@contrast/assess 1.57.0 → 1.58.1

package/lib/crypto-analysis/install/math.js

@@ -52,6 +52,7 @@ module.exports = function (core) {
           if (!getSinkContext(ruleId)) return;
 
           const event = eventFactory.createCryptoAnalysisEvent({
+            args: [],
             context: 'Math.random()',
             methodName: 'random',
             moduleName: 'global.Math',

package/lib/dataflow/propagation/install/string/concat.js

@@ -29,6 +29,27 @@ module.exports = function(core) {
     }
   } = core;
 
+  function iterateOverArgs(args, tags, history, globalOffset, isIteratingArray = false) {
+    const metadata = [];
+
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i];
+      const isArray = Array.isArray(arg);
+      if (isArray) return iterateOverArgs(arg, tags, history, globalOffset, true);
+
+      const strInfo = tracker.getData(arg);
+      if (strInfo) {
+        metadata.push({ tracked: true, value: arg });
+        history.add(strInfo);
+        tags = createAppendTags(tags, strInfo.tags, globalOffset);
+      } else {
+        metadata.push({ tracked: false, value: getAdjustedUntrackedValue(arg) });
+      }
+      globalOffset += `${arg}`.length + (isIteratingArray ? 1 : 0);
+    }
+    return [metadata, tags];
+  }
+
   return core.assess.dataflow.propagation.stringInstrumentation.concat = {
     install() {
       const name = 'String.prototype.concat';
@@ -66,25 +87,9 @@ module.exports = function(core) {
           const objInfo = tracker.getData(data.obj);
           const history = objInfo ? new Set([objInfo]) : new Set();
 
-          let globalOffset = typeof data.obj !== 'function' ? data.obj.length : 0;
-          const args = [];
-          let tags = objInfo?.tags;
-
-          for (const arg of data.args) {
-            const isArray = Array.isArray(arg);
-            // TODO NODE-3748: handle tag ranges when arg is an Array
-            const strInfo = tracker.getData(arg);
-            if (strInfo) {
-              args.push({ tracked: true, value: arg });
-              history.add(strInfo);
-              tags = createAppendTags(tags, strInfo.tags, globalOffset);
-            } else {
-              args.push({ tracked: false, value: getAdjustedUntrackedValue(arg) });
-            }
+          const globalOffset = typeof data.obj !== 'function' ? data.obj.length : 0;
 
-            // if arg is an Array, then `${arg}` causes arg.join to get called and cause unwanted propagation
-            globalOffset += isArray ? ArrayPrototypeJoin.call(arg).length : `${arg}`.length;
-          }
+          const [args, tags] = iterateOverArgs(data.args, objInfo?.tags, history, globalOffset);
 
           if (history.size) {
             const event = createPropagationEvent({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.57.0",
+  "version": "1.58.1",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,17 +20,17 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.34.0",
-    "@contrast/config": "1.49.0",
-    "@contrast/core": "1.54.0",
-    "@contrast/dep-hooks": "1.23.0",
+    "@contrast/common": "1.34.1",
+    "@contrast/config": "1.49.1",
+    "@contrast/core": "1.54.1",
+    "@contrast/dep-hooks": "1.23.1",
     "@contrast/distringuish": "^5.1.0",
-    "@contrast/instrumentation": "1.33.0",
-    "@contrast/logger": "1.27.0",
-    "@contrast/patcher": "1.26.0",
-    "@contrast/rewriter": "1.30.0",
-    "@contrast/route-coverage": "1.45.0",
-    "@contrast/scopes": "1.24.0",
+    "@contrast/instrumentation": "1.33.1",
+    "@contrast/logger": "1.27.1",
+    "@contrast/patcher": "1.26.1",
+    "@contrast/rewriter": "1.30.1",
+    "@contrast/route-coverage": "1.45.1",
+    "@contrast/scopes": "1.24.1",
     "semver": "^7.6.0"
   }
 }