@contrast/assess 1.8.0 → 1.9.0

package/lib/dataflow/propagation/install/parse-int.js

@@ -0,0 +1,60 @@
+/*
+ * Copyright: 2022 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { isString } = require('@contrast/common');
+const { patchType } = require('../common');
+
+module.exports = function(core) {
+  const {
+    logger,
+    scopes: { instrumentation, sources },
+    patcher,
+    assess: {
+      dataflow: { tracker }
+    }
+  } = core;
+
+  const name = 'global.parseInt';
+
+  return core.assess.dataflow.propagation.parseIntInstrumentation = {
+    install() {
+      patcher.patch(global, 'parseInt', {
+        name,
+        patchType,
+        post(data) {
+          const { args: [value], result } = data;
+          if (
+            isNaN(result) ||
+            !value ||
+            !isString(value) ||
+            !sources.getStore()?.assess ||
+            instrumentation.isLocked() ||
+            !tracker.getData(value)
+          ) return;
+
+          // todo NODE-3118 to handle when value has trailing non-integer values
+
+          tracker.untrack(value);
+          logger.trace({ sanitizer: name, value }, 'untracked a string value');
+        }
+      });
+    },
+    uninstall() {
+      global.parseInt = patcher.unwrap(global.parseInt);
+    },
+  };
+};

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -36,8 +36,10 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.pugRuntimeEscape = {
     install() {
       depHooks.resolve({ name: 'pug-runtime' }, (pugRuntime, version) => {
+        const name = 'pug-runtime.escape';
+
         patcher.patch(pugRuntime, 'escape', {
-          name: 'pug-runtime.escape',
+          name,
           patchType,
           post(data) {
             const { args, result, hooked, orig } = data;
@@ -54,7 +56,10 @@ module.exports = function(core) {
             newTags[WEAK_URL_ENCODED] = [0, result.length - 1];
 
             const event = createPropagationEvent({
-              name: 'pug-runtime.escape',
+              name,
+              moduleName: 'pug-runtime',
+              methodName: 'escape',
+              context: `pugRuntime.escape('${argInfo.value}')`,
               object: {
                 value: createModuleLabel('pug-runtime', version),
                 tracked: false
@@ -67,6 +72,8 @@ module.exports = function(core) {
               tags: newTags,
               addedTags: [WEAK_URL_ENCODED],
               history,
+              source: 'P',
+              target: 'R',
               stacktraceOpts: {
                 constructorOpt: hooked,
                 prependFrames: [orig]

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -15,10 +15,11 @@
 
 'use strict';
 
-const util = require('util');
 const querystring = require('querystring');
 const {
-  DataflowTag: { URL_ENCODED }
+  DataflowTag: { URL_ENCODED },
+  inspect,
+  join
 } = require('@contrast/common');
 
 const { patchType } = require('../../common');
@@ -46,20 +47,21 @@ module.exports = function(core) {
       if (!tagRanges) return result;
 
       const resultInfo = tracker.getData(result);
+      const [, ...restOfArgsValues] = data.origArgs.map(inspect);
       const event = createPropagationEvent({
         name: data.name,
+        context: `querystring.parse('${trackingData.value}', ${join(restOfArgsValues, ', ')})`,
+        moduleName: 'querystring',
+        methodName: 'parse',
         history: [trackingData],
         object: {
           value: part,
           tracked: true,
         },
-        args: data.origArgs.map((arg) => {
-          const argInfo = tracker.getData(arg);
-          return {
-            value: argInfo ? argInfo.value : util.inspect(arg),
-            tracked: !!argInfo
-          };
-        }),
+        args: data.origArgs.map((_arg, idx) => ({
+          value: idx === 0 ? trackingData.value : restOfArgsValues[idx - 1],
+          tracked: !!idx === 0
+        })),
         result: {
           value: result,
           tracked: !!resultInfo

package/lib/dataflow/propagation/install/sequelize.js

@@ -21,7 +21,7 @@ const {
 } = require('@contrast/common');
 const { patchType, createModuleLabel } = require('../common');
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     scopes: { sources, instrumentation },
     patcher,
@@ -58,9 +58,10 @@ module.exports = function (core) {
         { name: 'sequelize', file: 'lib/sql-string.js' },
         (sqlString, version) => {
           const origEscape = sqlString.escape;
+          const name = 'sequelize.escape';
 
           patcher.patch(sqlString, 'escape', {
-            name: 'sequelize.escape',
+            name,
             patchType,
             post(data) {
               const { args, result, hooked, orig } = data;
@@ -85,8 +86,10 @@ module.exports = function (core) {
               newTags[SQL_ENCODED] = [0, result.length - 1];
 
               const event = createPropagationEvent({
-                context: 'sequelize.escape',
+                context: `sequelize.escape('${argInfo.value}')`,
                 name: 'sequelize/lib/sql-string.escape',
+                moduleName: 'sequelize',
+                methodName: 'escape',
                 object: {
                   value: createModuleLabel('sequelize/lib/sql-string.escape', version),
                   tracked: false,

