports = function(core) {
           [tagName]: [0, strInfo.value.length - 1],
         },
         target: 'P0',
-        stacktraceOpts: {
-          prependFrames: [origFn],
-        },
+        // stacktraceOpts: {},
       });
 
       if (event) {
@@ -175,9 +173,7 @@ module.exports = function(core) {
           source: 'P0',
           tags: createFullLengthCopyTags(argInfo.tags, result.value.length),
           target: 'R',
-          stacktraceOpts: {
-            prependFrames: [data.orig],
-          },
+          // stacktraceOpts: {},
         });
 
         if (!event) return;

package/lib/dataflow/propagation/install/joi/utils.js

@@ -37,7 +37,7 @@ function getRefInstancesTrackingData(tracker, obj, refInstancesPaths) {
 }
 
 function tagCustomValidatedString(createPropagationEvent, strInfo, metadata) {
-  const { inspectedSecondArg, origFn, methodName, target } = metadata;
+  const { inspectedSecondArg, methodName, target } = metadata;
 
   if (!strInfo) return;
 
@@ -65,9 +65,7 @@ function tagCustomValidatedString(createPropagationEvent, strInfo, metadata) {
       [CUSTOM_VALIDATED]: [0, strInfo.value.length - 1],
     },
     target,
-    stacktraceOpts: {
-      prependFrames: [origFn],
-    },
+    // stacktraceOpts: {},
   });
 
   if (event) {

package/lib/dataflow/propagation/install/joi/values.js

@@ -127,9 +127,7 @@ module.exports = function(core) {
             source: 'P0',
             tags: mergedTags,
             target: 'A',
-            stacktraceOpts: {
-              prependFrames: [metadata.orig],
-            },
+            // stacktraceOpts: {},
           });
 
           if (event) {

package/lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -62,9 +62,7 @@ module.exports = function (core) {
         [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1],
       },
       target: 'P0',
-      stacktraceOpts: {
-        prependFrames: [orig],
-      },
+      // todo: stacktraceOpts
     });
 
     if (!event) return;

package/lib/dataflow/propagation/install/mongoose/schema-mixed.js

@@ -62,9 +62,7 @@ module.exports = function (core) {
         [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1],
       },
       target: 'P0',
-      stacktraceOpts: {
-        prependFrames: [orig],
-      },
+      // todo: stacktraceOpts: {},
     });
 
     if (!event) return;