@contrast/assess 1.78.0 → 1.79.0

package/lib/dataflow/propagation/index.js

@@ -49,6 +49,8 @@ module.exports = function(core) {
   require('./install/path')(core);
   require('./install/reg-exp-prototype-exec')(core);
   require('./install/joi')(core);
+  require('./install/zod/v4')(core);
+  require('./install/zod/v3')(core);
   require('./install/util-format')(core);
 
   propagation.install = function() {

package/lib/dataflow/propagation/install/JSON/stringify.js

@@ -16,67 +16,20 @@
 'use strict';
 
 const {
-  isString,
   primordials: {
     ArrayPrototypeSlice,
-    StringPrototypeReplace,
-    StringPrototypeMatch,
-    StringPrototypeMatchAll,
-    StringPrototypeSlice,
   }
 } = require('@contrast/common');
-const crypto = require('crypto');
 const { createMergedTags, getAdjustedUntrackedValue, truncateStringValue } = require('../../../tag-utils');
 const { patchType } = require('../../common');
-
-function makeCanary() {
-  return StringPrototypeReplace.call(
-    crypto
-      .randomBytes(12)
-      .toString('base64'),
-    /[+\\]/g,
-    (match) => match === '+' ? '%' : '#'
-  );
-}
-
-const canary = makeCanary();
-const regex = new RegExp(`"${canary}(\\d+)~`, 'g');
-function identity(_key, val) {
-  return val;
-}
-
-function patchReplacer(replacer) {
-  if (Array.isArray(replacer)) {
-    // keys that are numbers get cast to string when they come through the replacer
-    // add '' to the list of keys as that's always the first iteration of replacer, the entire json string
-    const filterKeys = replacer
-      .filter((key) => isString(key) || typeof key === 'number')
-      .concat('')
-      .map((value) => value.toString());
-
-    let nextArray = [];
-    replacer = function(key, value) {
-      // we need to keep track of arrays
-      // and shift each element as the replacer hits it
-      // so we can compare those values are expected
-      // when filtering
-      const nextEl = nextArray.shift();
-      if (Array.isArray(value)) {
-        nextArray = [...value];
-      }
-
-      if (filterKeys.includes(key) || value === nextEl) {
-        return value;
-      }
-    };
-  } else if (typeof replacer === 'function') {
-    // do nothing!
-  } else {
-    replacer = identity;
-  }
-
-  return replacer;
-}
+const {
+  regex,
+  patchReplacer,
+  getUntrustedSpaceProps,
+  createSpaceTagRanges,
+  markCanaryValue,
+  applyCanaryTagRanges,
+} = require('./tag-ranges');
 
 module.exports = function(core) {
   const {
@@ -88,77 +41,6 @@ module.exports = function(core) {
     }
   } = core;
 
-  function getUntrustedSpaceProps(space) {
-    // it can't be a problem if it's not a string, if the string is all spaces, or
-    // if the string is zero length.
-    if (!isString(space) || StringPrototypeMatch.call(space, /^\s+$/) || !space) {
-      return null;
-    }
-    const props = tracker.getData(StringPrototypeSlice.call(space, 0, 10));
-    if (!props || !Object.keys(props.tags).length) {
-      return null;
-    }
-
-    return props;
-  }
-
-
-  function createSpaceTagRanges(result, metadata) {
-    const tags = {};
-    const spaceValue = StringPrototypeSlice.call(metadata.origArgs[2], 0, 10);
-    const { spaceProps: { tags: spacePropsTags } } = metadata;
-
-    const spaces = Array.from(StringPrototypeMatchAll.call(result, new RegExp(`(?<=\\n)(${spaceValue})+?(?=\\d|"|null|]|})`, 'g')));
-
-    for (const space of spaces) {
-      const match = space[0];
-      const { index } = space;
-      for (const tagKey of Object.keys(spacePropsTags)) {
-        if (!tags[tagKey]) {
-          tags[tagKey] = [];
-        }
-
-        if (space !== spaceValue && (spacePropsTags[tagKey].length !== 2 || spacePropsTags[tagKey][1] !== spaceValue.length - 1)) {
-          for (let i = 0; i < match.length / spaceValue.length; i++) {
-            tags[tagKey].push(...spacePropsTags[tagKey].map((rangeIdx) => index + (rangeIdx + i * spaceValue.length)));
-          }
-        } else {
-          tags[tagKey].push(index, index + match.length - 1);
-        }
-      }
-    }
-
-    return tags;
-  }
-
-  function applyCanaryTagRanges(result, metadata, tags) {
-    metadata.sourceEvents = [];
-    // the diff doesn't include the " that opens the regex.
-    let canaryReplacementDiff = 0;
-    // for each marker in the stringify's result, remove the marker and
-    // create a TagRange for the value.
-    return StringPrototypeReplace.call(result, metadata.regex, (m, id, offset) => {
-      // adjust offset by total characters removed so far
-      offset = offset - canaryReplacementDiff + 1;
-      // we don't replace the opening " in the regex - that just makes sure
-      // we only find our marker at the start of a string value.
-      canaryReplacementDiff += m.length - 1;
-      for (const tagKey of Object.keys(metadata.strInfos[id].tags)) {
-        if (!tags[tagKey]) {
-          tags[tagKey] = [];
-        }
-
-        for (const tagIdx of metadata.strInfos[id].tags[tagKey]) {
-          tags[tagKey].push(tagIdx + offset);
-        }
-      }
-
-      metadata.history.add(metadata.strInfos[id]);
-      // replace the canary with the starting quote
-      return '"';
-    });
-  }
-
   return core.assess.dataflow.propagation.jsonInstrumentation.stringify = {
     install() {
       patcher.patch(JSON, 'stringify', {
@@ -186,16 +68,13 @@ module.exports = function(core) {
 
