@contrast/assess 1.73.0 → 1.74.0

package/lib/dataflow/sinks/install/child-process.js

@@ -51,8 +51,7 @@ module.exports = function(core) {
     command,
     secondArg,
     thirdArg,
-    hooked,
-    orig
+    hooked
   ) {
     const strInfo = tracker.getData(command);
     if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags))
@@ -91,7 +90,6 @@ module.exports = function(core) {
       source: 'P0',
       stacktraceOpts: {
         constructorOpt: hooked,
-        prependFrames: [orig],
       },
     });
 
@@ -120,8 +118,7 @@ module.exports = function(core) {
     commandInfo,
     origArgs,
     options,
-    hooked,
-    orig
+    hooked
   ) {
     if (!Array.isArray(origArgs) || !origArgs?.length) return;
 
@@ -177,7 +174,6 @@ module.exports = function(core) {
       source: 'P1',
       stacktraceOpts: {
         contructorOpt: hooked,
-        prependFrames: [orig],
       },
     });
 

package/lib/dataflow/sinks/install/express/reflected-xss.js

@@ -113,7 +113,6 @@ module.exports = function(core) {
               source: 'P0',
               stacktraceOpts: {
                 constructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -112,7 +112,6 @@ module.exports = function(core) {
               source: 'P0',
               stacktraceOpts: {
                 constructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -140,7 +140,6 @@ module.exports = function(core) {
               source: `P${valueIndex}`,
               stacktraceOpts: {
                 constructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/fs.js

@@ -101,7 +101,6 @@ module.exports = function(core) {
         source: `P${i}`,
         stacktraceOpts: {
           contructorOpt: data.hooked,
-          prependFrames: [data.orig],
         },
       });
 

package/lib/dataflow/sinks/install/function.js

@@ -65,7 +65,7 @@ module.exports = function (core) {
       patcher.patch(global.ContrastMethods, 'Function', {
         name: 'global.ContrastMethods.Function',
         patchType,
-        pre({ args: origArgs, hooked, orig, name }) {
+        pre({ args: origArgs, hooked, name }) {
           if (!getSinkContext(ruleId)) return;
 
           const fnBody = origArgs[origArgs.length - 1];
@@ -131,7 +131,6 @@ module.exports = function (core) {
               source: `P${origArgs.length - 1}`,
               stacktraceOpts: {
                 contructorOpt: hooked,
-                prependFrames: [orig],
               },
             });
 

package/lib/dataflow/sinks/install/hapi/unvalidated-redirect.js

@@ -108,7 +108,6 @@ module.exports = function(core) {
               source: 'P0',
               stacktraceOpts: {
                 constructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/http/request.js

@@ -139,7 +139,6 @@ module.exports = function(core) {
                   source: 'P0',
                   stacktraceOpts: {
                     constructorOpt: data.hooked,
-                    prependFrames: [data.orig]
                   },
                   tags: urlTags,
                 });

package/lib/dataflow/sinks/install/http/server-response.js

@@ -76,7 +76,7 @@ module.exports = function(core) {
     WEAK_URL_ENCODED,
   ];
 
-  const preHook = (moduleName, responseName, method) => ({ args, obj: response, result, hooked, orig }) => {
+  const preHook = (moduleName, responseName, method) => ({ args, obj: response, result, hooked }) => {
     const methodName = `${`${responseName}.prototype`}.${method}`;
     const name = `${moduleName}.${methodName}`;
     const sourceContext = getSinkContext(ruleId);
@@ -113,7 +113,6 @@ module.exports = function(core) {
         source: 'P0',
         stacktraceOpts: {
           constructorOpt: hooked,
-          prependFrames: [orig]
         },
         tags: strInfo.tags,
       });

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -126,7 +126,6 @@ module.exports = function(core) {
               source: `P${isBackRoute ? 1 : 0}`,
               stacktraceOpts: {
                 constructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/libxmljs.js

