@contrast/assess 1.8.0 → 1.10.0

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -15,10 +15,11 @@
 
 'use strict';
 
-const util = require('util');
 const querystring = require('querystring');
 const {
-  DataflowTag: { URL_ENCODED }
+  DataflowTag: { URL_ENCODED },
+  inspect,
+  join
 } = require('@contrast/common');
 
 const { patchType } = require('../../common');
@@ -41,25 +42,26 @@ module.exports = function(core) {
     function unescapeWrapper(part) {
       let result = unescape(part);
       const start = input.indexOf(part, data.idx);
-      const tagRanges = createSubsetTags(trackingData.tags, start, result.length - 1);
+      const tagRanges = createSubsetTags(trackingData.tags, start, result.length);
 
       if (!tagRanges) return result;
 
       const resultInfo = tracker.getData(result);
+      const [, ...restOfArgsValues] = data.origArgs.map(inspect);
       const event = createPropagationEvent({
         name: data.name,
+        context: `querystring.parse('${trackingData.value}', ${join(restOfArgsValues, ', ')})`,
+        moduleName: 'querystring',
+        methodName: 'parse',
         history: [trackingData],
         object: {
           value: part,
           tracked: true,
         },
-        args: data.origArgs.map((arg) => {
-          const argInfo = tracker.getData(arg);
-          return {
-            value: argInfo ? argInfo.value : util.inspect(arg),
-            tracked: !!argInfo
-          };
-        }),
+        args: data.origArgs.map((_arg, idx) => ({
+          value: idx === 0 ? trackingData.value : restOfArgsValues[idx - 1],
+          tracked: !!idx === 0
+        })),
         result: {
           value: result,
           tracked: !!resultInfo

package/lib/dataflow/propagation/install/sequelize.js

@@ -21,7 +21,7 @@ const {
 } = require('@contrast/common');
 const { patchType, createModuleLabel } = require('../common');
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     scopes: { sources, instrumentation },
     patcher,
@@ -58,9 +58,10 @@ module.exports = function (core) {
         { name: 'sequelize', file: 'lib/sql-string.js' },
         (sqlString, version) => {
           const origEscape = sqlString.escape;
+          const name = 'sequelize.escape';
 
           patcher.patch(sqlString, 'escape', {
-            name: 'sequelize.escape',
+            name,
             patchType,
             post(data) {
               const { args, result, hooked, orig } = data;
@@ -85,8 +86,10 @@ module.exports = function (core) {
               newTags[SQL_ENCODED] = [0, result.length - 1];
 
               const event = createPropagationEvent({
-                context: 'sequelize.escape',
+                context: `sequelize.escape('${argInfo.value}')`,
                 name: 'sequelize/lib/sql-string.escape',
+                moduleName: 'sequelize',
+                methodName: 'escape',
                 object: {
                   value: createModuleLabel('sequelize/lib/sql-string.escape', version),
                   tracked: false,

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -33,8 +33,10 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.sqlTemplateStrings = {
     install() {
       depHooks.resolve({ name: 'sql-template-strings' }, (sqlTemplateStrings, version) => {
+        const name = 'sql-template-strings.SQL';
+
         patcher.patch(sqlTemplateStrings, 'SQL', {
-          name: 'sql-template-strings.SQL',
+          name,
           patchType,
           post(data) {
             const { args, result, hooked, orig } = data;
@@ -55,7 +57,10 @@ module.exports = function(core) {
               newTags[SQL_ENCODED] = [0, resultValue.length - 1];
 
               const event = createPropagationEvent({
-                name: 'sql-template-strings.SQL',
+                name,
+                moduleName: 'sql-template-strings',
+                methodName: 'SQL',
+                context: `SQL\`${argInfo.value}\``,
                 object: {
                   value: createModuleLabel('sql-template-strings', version),
                   tracked: false
@@ -68,6 +73,8 @@ module.exports = function(core) {
                 tags: newTags,
                 addedTags: [SQL_ENCODED],
                 history,
+                source: 'P',
+                target: 'R',
                 stacktraceOpts: {
                   constructorOpt: hooked,
                   prependFrames: [orig]

package/lib/dataflow/propagation/install/string/concat.js

@@ -18,6 +18,7 @@
 const {
   createAppendTags
 } = require('../../../tag-utils');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
@@ -31,8 +32,10 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.concat = {
     install() {
+      const name = 'String.prototype.concat';
+
       patcher.patch(String.prototype, 'concat', {
-        name: 'String.prototype.concat',
+        name,
         patchType,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
@@ -70,7 +73,10 @@ module.exports = function(core) {
 
           if (history.size) {
             const event = createPropagationEvent({
-              name: 'String.prototype.concat',
+              name,
+              moduleName: 'String',
+              methodName: 'prototype.concat',
+              context: `${inspect(objInfo?.value) || String(obj)}.concat(${join(argsData.map(d => d.value), ', ')})`,
               object: {
                 value: objInfo?.value || String(obj),
                 tracked: !!objInfo