           // if the space can't be trusted then remember space's tracking info so it
           // can be applied to the entire JSON.stringify result string.
-          const spaceProps = getUntrustedSpaceProps(space);
+          const spaceProps = getUntrustedSpaceProps(tracker, space);
           if (spaceProps) {
             data.metadata.spaceProps = spaceProps;
             data.metadata.history.add(spaceProps);
             data.metadata.propagate = true;
           }
 
-          // each canary tag gets a separate id to make matching easier.
-          let id = 0;
-
           /**
            * wraps the replacer method and updates propagate boolean if value of replacer
            * is tracked
@@ -204,20 +83,14 @@ module.exports = function(core) {
            * @param {string} value
            */
           function contrastReplacer(key, val) {
-            const valProperties = tracker.getData(val);
-            if (valProperties && Object.keys(valProperties.tags).length) {
+            const value = replacer.call(this, key, val);
+            const marked = markCanaryValue(tracker, data.metadata.strInfos, val, value);
+
+            if (marked.propagate) {
               data.metadata.propagate = true;
             }
 
-            let value = replacer.call(this, key, val);
-
-            // keys aren't propagated, so check only the value
-            if (isString(value) && valProperties) {
-              data.metadata.strInfos[id] = valProperties;
-              value = `${canary}${id}~${value}`;
-              id++;
-            }
-            return value;
+            return marked.value;
           }
 
           data.args = [input, contrastReplacer, space];