@@ -103,7 +103,6 @@ module.exports = function(core) {
             source: 'P0',
             stacktraceOpts: {
               contructorOpt: data.hooked,
-              prependFrames: [data.orig]
             },
           });
 

package/lib/dataflow/sinks/install/marsdb.js

@@ -120,7 +120,6 @@ module.exports = function (core) {
           source: `P${argIdx}`,
           stacktraceOpts: {
             constructorOpt: data.hooked,
-            prependFrames: [data.orig]
           },
           tags: strInfo.tags,
         });

package/lib/dataflow/sinks/install/mssql.js

@@ -92,7 +92,6 @@ module.exports = function (core) {
         source: 'P0',
         stacktraceOpts: {
           contructorOpt: data.hooked,
-          prependFrames: [data.orig],
         },
       });
 

package/lib/dataflow/sinks/install/mysql.js

@@ -109,7 +109,6 @@ module.exports = function(core) {
       source: 'P0',
       stacktraceOpts: {
         contructorOpt: data.hooked,
-        prependFrames: [data.orig]
       },
     });
 

package/lib/dataflow/sinks/install/node-serialize.js

@@ -82,7 +82,6 @@ module.exports = function(core) {
               source: 'P0',
               stacktraceOpts: {
                 contructorOpt: data.hooked,
-                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/postgres.js

@@ -99,7 +99,6 @@ module.exports = function(core) {
         source: 'P0',
         stacktraceOpts: {
           constructorOpt: data.hooked,
-          prependFrames: [data.orig]
         },
       });
 

package/lib/dataflow/sinks/install/restify.js

@@ -79,7 +79,6 @@ module.exports = function(core) {
       },
       stacktraceOpts: {
         constructorOpt: data.hooked,
-        prependFrames: [data.orig]
       },
     };
   }

package/lib/dataflow/sinks/install/sequelize.js

@@ -69,7 +69,7 @@ module.exports = function (core) {
         around(next, data) {
           if (!getSinkContext(ruleId) || !data.args[0]) return next();
 
-          const { args, hooked, orig } = data;
+          const { args, hooked } = data;
           const query = typeof args[0] === 'string' ? args[0] : args[0].query;
 
           try {
@@ -121,7 +121,6 @@ module.exports = function (core) {
               source: 'P0',
               stacktraceOpts: {
                 contructorOpt: hooked,
-                prependFrames: [orig],
               },
             });
 

package/lib/dataflow/sinks/install/sqlite3.js

@@ -93,7 +93,6 @@ module.exports = function(core) {
       source: 'P0',
       stacktraceOpts: {
         contructorOpt: data.hooked,
-        prependFrames: [data.orig]
       },
     });
 

package/lib/dataflow/sinks/install/vm.js

@@ -142,7 +142,7 @@ module.exports = function (core) {
     return argsInfo;
   }
 
-  function around(next, { args: origArgs, hooked, orig, name }) {
+  function around(next, { args: origArgs, hooked, name }) {
     if (!getSinkContext(ruleId) || isLocked(ruleId)) return next();
 
     const methodPath = StringPrototypeSplit.call(name, '.');
@@ -232,7 +232,6 @@ module.exports = function (core) {
         source: `P${vulnerableArg.idx}`,
         stacktraceOpts: {
           contructorOpt: hooked,
-          prependFrames: [orig],
         },
       });
 

package/lib/dataflow/sources/index.js

@@ -21,6 +21,7 @@ module.exports = function (core) {
   const sources = core.assess.dataflow.sources = {};
 
   core.initComponentSync(require('./handler'));
+  core.initComponentSync(require('./install/@sap'));
   require('./install/express')(core);
   require('./install/fastify')(core);
   require('./install/hapi')(core);