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -29,8 +29,10 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.stringInstrumentation.formatMethods = {
     install() {
       ['toLowerCase', 'toUpperCase', 'toLocaleLowerCase', 'toLocaleUpperCase'].forEach((method) => {
+        const name = `String.prototype.${method}`;
+
         patcher.patch(String.prototype, method, {
-          name: `String.prototype.${method}`,
+          name,
           patchType,
           post(data) {
             const { obj, result, hooked, orig } = data;
@@ -43,7 +45,10 @@ module.exports = function(core) {
             const history = [objInfo];
 
             const event = createPropagationEvent({
-              name: `String.prototype.${method}`,
+              name,
+              moduleName: 'String',
+              methodName: `prototype.${method}`,
+              context: `'${objInfo.value}'.${method}()`,
               object: {
                 value: objInfo.value,
                 tracked: true

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -18,6 +18,7 @@
 const {
   createAppendTags
 } = require('../../../tag-utils');
+const { inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 const htmlTagsLengths = {
   anchor: 11,
@@ -57,8 +58,9 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.htmlMethods = {
     install() {
+      const name = 'String.prototype.anchor';
       patcher.patch(String.prototype, 'anchor', {
-        name: 'String.prototype.anchor',
+        name,
         patchType,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
@@ -75,7 +77,10 @@ module.exports = function(core) {
 
           if (history.size) {
             const event = createPropagationEvent({
-              name: 'String.prototype.anchor',
+              name,
+              moduleName: 'String',
+              methodName: 'prototype.anchor',
+              context: `${inspect(objInfo?.value) || String(obj)}.anchor(${argInfo ? argInfo.value : arg})`,
               object: {
                 value: objInfo?.value || String(obj),
                 tracked: !!objInfo
@@ -85,7 +90,7 @@ module.exports = function(core) {
                 tracked: true
               },
               args: [
-                { value: arg, tracked: !!argInfo }
+                { value: argInfo ? argInfo.value : arg, tracked: !!argInfo }
               ],
               tags: adjustTags('anchor', objInfo?.tags, `${arg}`.length, argInfo?.tags),
               history: Array.from(history),
@@ -109,8 +114,10 @@ module.exports = function(core) {
       });
 
       ['big', 'blink', 'italics', 'small', 'strike', 'sub', 'fixed'].forEach((method) => {
+        const name = `String.prototype.${method}`;
+
         patcher.patch(String.prototype, method, {
-          name: `String.prototype.${method}`,
+          name,
           patchType,
           post(data) {
             const { obj, result, hooked, orig } = data;
@@ -123,7 +130,10 @@ module.exports = function(core) {
             const history = [objInfo];
 
             const event = createPropagationEvent({
-              name: `String.prototype.${method}`,
+              name,
+              moduleName: 'String',
+              methodName: `prototype.${method}`,
+              context: `${objInfo.value}.${method}()`,
               object: {
                 value: objInfo.value,
                 tracked: true

package/lib/dataflow/propagation/install/string/match.js

@@ -14,7 +14,7 @@
  */
 
 'use strict';
-const { join } = require('@contrast/common');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { createSubsetTags } = require('../../../tag-utils');
 
@@ -28,24 +28,29 @@ module.exports = function(core) {
   } = core;
 
   function getPropagationEvent(data, res, objInfo, start) {
-    const { name, args, result, hooked, orig } = data;
-    const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
+    const { name, args: origArgs, result, hooked, orig } = data;
+    const tags = createSubsetTags(objInfo.tags, start, res.length);
     if (!tags) return;
 