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -33,8 +33,10 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.sqlTemplateStrings = {
     install() {
       depHooks.resolve({ name: 'sql-template-strings' }, (sqlTemplateStrings, version) => {
+        const name = 'sql-template-strings.SQL';
+
         patcher.patch(sqlTemplateStrings, 'SQL', {
-          name: 'sql-template-strings.SQL',
+          name,
           patchType,
           post(data) {
             const { args, result, hooked, orig } = data;
@@ -55,7 +57,10 @@ module.exports = function(core) {
               newTags[SQL_ENCODED] = [0, resultValue.length - 1];
 
               const event = createPropagationEvent({
-                name: 'sql-template-strings.SQL',
+                name,
+                moduleName: 'sql-template-strings',
+                methodName: 'SQL',
+                context: `SQL\`${argInfo.value}\``,
                 object: {
                   value: createModuleLabel('sql-template-strings', version),
                   tracked: false
@@ -68,6 +73,8 @@ module.exports = function(core) {
                 tags: newTags,
                 addedTags: [SQL_ENCODED],
                 history,
+                source: 'P',
+                target: 'R',
                 stacktraceOpts: {
                   constructorOpt: hooked,
                   prependFrames: [orig]

package/lib/dataflow/propagation/install/string/concat.js

@@ -18,6 +18,7 @@
 const {
   createAppendTags
 } = require('../../../tag-utils');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
@@ -31,8 +32,10 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.concat = {
     install() {
+      const name = 'String.prototype.concat';
+
       patcher.patch(String.prototype, 'concat', {
-        name: 'String.prototype.concat',
+        name,
         patchType,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
@@ -70,7 +73,10 @@ module.exports = function(core) {
 
           if (history.size) {
             const event = createPropagationEvent({
-              name: 'String.prototype.concat',
+              name,
+              moduleName: 'String',
+              methodName: 'prototype.concat',
+              context: `${inspect(objInfo?.value) || String(obj)}.concat(${join(argsData.map(d => d.value), ', ')})`,
               object: {
                 value: objInfo?.value || String(obj),
                 tracked: !!objInfo

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -29,8 +29,10 @@ module.exports = function(core) {
   return core.assess.dataflow.propagation.stringInstrumentation.formatMethods = {
     install() {
       ['toLowerCase', 'toUpperCase', 'toLocaleLowerCase', 'toLocaleUpperCase'].forEach((method) => {
+        const name = `String.prototype.${method}`;
+
         patcher.patch(String.prototype, method, {
-          name: `String.prototype.${method}`,
+          name,
           patchType,
           post(data) {
             const { obj, result, hooked, orig } = data;
@@ -43,7 +45,10 @@ module.exports = function(core) {
             const history = [objInfo];
 
             const event = createPropagationEvent({
-              name: `String.prototype.${method}`,
+              name,
+              moduleName: 'String',
+              methodName: `prototype.${method}`,
+              context: `'${objInfo.value}'.${method}()`,
               object: {
                 value: objInfo.value,
                 tracked: true

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -18,6 +18,7 @@
 const {
   createAppendTags
 } = require('../../../tag-utils');
+const { inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 const htmlTagsLengths = {
   anchor: 11,
@@ -57,8 +58,9 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.htmlMethods = {
     install() {
+      const name = 'String.prototype.anchor';
       patcher.patch(String.prototype, 'anchor', {
-        name: 'String.prototype.anchor',
+        name,
         patchType,
         post(data) {
           const { args, obj, result, hooked, orig } = data;
@@ -75,7 +77,10 @@ module.exports = function(core) {
 
           if (history.size) {
             const event = createPropagationEvent({
-              name: 'String.prototype.anchor',
+              name,
+              moduleName: 'String',
+              methodName: 'prototype.anchor',
+              context: `${inspect(objInfo?.value) || String(obj)}.anchor(${argInfo ? argInfo.value : arg})`,
               object: {
                 value: objInfo?.value || String(obj),
                 tracked: !!objInfo
@@ -85,7 +90,7 @@ module.exports = function(core) {
                 tracked: true
               },
               args: [
-                { value: arg, tracked: !!argInfo }
+                { value: argInfo ? argInfo.value : arg, tracked: !!argInfo }
               ],
               tags: adjustTags('anchor', objInfo?.tags, `${arg}`.length, argInfo?.tags),
               history: Array.from(history),
@@ -109,8 +114,10 @@ module.exports = function(core) {
       });
 
