@contrast/assess 1.77.0 → 1.79.0

package/lib/dataflow/propagation/install/zod/utils.js

@@ -0,0 +1,227 @@
+/*
+ * Copyright: 2026 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  DataflowTag: { CUSTOM_VALIDATED },
+  isNonEmptyObject,
+  traverseValues,
+} = require('@contrast/common');
+const { createFullLengthCopyTags } = require('../../../tag-utils');
+
+module.exports = function(core) {
+  const {
+    assess: {
+      getPropagatorContext,
+      inspect,
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
+    },
+    config,
+  } = core;
+
+  /**
+   * Merges the given tags onto an already-tracked string's existing tracking
+   * info, in place. Used for checks that validate a string without changing
+   * its identity (format checks, length checks, refine/superRefine).
+   */
+  function applyTags(value, tags, schema, methodName) {
+    if (!tags.size || typeof value !== 'string') return;
+
+    const strInfo = tracker.getData(value);
+    if (!strInfo) return;
+
+    const event = createPropagationEvent({
+      name: `zod.${methodName}`,
+      moduleName: 'zod',
+      methodName,
+      history: [{ ...strInfo }],
+      object: { tracked: false, value: 'zod.schema' },
+      args: [
+        { tracked: true, value: strInfo.value },
+        { tracked: false, value: inspect(schema) },
+      ],
+      result: { tracked: false, value: undefined },
+      source: 'P0',
+      tags: Object.assign(
+        { ...strInfo.tags },
+        ...[...tags].map((tag) => ({ [tag]: [0, strInfo.value.length - 1] }))
+      ),
+      target: 'P0',
+    });
+
+    if (event) Object.assign(strInfo, event);
+  }
+
+  /**
+   * Untracks a value that has become a member of a fixed allow-list
+   * (enum/literal) and is no longer meaningfully "tainted" freeform input.
+   */
+  function untrackValue(value) {
+    if (typeof value !== 'string' && typeof value !== 'object') return;
+    if (!tracker.getData(value)) return;
+    tracker.untrack(value);
+  }
+
+  /**
+   * Generic retrack for any '.check === overwrite' check (trim/toLowerCase/
+   * toUpperCase/normalize/slugify) - the check mutates the value in place
+   * inside zod, producing a new string object. Carries the input's existing
+   * tags forward onto the new string, generalizing joi's isoDate-coercion
+   * retrack (string-schema.js's reTrackCoercedValue) to any overwrite check.
+   * Returns the (possibly externalized) result string to use going forward.
+   */
+  function retrackOverwrite(input, result, schema) {
+    if (typeof input !== 'string' || typeof result !== 'string' || input === result) return result;
+
+    const inputInfo = tracker.getData(input);
+    if (!inputInfo) return result;
+
+    const tags = createFullLengthCopyTags(inputInfo.tags, result.length);
+    if (!tags) return result;
+
+    const event = createPropagationEvent({
+      name: 'zod.string.overwrite',
+      moduleName: 'zod',
+      methodName: 'string.overwrite',
+      history: [{ ...inputInfo }],
+      object: { tracked: false, value: 'zod.string' },
+      args: [
+        { tracked: true, value: inputInfo.value },
+        { tracked: false, value: inspect(schema) },
+      ],
+      result: { tracked: false, value: result },
+      source: 'P0',
+      tags,
+      target: 'R',
+    });
+
+    if (!event) return result;
+
+    const { extern } = tracker.track(result, event);
+    return extern || result;
+  }
+
+  /**
+   * Tags data derived from arbitrary user code (refine/superRefine/transform)
+   * as CUSTOM_VALIDATED, gated behind the same operator opt-in flag used by
+   * every other instrumented validator library in this codebase (joi,
+   * validator, mongoose) - trusting an arbitrary function to have performed
+   * meaningful validation/sanitization is exactly the judgment call this flag