package/lib/dataflow/propagation/install/JSON/tag-ranges.js

@@ -0,0 +1,174 @@
+/*
+ * Copyright: 2026 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const {
+  isString,
+  primordials: {
+    StringPrototypeReplace,
+    StringPrototypeMatch,
+    StringPrototypeMatchAll,
+    StringPrototypeSlice,
+  }
+} = require('@contrast/common');
+const crypto = require('crypto');
+
+// Shared functions between JSON.stringify instrumentation
+// and util.format when 'j' format string is used
+// for keeping accurate tag ranges
+
+function makeCanary() {
+  return StringPrototypeReplace.call(
+    crypto
+      .randomBytes(12)
+      .toString('base64'),
+    /[+\\]/g,
+    (match) => match === '+' ? '%' : '#'
+  );
+}
+
+const canary = makeCanary();
+const regex = new RegExp(`"${canary}(\\d+)~`, 'g');
+
+function identity(_key, val) {
+  return val;
+}
+
+function patchReplacer(replacer) {
+  if (Array.isArray(replacer)) {
+    // keys that are numbers get cast to string when they come through the replacer
+    // add '' to the list of keys as that's always the first iteration of replacer, the entire json string
+    const filterKeys = replacer
+      .filter((key) => isString(key) || typeof key === 'number')
+      .concat('')
+      .map((value) => value.toString());
+
+    let nextArray = [];
+    replacer = function(key, value) {
+      // we need to keep track of arrays
+      // and shift each element as the replacer hits it
+      // so we can compare those values are expected
+      // when filtering
+      const nextEl = nextArray.shift();
+      if (Array.isArray(value)) {
+        nextArray = [...value];
+      }
+
+      if (filterKeys.includes(key) || value === nextEl) {
+        return value;
+      }
+    };
+  } else if (typeof replacer === 'function') {
+    // do nothing!
+  } else {
+    replacer = identity;
+  }
+
+  return replacer;
+}
+
+function getUntrustedSpaceProps(tracker, space) {
+  // it can't be a problem if it's not a string, if the string is all spaces, or
+  // if the string is zero length.
+  if (!isString(space) || StringPrototypeMatch.call(space, /^\s+$/) || !space) {
+    return null;
+  }
+  const props = tracker.getData(StringPrototypeSlice.call(space, 0, 10));
+  if (!props || !Object.keys(props.tags).length) {
+    return null;
+  }
+
+  return props;
+}
+
+function createSpaceTagRanges(result, metadata) {
+  const tags = {};
+  const spaceValue = StringPrototypeSlice.call(metadata.origArgs[2], 0, 10);
+  const { spaceProps: { tags: spacePropsTags } } = metadata;
+
+  const spaces = Array.from(StringPrototypeMatchAll.call(result, new RegExp(`(?<=\\n)(${spaceValue})+?(?=\\d|"|null|]|})`, 'g')));
+
+  for (const space of spaces) {
+    const match = space[0];
+    const { index } = space;
+    for (const tagKey of Object.keys(spacePropsTags)) {
+      if (!tags[tagKey]) {
+        tags[tagKey] = [];
+      }
+
+      if (space !== spaceValue && (spacePropsTags[tagKey].length !== 2 || spacePropsTags[tagKey][1] !== spaceValue.length - 1)) {
+        for (let i = 0; i < match.length / spaceValue.length; i++) {
+          tags[tagKey].push(...spacePropsTags[tagKey].map((rangeIdx) => index + (rangeIdx + i * spaceValue.length)));
+        }
+      } else {
+        tags[tagKey].push(index, index + match.length - 1);
+      }
+    }
+  }
+
+  return tags;
+}
+
+function markCanaryValue(tracker, strInfos, val, value) {
+  const valInfo = tracker.getData(val);
+  const propagate = !!(valInfo && Object.keys(valInfo.tags).length);
+
+  if (isString(value) && valInfo) {
+    const id = Object.keys(strInfos).length;
+    strInfos[id] = valInfo;
+    value = `${canary}${id}~${value}`;
+  }
+
+  return { value, propagate };
+}
+
+function applyCanaryTagRanges(result, metadata, tags) {
+  metadata.sourceEvents = [];
+  // the diff doesn't include the " that opens the regex.
+  let canaryReplacementDiff = 0;
+  // for each marker in the stringify's result, remove the marker and
+  // create a TagRange for the value.
+  return StringPrototypeReplace.call(result, metadata.regex, (m, id, offset) => {
+    // adjust offset by total characters removed so far
+    offset = offset - canaryReplacementDiff + 1;
+    // we don't replace the opening " in the regex - that just makes sure
+    // we only find our marker at the start of a string value.
+    canaryReplacementDiff += m.length - 1;
+    for (const tagKey of Object.keys(metadata.strInfos[id].tags)) {
+      if (!tags[tagKey]) {
+        tags[tagKey] = [];
+      }
+
+      for (const tagIdx of metadata.strInfos[id].tags[tagKey]) {
+        tags[tagKey].push(tagIdx + offset);
+      }
+    }
+
+    metadata.history.add(metadata.strInfos[id]);
+    // replace the canary with the starting quote
+    return '"';
+  });
+}
+
+module.exports = {
+  regex,
+  identity,
+  patchReplacer,
+  getUntrustedSpaceProps,
+  createSpaceTagRanges,
+  markCanaryValue,
+  applyCanaryTagRanges,
+};

package/lib/dataflow/propagation/install/jsonwebtoken.js

@@ -15,7 +15,7 @@
  */
 'use strict';
 
-const { kComponentName, ComponentBase } = require('@contrast/core/lib/ioc/core');
+const { kComponentName, ComponentBase } = require('@contrast/core');
 const { isString, set, traverseValues, primordials } = require('@contrast/common');
 const { createFullLengthCopyTags } = require('../../tag-utils');
 const { patchType } = require('../common');

package/lib/dataflow/propagation/install/sanitize-html.js

@@ -18,7 +18,7 @@
 const {
   primordials: { StringPrototypeSubstr },
   DataflowTag: { CUSTOM_VALIDATED_REFLECTED_XSS } } = require('@contrast/common');
-const { kComponentName, ComponentBase } = require('@contrast/core/lib/ioc/core');
+const { kComponentName, ComponentBase } = require('@contrast/core');
 const { patchType } = require('../common');
 
 const COMPONENT_NAME = 'assess.dataflow.propagation.sanitizeHtml';

package/lib/dataflow/propagation/install/url/url.js

@@ -16,8 +16,11 @@
 'use strict';
 
 const { patchType } = require('../../common');
+const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
-const { primordials: { StringPrototypeSplit } } = require('@contrast/common');
+const {
+  primordials: { StringPrototypeSplit }
+} = require('@contrast/common');
 
 module.exports = function(core) {
   const {
@@ -49,7 +52,12 @@ module.exports = function(core) {
     ]
   ];
 