       ['big', 'blink', 'italics', 'small', 'strike', 'sub', 'fixed'].forEach((method) => {
+        const name = `String.prototype.${method}`;
+
         patcher.patch(String.prototype, method, {
-          name: `String.prototype.${method}`,
+          name,
           patchType,
           post(data) {
             const { obj, result, hooked, orig } = data;
@@ -123,7 +130,10 @@ module.exports = function(core) {
             const history = [objInfo];
 
             const event = createPropagationEvent({
-              name: `String.prototype.${method}`,
+              name,
+              moduleName: 'String',
+              methodName: `prototype.${method}`,
+              context: `${objInfo.value}.${method}()`,
               object: {
                 value: objInfo.value,
                 tracked: true

package/lib/dataflow/propagation/install/string/match.js

@@ -14,7 +14,7 @@
  */
 
 'use strict';
-const { join } = require('@contrast/common');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { createSubsetTags } = require('../../../tag-utils');
 
@@ -28,24 +28,29 @@ module.exports = function(core) {
   } = core;
 
   function getPropagationEvent(data, res, objInfo, start) {
-    const { name, args, result, hooked, orig } = data;
+    const { name, args: origArgs, result, hooked, orig } = data;
     const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
     if (!tags) return;
 
+    const args = origArgs.map((arg) => {
+      const argInfo = tracker.getData(arg);
+      return {
+        value: argInfo ? argInfo.value : inspect(arg),
+        tracked: !!argInfo
+      };
+    });
+
     return createPropagationEvent({
       name,
+      moduleName: 'String',
+      methodName: 'prototype.match',
+      context: `'${objInfo.value}'.match(${join(args.map(a => a.value), ', ')})`,
       history: [objInfo],
       object: {
         value: objInfo.value,
         tracked: true,
       },
-      args: args.map((arg) => {
-        const argInfo = tracker.getData(arg);
-        return {
-          value: argInfo ? argInfo.value : arg.toString(),
-          tracked: !!argInfo
-        };
-      }),
+      args,
       tags,
       result: {
         value: join(result),

package/lib/dataflow/propagation/install/string/replace.js

@@ -16,8 +16,11 @@
 'use strict';
 
 const {
-  DataflowTag: { UNTRUSTED }
+  DataflowTag: { UNTRUSTED },
+  match: origMatch,
+  substring
 } = require('@contrast/common');
+const { inspect, join } = require('@contrast/common');
 const { patchType } = require('../../common');
 const { createSubsetTags, createAppendTags } = require('../../../tag-utils');
 
@@ -63,7 +66,7 @@ module.exports = function(core) {
         replace: str.substring(str.indexOf(match) + match.length, str.length)
       }
     ].forEach(({ regex, replace }) => {
-      if (ret && ret.match(regex)) {
+      if (ret && origMatch(ret, regex)) {
         // If the match string is tracked, we can actually use the patched replace
         // to keep track of its tag ranges
         if (tracker.getData(replace)) {
@@ -77,7 +80,7 @@ module.exports = function(core) {
     const numberedGroupMatches = replacementType !== 'function' && replacement.match(/\$[1-9][0-9]|\$[1-9]/g);
     if (numberedGroupMatches) {
       numberedGroupMatches.forEach((numberedGroup) => {
-        const group = Number(numberedGroup.substring(1));
+        const group = Number(substring(numberedGroup, 1));
         ret = origReplace.call(ret, numberedGroup, captureGroups[group - 1]);
       });
     }
@@ -130,8 +133,9 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.stringInstrumentation.replace = {
     install() {
+      const name = 'String.prototype.replace';
       patcher.patch(String.prototype, 'replace', {
-        name: 'String.prototype.replace',
+        name,
         patchType,
         pre(data) {
           if (!sources.getStore()?.assess || instrumentation.isLocked()) return;
@@ -160,23 +164,27 @@ module.exports = function(core) {
             return;
           }
 