+   * exists for.
+   *
+   * `retrack: true` (transform - the value's identity changes) tracks a fresh
+   * value derived from `sourceValue`'s tags. `retrack: false` (refine/
+   * superRefine - identity unchanged) merges the tag onto the existing value
+   * in place.
+   */
+  function tagCustomValidated({ sourceValue, targetValue, schema, methodName, retrack }) {
+    if (!config.assess.trust_custom_validators) return targetValue;
+
+    const sourceInfo = tracker.getData(sourceValue);
+    if (!sourceInfo) return targetValue;
+
+    if (!retrack) {
+      applyTags(targetValue, new Set([CUSTOM_VALIDATED]), schema, methodName);
+      return targetValue;
+    }
+
+    if (typeof targetValue !== 'string') return targetValue;
+
+    const event = createPropagationEvent({
+      addedTags: [CUSTOM_VALIDATED],
+      name: `zod.${methodName}`,
+      moduleName: 'zod',
+      methodName,
+      history: [{ ...sourceInfo }],
+      object: { tracked: false, value: `zod.${methodName}` },
+      args: [
+        { tracked: true, value: sourceInfo.value },
+        { tracked: false, value: inspect(schema) },
+      ],
+      result: { tracked: true, value: targetValue },
+      source: 'P0',
+      tags: { [CUSTOM_VALIDATED]: [0, targetValue.length - 1] },
+      target: 'R',
+    });
+
+    if (!event) return targetValue;
+
+    const { extern } = tracker.track(targetValue, event);
+    return extern || targetValue;
+  }
+
+  /**
+   * Handles a transform-shaped boundary - v4's `.transform()`/`.pipe()`
+   * (def.type === 'pipe') and v3's `.transform()` (ZodEffects, effect.type
+   * 'transform') and explicit `.pipe()` (ZodPipeline) all reduce to the same
+   * shape once each version's process-result module has already resolved
+   * `sourceSchema` (v4's `def.in`, v3's `def.schema`/`def.in`) - see each
+   * version's own walker for that resolution. Per design, format/type tags
+   * from the source schema's checks are deliberately NOT carried forward
+   * across the boundary - an arbitrary transform function can invalidate the
+   * security guarantee those tags imply (e.g. LIMITED_CHARS after `.email()`
+   * no longer holds once a transform can do anything to the string). Only
+   * CUSTOM_VALIDATED is applied to the output, gated by
+   * trust_custom_validators, treating the output like any other
+   * arbitrary-user-code result (refine/superRefine).
+   */
+  function handleTransformLike(sourceSchema, input, result) {
+    if (typeof result !== 'string' && !isNonEmptyObject(result)) return result;
+    if (typeof input !== 'string' && !isNonEmptyObject(input)) return result;
+
+    return tagCustomValidated({
+      sourceValue: input,
+      targetValue: result,
+      schema: sourceSchema,
+      methodName: 'transform',
+      retrack: input !== result,
+    });
+  }
+
+  /**
+   * True if `value` is, or contains, any currently-tracked string. Checked
+   * against BOTH the pre-parse input and the post-parse result before
+   * deciding whether the (potentially expensive) schema walk is worth
+   * running: a retracked value (trim/toLowerCase/transform) appears
+   * untracked in `result` alone, since it's a brand new string object, so
+   * checking `result` by itself would miss every retracking case.
+   */
+  function hasAnyTrackedValue(value) {
+    if (typeof value === 'string') return !!tracker.getData(value);
+    if (!isNonEmptyObject(value)) return false;
+
+    let found = false;
+    traverseValues(value, (_path, _type, v) => {
+      if (tracker.getData(v)) {
+        found = true;
+        return 1;
+      }
+    });
+    return found;
+  }
+
+  return {
+    applyTags,
+    untrackValue,
+    retrackOverwrite,
+    tagCustomValidated,
+    handleTransformLike,
+    hasAnyTrackedValue,
+    getPropagatorContext,
+    tracker,
+  };
+};

