@contrast/assess 1.7.0 → 1.9.0

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -18,6 +18,7 @@
 const {
   createAppendTags
 } = require('../../../tag-utils');
+const { inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 const htmlTagsLengths = {
   anchor: 11,
@@ -57,8 +58,9 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.htmlMethods = {
     install() {
+      const name = 'String.prototype.anchor';
       patcher.patch(String.prototype, 'anchor', {
-        name: 'String.prototype.anchor',
+        name,
         patchType,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
@@ -75,7 +77,10 @@ module.exports = function(core) {
 
           if (history.size) {
             const event = createPropagationEvent({
-              name: 'String.prototype.anchor',
+              name,
+              moduleName: 'String',
+              methodName: 'prototype.anchor',
+              context: `${inspect(objInfo?.value) || String(obj)}.anchor(${argInfo ? argInfo.value : arg})`,
               object: {
                 value: objInfo?.value || String(obj),
                 tracked: !!objInfo
@@ -85,7 +90,7 @@ module.exports = function(core) {
                 tracked: true
               },
               args: [
-                { value: arg, tracked: !!argInfo }
+                { value: argInfo ? argInfo.value : arg, tracked: !!argInfo }
               ],
               tags: adjustTags('anchor', objInfo?.tags, `${arg}`.length, argInfo?.tags),
               history: Array.from(history),
@@ -109,8 +114,10 @@ module.exports = function(core) {
       });
 
       ['big', 'blink', 'italics', 'small', 'strike', 'sub', 'fixed'].forEach((method) => {
+        const name = `String.prototype.${method}`;
+
         patcher.patch(String.prototype, method, {
-          name: `String.prototype.${method}`,
+          name,
           patchType,
           post(data) {
             const { obj, result, hooked, orig } = data;
@@ -123,7 +130,10 @@ module.exports = function(core) {
             const history = [objInfo];
 
             const event = createPropagationEvent({
-              name: `String.prototype.${method}`,
+              name,
+              moduleName: 'String',
+              methodName: `prototype.${method}`,
+              context: `${objInfo.value}.${method}()`,
               object: {
                 value: objInfo.value,
                 tracked: true

package/lib/dataflow/propagation/install/string/match.js

@@ -14,7 +14,7 @@
  */
 
 'use strict';
-const { join } = require('@contrast/common');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { createSubsetTags } = require('../../../tag-utils');
 
@@ -28,24 +28,29 @@ module.exports = function(core) {
   } = core;
 
   function getPropagationEvent(data, res, objInfo, start) {
-    const { name, args, result, hooked, orig } = data;
+    const { name, args: origArgs, result, hooked, orig } = data;
     const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
     if (!tags) return;
 
+    const args = origArgs.map((arg) => {
+      const argInfo = tracker.getData(arg);
+      return {
+        value: argInfo ? argInfo.value : inspect(arg),
+        tracked: !!argInfo
+      };
+    });
+
     return createPropagationEvent({
       name,
+      moduleName: 'String',
+      methodName: 'prototype.match',
+      context: `'${objInfo.value}'.match(${join(args.map(a => a.value), ', ')})`,
       history: [objInfo],
       object: {
         value: objInfo.value,
         tracked: true,
       },
-      args: args.map((arg) => {
-        const argInfo = tracker.getData(arg);
-        return {
-          value: argInfo ? argInfo.value : arg.toString(),
-          tracked: !!argInfo
-        };
-      }),
+      args,
       tags,
       result: {
         value: join(result),

package/lib/dataflow/propagation/install/string/replace.js

@@ -16,8 +16,11 @@
 'use strict';
 
 const {
-  DataflowTag: { UNTRUSTED }
+  DataflowTag: { UNTRUSTED },
+  match: origMatch,
+  substring
 } = require('@contrast/common');
+const { inspect, join } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
@@ -63,7 +66,7 @@ module.exports = function(core) {
         replace: str.substring(str.indexOf(match) + match.length, str.length)
       }
     ].forEach(({ regex, replace }) => {
-      if (ret && ret.match(regex)) {
+      if (ret && origMatch(ret, regex)) {
         // If the match string is tracked, we can actually use the patched replace
         // to keep track of its tag ranges
         if (tracker.getData(replace)) {
@@ -77,7 +80,7 @@ module.exports = function(core) {
     const numberedGroupMatches = replacementType !== 'function' && replacement.match(/\$[1-9][0-9]|\$[1-9]/g);
     if (numberedGroupMatches) {
       numberedGroupMatches.forEach((numberedGroup) => {
-        const group = Number(numberedGroup.substring(1));
+        const group = Number(substring(numberedGroup, 1));
         ret = origReplace.call(ret, numberedGroup, captureGroups[group - 1]);
       });
     }
@@ -130,8 +133,9 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.replace = {
     install() {
+      const name = 'String.prototype.replace';
       patcher.patch(String.prototype, 'replace', {
-        name: 'String.prototype.replace',
+        name,
         patchType,
         pre(data) {
           if (!sources.getStore()?.assess || instrumentation.isLocked()) return;
@@ -160,23 +164,27 @@ module.exports = function(core) {
             return;
           }
 