+    const args = origArgs.map((arg) => {
+      const argInfo = tracker.getData(arg);
+      return {
+        value: argInfo ? argInfo.value : inspect(arg),
+        tracked: !!argInfo
+      };
+    });
+
     return createPropagationEvent({
       name,
+      moduleName: 'String',
+      methodName: 'prototype.match',
+      context: `'${objInfo.value}'.match(${join(args.map(a => a.value), ', ')})`,
       history: [objInfo],
       object: {
         value: objInfo.value,
         tracked: true,
       },
-      args: args.map((arg) => {
-        const argInfo = tracker.getData(arg);
-        return {
-          value: argInfo ? argInfo.value : arg.toString(),
-          tracked: !!argInfo
-        };
-      }),
+      args,
       tags,
       result: {
         value: join(result),
@@ -89,7 +94,7 @@ module.exports = function(core) {
             const res = result[i];
             if (!res || res === obj) continue;
             const start = obj.indexOf(res, idx);
-            idx += hasCaptureGroups ? 0 : res.length;
+            idx += hasCaptureGroups ? 0 : start + res.length;
             const event = getPropagationEvent(data, res, objInfo, start);
             if (event) {
               const { extern } = tracker.track(res, event);

package/lib/dataflow/propagation/install/string/replace.js

@@ -16,8 +16,11 @@
 'use strict';
 
 const {
-  DataflowTag: { UNTRUSTED }
+  DataflowTag: { UNTRUSTED },
+  match: origMatch,
+  substring
 } = require('@contrast/common');
+const { inspect, join } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
@@ -63,7 +66,7 @@ module.exports = function(core) {
         replace: str.substring(str.indexOf(match) + match.length, str.length)
       }
     ].forEach(({ regex, replace }) => {
-      if (ret && ret.match(regex)) {
+      if (ret && origMatch(ret, regex)) {
         // If the match string is tracked, we can actually use the patched replace
         // to keep track of its tag ranges
         if (tracker.getData(replace)) {
@@ -77,7 +80,7 @@ module.exports = function(core) {
     const numberedGroupMatches = replacementType !== 'function' && replacement.match(/\$[1-9][0-9]|\$[1-9]/g);
     if (numberedGroupMatches) {
       numberedGroupMatches.forEach((numberedGroup) => {
-        const group = Number(numberedGroup.substring(1));
+        const group = Number(substring(numberedGroup, 1));
         ret = origReplace.call(ret, numberedGroup, captureGroups[group - 1]);
       });
     }
@@ -112,7 +115,7 @@ module.exports = function(core) {
       const { _accumOffset, _accumTags } = data;
       const { replacement, replacementInfo } = getReplacementInfo(data, args, parsedArgs);
 
-      const preTags = createSubsetTags(_accumTags, 0, _accumOffset + matchIdx - 1);
+      const preTags = createSubsetTags(_accumTags, 0, _accumOffset + matchIdx);
       const postTags = createSubsetTags(_accumTags, _accumOffset + matchIdx + match.length, str.length - matchIdx - match.length);
       data._accumOffset += (replacement.length - match.length);
       if (preTags || postTags || replacementInfo) {
@@ -130,8 +133,9 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.replace = {
     install() {
+      const name = 'String.prototype.replace';
       patcher.patch(String.prototype, 'replace', {
-        name: 'String.prototype.replace',
+        name,
         patchType,
         pre(data) {
           if (!sources.getStore()?.assess || instrumentation.isLocked()) return;
@@ -160,23 +164,27 @@ module.exports = function(core) {
             return;
           }
 
-          const { _replacementInfo, obj, args, result, hooked, orig } = data;
+          const { _replacementInfo, obj, args: origArgs, result, hooked, orig } = data;
+          const args = [{
+            value: inspect(origArgs[0]),
+            tracked: !!tracker.getData(origArgs[0])
+          },
+          {
+            value: data._replacement,
+            tracked: !!_replacementInfo
+          }];
 
           const event = createPropagationEvent({
-            name: 'String.prototype.replace',
+            name,
+            moduleName: 'String',
+            methodName: 'prototype.replace',
+            context: `'${obj}'.replace(${join(args.map(a => a.value), ', ')})`,
             history: Array.from(data._history),
             object: {
               value: obj,
               tracked: !!data._objInfo
             },
-            args: [{
-              value: args[0].toString(),
-              tracked: !!tracker.getData(args[0])
-            },
-            {
-              value: data._replacement,
-              tracked: !!_replacementInfo
-            }],
+            args,
             result: {
               value: result,
               tracked: true

package/lib/dataflow/propagation/install/string/slice.js

@@ -14,6 +14,7 @@
  */
 'use strict';
 const { patchType } = require('../../common');
+const { inspect, join } = require('@contrast/common');
 const { createSubsetTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
@@ -36,7 +37,7 @@ module.exports = function(core) {
       end = obj.length - (Math.abs(end) || 0);
     }
 