package/lib/dataflow/propagation/install/zod/v3.js

@@ -0,0 +1,117 @@
+/*
+ * Copyright: 2026 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../../common');
+
+// zod v3's classic API assigns `.parse`/`.safeParse`/`.parseAsync`/
+// `.safeParseAsync` as bound-per-instance COPIES of shared `ZodType.prototype`
+// methods (`this.safeParse = this.safeParse.bind(this)` in the constructor),
+// unlike v4's independent per-instance closures - so the hook target here is
+// the prototype itself, patched before any schema is constructed (dep-hooks
+// patches at module-load time, before app code can call `z.string()`).
+//
+// Only `safeParse`/`safeParseAsync` are patched, NOT `parse`/`parseAsync`.
+// In v3's own source, `parse()` is `{ const result = this.safeParse(data,
+// params); if (result.success) return result.data; throw result.error; }`,
+// and `parseAsync()` wraps `safeParseAsync()` the same way - they are thin
+// wrappers, not independent implementations. Patching all 4 (mirroring v4)
+// would fire this hook TWICE per `.parse()` call - once via the outer patch,
+// once via the inner `safeParse` call `parse()` makes internally - causing
+// duplicate `tracker.track()` calls and duplicate propagation-graph nodes on
+// every retracking check (trim/toLowerCase/transform). Patching only the two
+// primitives avoids this: `parse`/`parseAsync` pick up tagging for free since
+// they read `result.data` off the now-mutated safeParse/safeParseAsync return
+// value. The `spa` alias (`safeParseAsync` alias, bound from the same
+// prototype method) is covered for free too.
+//
+// Known gap: `ZodType.prototype['~validate']` (the Standard Schema v1 entry
+// point used by tRPC v11, @hookform/resolvers, and newer
+// fastify-type-provider-zod) calls `_parseSync` directly, bypassing
+// `safeParse` entirely - uninstrumented here. v4 has the identical gap via
+// its own `~standard.validate`. See NODE-4022 for a follow-up covering both.
+const PARSE_METHODS = ['safeParse', 'safeParseAsync'];
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    logger,
+    assess: { getPropagatorContext },
+  } = core;
+  const { handleParseSuccess } = require('./process-result-v3')(core);
+
+  function patchZodType(types) {
+    const proto = types?.ZodType?.prototype;
+    if (!proto) return;
+
+    PARSE_METHODS.forEach((method) => {
+      const isAsync = method.endsWith('Async');
+
+      patcher.patch(proto, method, {
+        name: `zod.${method}`,
+        patchType,
+        usePerf: isAsync ? 'tbd' : 'sync',
+        post(data) {
+          try {
+            if (!getPropagatorContext()) return;
+
+            // patching a prototype method means the schema is the receiver
+            // (`data.obj`), not `data.args[0]` like v4's shared-module hook -
+            // `data.args` here is just `[input, params]`.
+            const schema = data.obj;
+            const [input] = data.args;
+
+            // both patched methods always return the uniform
+            // `{success, data|error}` shape, so - unlike v4 - there's no
+            // isSafe/isAsync result-shape branching needed here.
+            if (isAsync) {
+              data.result = data.result.then((outcome) => {
+                if (outcome?.success) {
+                  outcome.data = handleParseSuccess(schema, input, outcome.data);
+                }
+                return outcome;
+              });
+            } else if (data.result?.success) {
+              data.result.data = handleParseSuccess(schema, input, data.result.data);
+            }
+          } catch (err) {
+            logger.error({ err }, 'zod v3 parse propagation hook failed');
+          }
+        },
+      });
+    });
+  }
+
+  const zodV3Instrumentation = core.assess.dataflow.propagation.zodV3Instrumentation = {
+    install() {
+      // stable, dominant 3.x line - unchanged from early 3.x through 3.24.4.
+      depHooks.resolve({ name: 'zod', file: 'lib/types.js', version: '>=3.0.0 <3.25.0' }, patchZodType);
+
+      // covers both the tail of the 3.25.x prerelease line AND, more
+      // importantly, any app on zod v4 using the `zod/v3` compat subpath
+      // (the standard migration path off v3) - byte-equivalent ZodType
+      // shape, confirmed against the installed zod package's own
+      // `v3/types.cjs`. Deliberately excludes zod@3.25.0-3.25.75, a short
+      // prerelease window that used two other transitional file layouts
+      // (`dist/commonjs/types.js`, then `dist/cjs/v3/types.js`) - not worth
+      // two more registrations for versions nobody pins to.
+      depHooks.resolve({ name: 'zod', file: 'v3/types.cjs', version: '>=3.25.76 <5' }, patchZodType);
+    },
+  };
+
+  return zodV3Instrumentation;
+};