-  function getPropagationEvent(strInfo, partInfo, data) {
+  function calculateSubsetRange(tags, start, len) {
+    const clampedStart = Math.max(start, 0);
+    return createSubsetTags(tags, clampedStart, start + len - clampedStart);
+  }
+
+  function getPropagationEvent(url, tags, data) {
     const args = data.args.map((v) => {
       const strInfo = tracker.getData(v);
       return {
@@ -63,7 +71,7 @@ module.exports = function(core) {
       moduleName: 'url',
       methodName: 'URL',
       get context() {
-        return `url.URL('${strInfo.value}')`;
+        return `url.URL('${url}')`;
       },
       object: {
         value: 'url',
@@ -74,8 +82,8 @@ module.exports = function(core) {
         tracked: true
       },
       args,
-      tags: partInfo.tags,
-      history: [partInfo],
+      tags,
+      history: [{ tags, value: url }],
       source: 'P',
       target: 'R',
       stacktraceOpts: {
@@ -98,28 +106,47 @@ module.exports = function(core) {
             if (!result || !args[0] || !getPropagatorContext()) return;
 
             const [input, basename] = args;
+            const inputInfo = tracker.getData(input);
+            const basenameInfo = tracker.getData(basename);
+
             let url = input;
+            let tags = inputInfo?.tags ?? null;
+
             if (basename && url !== result.toString()) {
               const isAbsoluteURL = url.indexOf('://') > 0 || url.indexOf('//') === 0;
               if (isAbsoluteURL) {
-                const splitUrl = url.split(new RegExp('(?=//)', 'g'));
+                // input is split into chunks so any leading slashes on the input
+                // can be replaced with the basename's protocol when needed. Each
+                // chunk's tag range is calculated from its offset within `input`.
+                const splitUrl = StringPrototypeSplit.call(url, new RegExp('(?=//)', 'g'));
                 let endOfSlashes = splitUrl.length === 1 ? true : false;
-                let newUrl = splitUrl[0] === result.protocol ? splitUrl[0] : basename.split(/(?<=:)/)[0];
+                const useInputProtocol = splitUrl[0] === result.protocol;
+                let newUrl = useInputProtocol ? splitUrl[0] : StringPrototypeSplit.call(basename, /(?<=:)/)[0];
+                let newTags = useInputProtocol
+                  ? createSubsetTags(inputInfo?.tags, 0, newUrl.length)
+                  : createSubsetTags(basenameInfo?.tags, 0, newUrl.length);
+
+                let inputOffset = 0;
                 for (let i = 0; i < splitUrl.length; i++) {
+                  const piece = splitUrl[i];
                   if (endOfSlashes) {
-                    newUrl = newUrl.concat(splitUrl[i]);
+                    const pieceTags = createSubsetTags(inputInfo?.tags, inputOffset, piece.length);
+                    newTags = createAppendTags(newTags, pieceTags, newUrl.length);
+                    newUrl += piece;
                   }
-                  if (splitUrl[i] === '/' && splitUrl[i + 1] !== '/') {
+                  if (piece === '/' && splitUrl[i + 1] !== '/') {
                     endOfSlashes = true;
                   }
+                  inputOffset += piece.length;
                 }
                 url = newUrl;
+                tags = newTags;
               } else {
-                url = basename.concat(url);
+                tags = createAppendTags(basenameInfo?.tags, inputInfo?.tags, basename.length);
+                url = basename + url;
               }
             }
-            const strInfo = tracker.getData(url);
-            if (!strInfo) return;
+            if (!tags) return;
 
             const proxy = new Proxy(data.result, {
               set(obj, prop, value) {
@@ -139,31 +166,38 @@ module.exports = function(core) {
               }
             });
 