-    const subsetLen = (hasSingleArg ? obj.length - start : Math.abs(end - start)) - 1;
+    const subsetLen = (hasSingleArg ? obj.length - start : Math.abs(end - start));
 
     return {
       startIdx: start,
@@ -52,7 +53,7 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { name, args, obj, result, hooked, orig } = data;
+          const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !sources.getStore() || instrumentation.isLocked()) return;
 
           const objInfo = tracker.getData(obj);
@@ -68,22 +69,29 @@ module.exports = function(core) {
           const tags = createSubsetTags(objInfo.tags, startIdx, subsetLen);
           if (!tags) return;
 
+          const args = origArgs.map((arg) => ({
+            value: inspect(arg),
+            tracked: false
+          }));
+
           const event = createPropagationEvent({
             name,
+            moduleName: 'String',
+            methodName: 'prototype.slice',
+            context: `'${objInfo.value}'.slice(${join(args.map(a => a.value), ', ')})`,
             history: [objInfo],
             object: {
               value: obj,
               tracked: true,
             },
-            args: args.map((arg) => ({
-              value: arg.toString(),
-              tracked: false
-            })),
+            args,
             result: {
               value: result,
               tracked: true
             },
             tags,
+            source: 'O',
+            target: 'R',
             stacktraceOpts: {
               constructorOpt: hooked,
               prependFrames: [orig]

package/lib/dataflow/propagation/install/string/split.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { patchType } = require('../../common');
-const { join } = require('@contrast/common');
+const { join, inspect } = require('@contrast/common');
 const { createSubsetTags } = require('../../../tag-utils');
 
 
@@ -37,16 +37,16 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { name, args, obj, result, hooked, orig } = data;
+          const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (
             !obj ||
             !result ||
-            args.length === 0 ||
+            origArgs.length === 0 ||
             result.length === 0 ||
             !sources.getStore() ||
             typeof obj !== 'string' ||
             instrumentation.isLocked() ||
-            (args.length === 1 && args[0] == null)
+            (origArgs.length === 1 && origArgs[0] == null)
           ) return;
 
           const objInfo = tracker.getData(obj);
@@ -60,23 +60,27 @@ module.exports = function(core) {
             const objSubstr = obj.substring(start, start + res.length);
             const objSubstrInfo = tracker.getData(objSubstr);
             if (objSubstrInfo) {
-              const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
+              const tags = createSubsetTags(objInfo.tags, start, res.length);
               if (!tags) continue;
 
+              const args = origArgs.map((arg) => {
+                const argInfo = tracker.getData(arg);
+                return {
+                  value: argInfo ? argInfo.value : inspect(arg),
+                  tracked: !!argInfo
+                };
+              });
               const event = createPropagationEvent({
                 name,
+                moduleName: 'String',
+                methodName: 'prototype.slice',
+                context: `'${objInfo.value}'.split(${join(args.map(a => a.value), ', ')})`,
                 history: [objInfo],
                 object: {
                   value: obj,
                   tracked: true,
                 },
-                args: args.map((arg) => {
-                  const argInfo = tracker.getData(arg);
-                  return {
-                    value: argInfo ? argInfo.value : arg.toString(),
-                    tracked: !!argInfo
-                  };
-                }),
+                args,
                 tags,
                 result: {
                   value: join(result),

package/lib/dataflow/propagation/install/string/substring.js

@@ -16,6 +16,7 @@
 'use strict';
 
 const { createSubsetTags } = require('../../../tag-utils');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
@@ -29,7 +30,7 @@ module.exports = function(core) {
 
   function calculateSubsetRangeForSubstr({ args, result }) {
     const startIdx = args[0] || 0;
-    const subsetLen = args[1] === undefined ? result.length - startIdx - 1 : args[1] - 1;
+    const subsetLen = args[1] === undefined ? result.length - startIdx : args[1];
 
     return {
       startIdx,
@@ -40,7 +41,7 @@ module.exports = function(core) {
   function calculateSubsetRangeForSubstring({ obj, args }) {
     const hasSingleArg = args[1] === undefined;
     const startIdx = hasSingleArg ? args[0] : Math.min(...args);
-    const subsetLen = (hasSingleArg ? obj.length - args[0] : Math.abs(args[1] - args[0])) - 1;
+    const subsetLen = (hasSingleArg ? obj.length - args[0] : Math.abs(args[1] - args[0]));
 