-          const { _replacementInfo, obj, args, result, hooked, orig } = data;
+          const { _replacementInfo, obj, args: origArgs, result, hooked, orig } = data;
+          const args = [{
+            value: inspect(origArgs[0]),
+            tracked: !!tracker.getData(origArgs[0])
+          },
+          {
+            value: data._replacement,
+            tracked: !!_replacementInfo
+          }];
 
           const event = createPropagationEvent({
-            name: 'String.prototype.replace',
+            name,
+            moduleName: 'String',
+            methodName: 'prototype.replace',
+            context: `'${obj}'.replace(${join(args.map(a => a.value), ', ')})`,
             history: Array.from(data._history),
             object: {
               value: obj,
               tracked: !!data._objInfo
             },
-            args: [{
-              value: args[0].toString(),
-              tracked: !!tracker.getData(args[0])
-            },
-            {
-              value: data._replacement,
-              tracked: !!_replacementInfo
-            }],
+            args,
             result: {
               value: result,
               tracked: true

package/lib/dataflow/propagation/install/string/slice.js

@@ -14,6 +14,7 @@
  */
 'use strict';
 const { patchType } = require('../../common');
+const { inspect, join } = require('@contrast/common');
 const { createSubsetTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
@@ -52,7 +53,7 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { name, args, obj, result, hooked, orig } = data;
+          const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !sources.getStore() || instrumentation.isLocked()) return;
 
           const objInfo = tracker.getData(obj);
@@ -68,22 +69,29 @@ module.exports = function(core) {
           const tags = createSubsetTags(objInfo.tags, startIdx, subsetLen);
           if (!tags) return;
 
+          const args = origArgs.map((arg) => ({
+            value: inspect(arg),
+            tracked: false
+          }));
+
           const event = createPropagationEvent({
             name,
+            moduleName: 'String',
+            methodName: 'prototype.slice',
+            context: `'${objInfo.value}'.slice(${join(args.map(a => a.value), ', ')})`,
             history: [objInfo],
             object: {
               value: obj,
               tracked: true,
             },
-            args: args.map((arg) => ({
-              value: arg.toString(),
-              tracked: false
-            })),
+            args,
             result: {
               value: result,
               tracked: true
             },
             tags,
+            source: 'O',
+            target: 'R',
             stacktraceOpts: {
               constructorOpt: hooked,
               prependFrames: [orig]

package/lib/dataflow/propagation/install/string/split.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { patchType } = require('../../common');
-const { join } = require('@contrast/common');
+const { join, inspect } = require('@contrast/common');
 const { createSubsetTags } = require('../../../tag-utils');
 
 
@@ -37,16 +37,16 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { name, args, obj, result, hooked, orig } = data;
+          const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (
             !obj ||
             !result ||
-            args.length === 0 ||
+            origArgs.length === 0 ||
             result.length === 0 ||
             !sources.getStore() ||
             typeof obj !== 'string' ||
             instrumentation.isLocked() ||
-            (args.length === 1 && args[0] == null)
+            (origArgs.length === 1 && origArgs[0] == null)
           ) return;
 
           const objInfo = tracker.getData(obj);
@@ -63,20 +63,24 @@ module.exports = function(core) {
               const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
               if (!tags) continue;
 
+              const args = origArgs.map((arg) => {
+                const argInfo = tracker.getData(arg);
+                return {
+                  value: argInfo ? argInfo.value : inspect(arg),
+                  tracked: !!argInfo
+                };
+              });
               const event = createPropagationEvent({
                 name,
+                moduleName: 'String',
+                methodName: 'prototype.slice',
+                context: `'${objInfo.value}'.split(${join(args.map(a => a.value), ', ')})`,
                 history: [objInfo],
                 object: {
                   value: obj,
                   tracked: true,
                 },
-                args: args.map((arg) => {
-                  const argInfo = tracker.getData(arg);
-                  return {
-                    value: argInfo ? argInfo.value : arg.toString(),
-                    tracked: !!argInfo
-                  };
-                }),
+                args,
                 tags,
                 result: {
                   value: join(result),