package/lib/dataflow/propagation/install/zod/v4.js

@@ -0,0 +1,97 @@
+/*
+ * Copyright: 2026 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { patchType } = require('../../common');
+
+// zod v4's classic API (`import { z } from 'zod'`) assigns `.parse`/
+// `.safeParse`/`.parseAsync`/`.safeParseAsync` as PER-INSTANCE closures in
+// each schema's constructor (a deliberate zod performance optimization -
+// there is no shared prototype method to patch). Every one of those closures
+// calls through to the shared `v4/classic/parse.cjs` module's own exports
+// (e.g. `inst.parse = (data, params) => parse.parse(inst, data, params, ...)`)
+// as a live property lookup on every call, so patching that module's exports
+// object is the single centralized, correct hook point.
+const PARSE_METHODS = ['parse', 'safeParse', 'parseAsync', 'safeParseAsync'];
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    logger,
+    assess: { getPropagatorContext },
+  } = core;
+  const { handleParseSuccess } = require('./process-result-v4')(core);
+
+  const zodInstrumentation = core.assess.dataflow.propagation.zodInstrumentation = {
+    install() {
+      depHooks.resolve(
+        { name: 'zod', file: 'v4/classic/parse.cjs', version: '>=4 <5' },
+        (parseExports) => {
+          PARSE_METHODS.forEach((method) => {
+            const isSafe = method.startsWith('safe');
+            const isAsync = method.endsWith('Async');
+
+            patcher.patch(parseExports, method, {
+              name: `zod.${method}`,
+              patchType,
+              usePerf: isAsync ? 'tbd' : 'sync',
+              post(data) {
+                try {
+                  if (!getPropagatorContext()) return;
+
+                  const [schema, input] = data.args;
+
+                  // handleParseSuccess may retrack the value (trim/toLowerCase/
+                  // transform produce a NEW string) - its return value must
+                  // replace `data.result` (sync) or be spliced into a
+                  // replacement promise (async) so the original caller of
+                  // `.parse()`/`.parseAsync()` actually receives the tracked
+                  // value, not zod's untracked one. `post` runs before the
+                  // patcher returns `data.result` to the caller, so mutating
+                  // it here (sync case) takes effect; for async, a promise's
+                  // resolution value can't be swapped after the fact, so we
+                  // replace `data.result` itself with a chained promise.
+                  if (isAsync) {
+                    data.result = data.result.then((outcome) => {
+                      if (isSafe) {
+                        if (outcome.success) {
+                          outcome.data = handleParseSuccess(schema, input, outcome.data);
+                        }
+                        return outcome;
+                      }
+                      return handleParseSuccess(schema, input, outcome);
+                    });
+                  } else if (isSafe) {
+                    if (data.result.success) {
+                      data.result.data = handleParseSuccess(schema, input, data.result.data);
+                    }
+                  } else {
+                    data.result = handleParseSuccess(schema, input, data.result);
+                  }
+                } catch (err) {
+                  logger.error({ err }, 'zod parse propagation hook failed');
+                }
+              },
+            });
+          });
+        }
+      );
+    },
+  };
+
+  return zodInstrumentation;
+};

package/lib/dataflow/sinks/install/child-process.js

@@ -173,7 +173,7 @@ module.exports = function(core) {
       tags: trackedArgs[vulnerableArgIdx].tags,
       source: 'P1',
       stacktraceOpts: {
-        contructorOpt: hooked,
+        constructorOpt: hooked,
       },
     });
 

package/lib/dataflow/sinks/install/eval.js

@@ -118,7 +118,7 @@ module.exports = function (core) {
               tags: strInfo.tags,
               source: 'P0',
               stacktraceOpts: {
-                contructorOpt: orig
+                constructorOpt: orig
               },
             });
 

package/lib/dataflow/sinks/install/fs.js

@@ -100,7 +100,7 @@ module.exports = function(core) {
         tags: strInfo.tags,
         source: `P${i}`,
         stacktraceOpts: {
-          contructorOpt: data.hooked,
+          constructorOpt: data.hooked,
         },
       });
 

package/lib/dataflow/sinks/install/function.js

@@ -130,7 +130,7 @@ module.exports = function (core) {
               tags: strInfo.tags,
               source: `P${origArgs.length - 1}`,
               stacktraceOpts: {
-                contructorOpt: hooked,
+                constructorOpt: hooked,
               },
             });
 

package/lib/dataflow/sinks/install/libxmljs.js

@@ -102,7 +102,7 @@ module.exports = function(core) {
             tags: strInfo.tags,
             source: 'P0',
             stacktraceOpts: {
-              contructorOpt: data.hooked,
+              constructorOpt: data.hooked,
             },
           });
 

package/lib/dataflow/sinks/install/mssql.js

@@ -91,7 +91,7 @@ module.exports = function (core) {
         tags: strInfo.tags,
         source: 'P0',
         stacktraceOpts: {
-          contructorOpt: data.hooked,
+          constructorOpt: data.hooked,
         },
       });
 

package/lib/dataflow/sinks/install/mysql.js

@@ -108,7 +108,7 @@ module.exports = function(core) {
       tags: strInfo.tags,
       source: 'P0',
       stacktraceOpts: {
-        contructorOpt: data.hooked,
+        constructorOpt: data.hooked,
       },
     });
 

package/lib/dataflow/sinks/install/node-serialize.js

@@ -81,7 +81,7 @@ module.exports = function(core) {
               tags: strInfo.tags,
               source: 'P0',
               stacktraceOpts: {
-                contructorOpt: data.hooked,
+                constructorOpt: data.hooked,
               },
             });
 

package/lib/dataflow/sinks/install/sequelize.js

@@ -120,7 +120,7 @@ module.exports = function (core) {
               tags: queryInfo?.tags,
               source: 'P0',
               stacktraceOpts: {
-                contructorOpt: hooked,
+                constructorOpt: hooked,
               },
             });
 