     return {
       startIdx,
@@ -60,8 +61,8 @@ module.exports = function(core) {
           name: `String.prototype.${method}`,
           patchType,
           post(data) {
-            const { obj, args, result, name, hooked, orig } = data;
-            if (!result || !sources.getStore() || instrumentation.isLocked()) return;
+            const { obj, args: origArgs, result, name, hooked, orig } = data;
+            if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
 
             const objInfo = tracker.getData(obj);
             if (!objInfo) return;
@@ -78,17 +79,21 @@ module.exports = function(core) {
 
             if (!tags) return;
 
+            const args = origArgs.map((arg) => ({
+              value: inspect(arg),
+              tracked: false
+            }));
             const event = createPropagationEvent({
               name,
+              moduleName: 'String',
+              methodName: 'prototype.substring',
+              context: `'${objInfo.value}'.substring(${join(args.map(a => a.value), ', ')})`,
               history: [objInfo],
               object: {
                 value: obj,
                 tracked: true,
               },
-              args: args.map((arg) => ({
-                value: arg.toString(),
-                tracked: false
-              })),
+              args,
               result: {
                 value: result,
                 tracked: true
@@ -101,6 +106,11 @@ module.exports = function(core) {
               },
               target: 'R',
             });
+
+            if (!event) {
+              return;
+            }
+
             const { extern } = tracker.track(result, event);
 
             if (extern) {

package/lib/dataflow/propagation/install/string/trim.js

@@ -52,7 +52,7 @@ module.exports = function(core) {
       const start = presetStart || obj.indexOf(result);
       const newTags = {};
       const objTags = objInfo.tags || {};
-      Object.assign(newTags, createSubsetTags(objTags, start, result.length - 1));
+      Object.assign(newTags, createSubsetTags(objTags, start, result.length));
 
       if (!newTags.untrusted) {
         return;
@@ -60,6 +60,9 @@ module.exports = function(core) {
 
       const event = createPropagationEvent({
         name: `String.prototype.${methodName}`,
+        moduleName: 'String',
+        methodName: `prototype.${methodName}`,
+        context: `'${obj}'.${methodName}()`,
         history,
         object: {
           value: obj,

package/lib/dataflow/propagation/install/unescape.js

@@ -34,8 +34,10 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.unescape = {
     install() {
+      const name = 'global.unescape';
+
       patcher.patch(global, 'unescape', {
-        name: 'global.unescape',
+        name,
         patchType,
         post(data) {
           const { args, result, hooked, orig } = data;
@@ -53,7 +55,10 @@ module.exports = function(core) {
           if (!Object.keys(newTags).length) return;
 
           const event = createPropagationEvent({
-            name: 'global.unescape',
+            name,
+            moduleName: 'global',
+            methodName: 'unescape',
+            context: `unescape('${argInfo.value}')`,
             object: {
               value: createObjectLabel('global'),
               tracked: false
@@ -65,6 +70,8 @@ module.exports = function(core) {
             args: [{ value: argInfo.value, tracked: true }],
             tags: newTags,
             history,
+            source: 'P',
+            target: 'R',
             removedTags: [WEAK_URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -34,8 +34,10 @@ module.exports = function(core) {
     install() {
       depHooks.resolve({ name: 'url' }, (url, version) => {
         ['domainToASCII', 'domainToUnicode'].forEach((method) => {
+          const name = `url.${method}`;
+
           patcher.patch(url, method, {
-            name: `url.${method}`,
+            name,
             patchType,
             post(data) {
               const { args, result, hooked, orig } = data;
@@ -49,7 +51,10 @@ module.exports = function(core) {
               const history = [argInfo];
 
               const event = createPropagationEvent({
-                name: `url.${method}`,
+                name,
+                moduleName: 'url',
+                methodName: method,
+                context: `url.${method}('${argInfo.value}')`,
                 object: {
                   value: createModuleLabel('url', version),
                   tracked: false

package/lib/dataflow/propagation/install/url/index.js

@@ -28,6 +28,7 @@ module.exports = function(core) {
   };
 
   require('./domain-parsers')(core);
+  require('./url')(core);
 
   return urlInstrumentation;
 };