package/lib/dataflow/propagation/install/string/substring.js

@@ -16,6 +16,7 @@
 'use strict';
 
 const { createSubsetTags } = require('../../../tag-utils');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
@@ -60,8 +61,8 @@ module.exports = function(core) {
           name: `String.prototype.${method}`,
           patchType,
           post(data) {
-            const { obj, args, result, name, hooked, orig } = data;
-            if (!result || !sources.getStore() || instrumentation.isLocked()) return;
+            const { obj, args: origArgs, result, name, hooked, orig } = data;
+            if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
 
             const objInfo = tracker.getData(obj);
             if (!objInfo) return;
@@ -78,17 +79,21 @@ module.exports = function(core) {
 
             if (!tags) return;
 
+            const args = origArgs.map((arg) => ({
+              value: inspect(arg),
+              tracked: false
+            }));
             const event = createPropagationEvent({
               name,
+              moduleName: 'String',
+              methodName: 'prototype.substring',
+              context: `'${objInfo.value}'.substring(${join(args.map(a => a.value), ', ')})`,
               history: [objInfo],
               object: {
                 value: obj,
                 tracked: true,
               },
-              args: args.map((arg) => ({
-                value: arg.toString(),
-                tracked: false
-              })),
+              args,
               result: {
                 value: result,
                 tracked: true
@@ -101,6 +106,11 @@ module.exports = function(core) {
               },
               target: 'R',
             });
+
+            if (!event) {
+              return;
+            }
+
             const { extern } = tracker.track(result, event);
 
             if (extern) {

package/lib/dataflow/propagation/install/string/trim.js

@@ -60,6 +60,9 @@ module.exports = function(core) {
 
       const event = createPropagationEvent({
         name: `String.prototype.${methodName}`,
+        moduleName: 'String',
+        methodName: `prototype.${methodName}`,
+        context: `'${obj}'.${methodName}()`,
         history,
         object: {
           value: obj,

package/lib/dataflow/propagation/install/unescape.js

@@ -34,8 +34,10 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.unescape = {
     install() {
+      const name = 'global.unescape';
+
       patcher.patch(global, 'unescape', {
-        name: 'global.unescape',
+        name,
         patchType,
         post(data) {
           const { args, result, hooked, orig } = data;
@@ -53,7 +55,10 @@ module.exports = function(core) {
           if (!Object.keys(newTags).length) return;
 
           const event = createPropagationEvent({
-            name: 'global.unescape',
+            name,
+            moduleName: 'global',
+            methodName: 'unescape',
+            context: `unescape('${argInfo.value}')`,
             object: {
               value: createObjectLabel('global'),
               tracked: false
@@ -65,6 +70,8 @@ module.exports = function(core) {
             args: [{ value: argInfo.value, tracked: true }],
             tags: newTags,
             history,
+            source: 'P',
+            target: 'R',
             removedTags: [WEAK_URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -34,8 +34,10 @@ module.exports = function(core) {
     install() {
       depHooks.resolve({ name: 'url' }, (url, version) => {
         ['domainToASCII', 'domainToUnicode'].forEach((method) => {
+          const name = `url.${method}`;
+
           patcher.patch(url, method, {
-            name: `url.${method}`,
+            name,
             patchType,
             post(data) {
               const { args, result, hooked, orig } = data;
@@ -49,7 +51,10 @@ module.exports = function(core) {
               const history = [argInfo];
 
               const event = createPropagationEvent({
-                name: `url.${method}`,
+                name,
+                moduleName: 'url',
+                methodName: method,
+                context: `url.${method}('${argInfo.value}')`,
                 object: {
                   value: createModuleLabel('url', version),
                   tracked: false

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -30,9 +30,12 @@ module.exports = function(core) {
   function createValidatorPropagationEvent(method, data, trackingData, newTags, target) {
     return createPropagationEvent({
       name: `validator.${method}`,
+      moduleName: 'validator',
+      methodName: method,
+      context: `validator.${method}('${trackingData.value}')`,
       history: [{ ...trackingData }],
       args: [{
-        value: data.args[0],
+        value: trackingData.value,
         tracked: true
       }],
       result: {
@@ -59,8 +62,9 @@ module.exports = function(core) {
           { name: 'validator', file: `lib/${validator}` },
           (index) => {
             const patchFn = typeof index === 'object' ? index.default : index;
+            const name = `validator.${validator}`;
             return patcher.patch(patchFn, {
-              name: `validator.${validator}`,
+              name,
               patchType,
               post(data) {
                 const matches = validator === 'matches';