-            const traverse = function(href, url, keys, idx = 0) {
+            const traverse = function(href, hrefTags, urlObj, keys, idx = 0) {
               let substr = href;
+              let substrTags = hrefTags;
               keys.forEach((key) => {
                 if (typeof key === 'string') {
-                  const part = url[key];
+                  const part = urlObj[key];
                   if (part !== 'null') {
+                    let partTags;
 
                     if (key === 'origin') {
                       const [protocol, originWithoutProtocol] = StringPrototypeSplit.call(part, new RegExp('(?<=//)'));
                       const idx1 = href.indexOf(protocol);
                       const idx2 = href.indexOf(originWithoutProtocol, idx - 1);
-                      substr = href.substring(idx1, idx1 + protocol.length).concat(href.substring(idx2, idx2 + originWithoutProtocol.length));
+                      partTags = createAppendTags(
+                        calculateSubsetRange(hrefTags, idx1, protocol.length),
+                        calculateSubsetRange(hrefTags, idx2, originWithoutProtocol.length),
+                        protocol.length
+                      );
                     } else {
                       const index = href.indexOf(part, idx - 1);
-                      substr = href.substring(index, index + part.length);
+                      partTags = calculateSubsetRange(hrefTags, index, part.length);
                       idx += part.length;
                     }
 
-                    const partInfo = tracker.getData(substr);
-                    if (!partInfo) return;
+                    substr = part;
+                    substrTags = partTags;
+
+                    if (!partTags) return;
 
-                    const event = getPropagationEvent(strInfo, partInfo, data);
+                    const event = getPropagationEvent(url, partTags, data);
                     if (!event) return;
 
-                    Object.assign(partInfo, event);
                     const { extern } = tracker.track(part, event);
 
                     if (extern) {
@@ -171,12 +205,12 @@ module.exports = function(core) {
                     }
                   }
                 } else {
-                  traverse(substr, url, key, 0);
+                  traverse(substr, substrTags, urlObj, key, 0);
                 }
               });
             };
 
-            traverse(url, result, keys, 0);
+            traverse(url, tags, result, keys, 0);
 
             if (proxy.search) {
               proxy._contrast_searchParams = new URLSearchParams(proxy.search);

package/lib/dataflow/propagation/install/util-format.js

@@ -18,10 +18,12 @@
 const { isString, primordials: { StringPrototypeMatch } } = require('@contrast/common');
 const { createAppendTags } = require('../../tag-utils');
 const { patchType } = require('../common');
+const { regex, markCanaryValue, applyCanaryTagRanges } = require('./JSON/tag-ranges');
 
 module.exports = function(core) {
   const {
     patcher,
+    scopes,
     depHooks,
     assess: {
       inspect,
@@ -53,6 +55,32 @@ module.exports = function(core) {
     return tags;
   }
 
+  function stringifyWithTags(value) {
+    const strInfos = {};
+    let propagate = false;
+
+    function markCanaries(_key, val) {
+      const marked = markCanaryValue(tracker, strInfos, val, val);
+      if (marked.propagate) propagate = true;
+      return marked.value;
+    }
+
+    const result = scopes.instrumentation.run({ lock: true }, () => JSON.stringify(value, markCanaries));
+    if (!propagate || result === undefined) {
+      return { value: result, tags: null, history: [] };
+    }
+
+    const tags = {};
+    const metadata = { regex, strInfos, history: new Set() };
+    const taggedResult = applyCanaryTagRanges(result, metadata, tags);
+
+    return {
+      value: taggedResult,
+      tags: Object.keys(tags).length ? tags : null,
+      history: Array.from(metadata.history),
+    };
+  }
+
   return core.assess.dataflow.propagation.utilFormat = {
     install() {
       depHooks.resolve({ name: 'util', version: '*' }, (util) => {
@@ -97,9 +125,21 @@ module.exports = function(core) {
                   case 'f':
                     // won't be tracked
                     break;
-                  case 'j':
-                    arg = JSON.stringify(arg) ?? 'undefined';
-                    break;
+                  case 'j': {
+                    const stringified = stringifyWithTags(arg);
+                    arg = stringified.value ?? 'undefined';
+
+                    if (!stringified.tags) break;
+
+                    const currIdx = result.indexOf(arg, idx);
+                    if (currIdx === -1) break;
+
+                    idx = currIdx + arg.length;
+                    newTags = createAppendTags(newTags, stringified.tags, currIdx);
+                    stringified.history.forEach((info) => history.push({ ...info }));
+                    eventArgs.push({ value: arg, tracked: true });
+                    continue;
+                  }
                   case 'o':
                     break; // handled below
                   case 'O':