package/lib/dataflow/sources/install/@sap.js

@@ -0,0 +1,132 @@
+/*
+ * Copyright: 2026 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { kComponentName, ComponentBase } = require('@contrast/core/lib/ioc/core');
+const {
+  InputType,
+  traverseValues,
+  primordials: { ArrayPrototypeJoin, StringPrototypeSlice },
+} = require('@contrast/common');
+const { patchType } = require('../common');
+
+const COMPONENT_NAME = 'assess.dataflow.sources.sapServiceInstrumentation';
+
+module.exports = class SAPInstrumentation extends ComponentBase {
+  static [kComponentName] = COMPONENT_NAME;
+
+  install() {
+    const {
+      depHooks,
+      patcher,
+      assess,
+    } = this.core;
+
+    depHooks.resolve({ name: '@sap/cds', version: '*', file: 'lib/srv/cds.Service.js' }, (Service) => {
+      patcher.patch(Service.prototype, 'dispatch', {
+        name: '@sap/cds.Service.prototype.dispatch',
+        patchType,
+        pre(data) {
+          const sourceContext = assess.getSourceContext();
+          if (!sourceContext || sourceContext.cdsDispatchHandled) return;
+
+          // dispatch can run multiple times e.g. with $batch
+          sourceContext.cdsDispatchHandled = true;
+          const cdsReq = data.args[0];
+
+          // this should also take care of cdsReq.req._data and cdsReq.data
+          if (cdsReq?.req?.body) {
+            assess.dataflow.sources.handle({
+              context: 'req.body',
+              data: cdsReq.req.body,
+              name: data.name,
+              inputType: InputType.BODY,
+              sourceContext,
+              stacktraceOpts: {
+                constructorOpt: data.hooked,
+              },
+            });
+
+            if (cdsReq?.req?._raw) {
+              assess.dataflow.sources.handle({
+                context: 'req',
+                data: cdsReq,
+                name: data.name,
+                keys: ['_raw'],
+                inputType: InputType.BODY,
+                sourceContext,
+                stacktraceOpts: {
+                  constructorOpt: data.hooked,
+                },
+              });
+            }
+          }
+
+          if (cdsReq?.params?.length) {
+            assess.dataflow.sources.handle({
+              context: 'req.params',
+              data: cdsReq.params,
+              name: data.name,
+              inputType: InputType.URL_PARAMETER,
+              sourceContext,
+              stacktraceOpts: {
+                constructorOpt: data.hooked,
+              },
+            });
+          }
+
+          // Handle cdsReq.query (CQN AST) since the OData/REST URL parser is deadzoned.
+          // Only track user-controlled leaf nodes, which are `val` and `ref` values.
+          // Other strings in the CQN are grammar tokens or schema-derived identifiers.
+          // Note: this also handles cdsReq.req._target since it's an alias for query values e.g.
+          //  req._target.ref[0].where[2].val  ===  cdsReq.query.SELECT.from.ref[0].where[2].val
+          const queries = Array.isArray(cdsReq?.query)
+            ? cdsReq.query
+            : cdsReq?.query ? [cdsReq.query] : [];
+
+          for (const cqn of queries) {
+            if (!cqn || typeof cqn !== 'object') continue;
+
+            traverseValues(cqn, (path, _type, _value, parent) => {
+              const lastKey = path[path.length - 1];
+              const inValObject = !Array.isArray(parent) && lastKey === 'val';
+              const inRefArray = Array.isArray(parent) && path[path.length - 2] === 'ref';
+              if (!inValObject && !inRefArray) return;
+
+              // Build context as 'req.query' + path without the trailing leaf key
+              // (sources.handle appends the leaf key automatically).
+              const fullPath = ArrayPrototypeJoin.call(path, '.');
+              const lastKeyLen = `${lastKey}`.length + (path.length > 1 ? 1 : 0);
+              const prefix = StringPrototypeSlice.call(fullPath, 0, fullPath.length - lastKeyLen);
+
+              assess.dataflow.sources.handle({
+                context: prefix ? `req.query.${prefix}` : 'req.query',
+                data: parent,
+                name: data.name,
+                keys: [lastKey],
+                inputType: InputType.URL_PARAMETER,
+                sourceContext,
+                stacktraceOpts: {
+                  constructorOpt: data.hooked,
+                },
+              });
+            });
+          }
+        }
+      });
+    });
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/assess",
-  "version": "1.73.0",
+  "version": "1.74.0",
   "description": "Contrast service providing framework-agnostic Assess support",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -29,10 +29,10 @@
     "@contrast/logger": "1.36.2",
     "@contrast/patcher": "1.35.2",
     "@contrast/rewriter": "1.40.3",
-    "@contrast/route-coverage": "1.57.0",
+    "@contrast/route-coverage": "1.57.1",
     "@contrast/scopes": "1.33.2",
     "@contrast/sources": "1.9.2",
-    "@contrast/stack-trace-factory": "1.3.3",
+    "@contrast/stack-trace-factory": "1.4.0",
     "semver": "7.6.0"
   }
 }