package/lib/dataflow/sinks/install/sqlite3.js

@@ -92,7 +92,7 @@ module.exports = function(core) {
       tags: strInfo.tags,
       source: 'P0',
       stacktraceOpts: {
-        contructorOpt: data.hooked,
+        constructorOpt: data.hooked,
       },
     });
 

package/lib/dataflow/sinks/install/vm.js

@@ -231,7 +231,7 @@ module.exports = function (core) {
           : vulnerableArg.strInfo.tags,
         source: `P${vulnerableArg.idx}`,
         stacktraceOpts: {
-          contructorOpt: hooked,
+          constructorOpt: hooked,
         },
       });
 

package/lib/dataflow/sources/handler.js

@@ -25,7 +25,7 @@ const {
     StringPrototypeToLowerCase
   }
 } = require('@contrast/common');
-const { Core } = require('@contrast/core/lib/ioc/core');
+const { Core } = require('@contrast/core');
 
 module.exports = Core.makeComponent({
   name: 'assess.dataflow.sources.handle',

package/lib/dataflow/sources/install/@sap.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { kComponentName, ComponentBase } = require('@contrast/core/lib/ioc/core');
+const { kComponentName, ComponentBase } = require('@contrast/core');
 const {
   InputType,
   traverseValues,
@@ -47,7 +47,6 @@ module.exports = class SAPInstrumentation extends ComponentBase {
           sourceContext.cdsDispatchHandled = true;
           const cdsReq = data.args[0];
 
-          // this should also take care of cdsReq.req._data and cdsReq.data
           if (cdsReq?.req?.body) {
             assess.dataflow.sources.handle({
               context: 'req.body',
@@ -75,6 +74,19 @@ module.exports = class SAPInstrumentation extends ComponentBase {
             }
           }
 
+          if (cdsReq?.data) {
+            assess.dataflow.sources.handle({
+              context: 'req.data',
+              data: cdsReq.data,
+              name: data.name,
+              inputType: InputType.BODY,
+              sourceContext,
+              stacktraceOpts: {
+                constructorOpt: data.hooked,
+              },
+            });
+          }
+
           if (cdsReq?.params?.length) {
             assess.dataflow.sources.handle({
               context: 'req.params',

package/lib/dataflow/sources/install/fastify-websocket.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { InputType, set } = require('@contrast/common');
-const Core = require('@contrast/core/lib/ioc/core');
+const Core = require('@contrast/core');
 const { patchType } = require('../common');
 
 const COMPONENT_NAME = 'assess.dataflow.sources.fastifyWebsocketInstrumentation';

package/lib/dataflow/sources/install/socket.io.js

@@ -15,7 +15,7 @@
 'use strict';
 
 const { InputType, set } = require('@contrast/common');
-const Core = require('@contrast/core/lib/ioc/core');
+const Core = require('@contrast/core');
 const { patchType } = require('../common');
 
 const COMPONENT_NAME = 'assess.dataflow.sources.socketIoInstrumentation';

package/lib/event-factory.js

@@ -23,7 +23,7 @@ const {
   primordials: { StringPrototypeMatch }
 } = require('@contrast/common');
 const { ConfigSource } = require('@contrast/config');
-const { Core } = require('@contrast/core/lib/ioc/core');
+const { Core } = require('@contrast/core');
 
 const ANNOTATION_REGEX = /^(A|O|R|P|P\d+)$/;
 const SOURCE_EVENT_MSG = 'Source event not created: %s';

package/lib/get-source-context.js

@@ -15,7 +15,7 @@
 // @ts-check
 'use strict';
 
-const { Core } = require('@contrast/core/lib/ioc/core');
+const { Core } = require('@contrast/core');
 
 /** @typedef {import('@contrast/assess').SourceContext} SourceContext */
 

package/lib/index.js

@@ -42,7 +42,7 @@ module.exports = function assess(core) {
       }
 
       // configure rewriter
-      core.rewriter.install('assess');
+      core.rewriter.modes.add('assess');
       // dispatch subcomponent installation
       callChildComponentMethodsSync(core.assess, 'install');
     },

package/lib/make-source-context.js

@@ -15,7 +15,7 @@
 
 'use strict';
 
-const { Core } = require('@contrast/core/lib/ioc/core');
+const { Core } = require('@contrast/core');
 
 /**
  * @param {{

package/lib/policy.js

@@ -25,7 +25,7 @@ const {
   set,
   primordials: { ArrayPrototypeJoin, RegExpPrototypeTest }
 } = require('@contrast/common');
-const { Core } = require('@contrast/core/lib/ioc/core');
+const { Core } = require('@contrast/core');
 
 const ASSESS_RULES = Object.values({
   ...Rule,