-          const { _replacementInfo, obj, args, result, hooked, orig } = data;
+          const { _replacementInfo, obj, args: origArgs, result, hooked, orig } = data;
+          const args = [{
+            value: inspect(origArgs[0]),
+            tracked: !!tracker.getData(origArgs[0])
+          },
+          {
+            value: data._replacement,
+            tracked: !!_replacementInfo
+          }];
 
           const event = createPropagationEvent({
-            name: 'String.prototype.replace',
+            name,
+            moduleName: 'String',
+            methodName: 'prototype.replace',
+            context: `'${obj}'.replace(${join(args.map(a => a.value), ', ')})`,
             history: Array.from(data._history),
             object: {
               value: obj,
               tracked: !!data._objInfo
             },
-            args: [{
-              value: args[0].toString(),
-              tracked: !!tracker.getData(args[0])
-            },
-            {
-              value: data._replacement,
-              tracked: !!_replacementInfo
-            }],
+            args,
             result: {
               value: result,
               tracked: true

package/lib/dataflow/propagation/install/string/slice.js

@@ -14,6 +14,7 @@
  */
 'use strict';
 const { patchType } = require('../../common');
+const { inspect, join } = require('@contrast/common');
 const { createSubsetTags } = require('../../../tag-utils');
 
 module.exports = function(core) {
@@ -52,7 +53,7 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { name, args, obj, result, hooked, orig } = data;
+          const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (!result || !sources.getStore() || instrumentation.isLocked()) return;
 
           const objInfo = tracker.getData(obj);
@@ -68,22 +69,29 @@ module.exports = function(core) {
           const tags = createSubsetTags(objInfo.tags, startIdx, subsetLen);
           if (!tags) return;
 
+          const args = origArgs.map((arg) => ({
+            value: inspect(arg),
+            tracked: false
+          }));
+
           const event = createPropagationEvent({
             name,
+            moduleName: 'String',
+            methodName: 'prototype.slice',
+            context: `'${objInfo.value}'.slice(${join(args.map(a => a.value), ', ')})`,
             history: [objInfo],
             object: {
               value: obj,
               tracked: true,
             },
-            args: args.map((arg) => ({
-              value: arg.toString(),
-              tracked: false
-            })),
+            args,
             result: {
               value: result,
               tracked: true
             },
             tags,
+            source: 'O',
+            target: 'R',
             stacktraceOpts: {
               constructorOpt: hooked,
               prependFrames: [orig]

package/lib/dataflow/propagation/install/string/split.js

@@ -16,7 +16,7 @@
 'use strict';
 
 const { patchType } = require('../../common');
-const { join } = require('@contrast/common');
+const { join, inspect } = require('@contrast/common');
 const { createSubsetTags } = require('../../../tag-utils');
 
 
@@ -37,16 +37,16 @@ module.exports = function(core) {
         name,
         patchType,
         post(data) {
-          const { name, args, obj, result, hooked, orig } = data;
+          const { name, args: origArgs, obj, result, hooked, orig } = data;
           if (
             !obj ||
             !result ||
-            args.length === 0 ||
+            origArgs.length === 0 ||
             result.length === 0 ||
             !sources.getStore() ||
             typeof obj !== 'string' ||
             instrumentation.isLocked() ||
-            (args.length === 1 && args[0] == null)
+            (origArgs.length === 1 && origArgs[0] == null)
           ) return;
 
           const objInfo = tracker.getData(obj);
@@ -63,20 +63,24 @@ module.exports = function(core) {
               const tags = createSubsetTags(objInfo.tags, start, res.length - 1);
               if (!tags) continue;
 
+              const args = origArgs.map((arg) => {
+                const argInfo = tracker.getData(arg);
+                return {
+                  value: argInfo ? argInfo.value : inspect(arg),
+                  tracked: !!argInfo
+                };
+              });
               const event = createPropagationEvent({
                 name,
+                moduleName: 'String',
+                methodName: 'prototype.slice',
+                context: `'${objInfo.value}'.split(${join(args.map(a => a.value), ', ')})`,
                 history: [objInfo],
                 object: {
                   value: obj,
                   tracked: true,
                 },
-                args: args.map((arg) => {
-                  const argInfo = tracker.getData(arg);
-                  return {
-                    value: argInfo ? argInfo.value : arg.toString(),
-                    tracked: !!argInfo
-                  };
-                }),
+                args,
                 tags,
                 result: {
                   value: join(result),

package/lib/dataflow/propagation/install/string/substring.js

@@ -16,6 +16,7 @@
 'use strict';
 
 const { createSubsetTags } = require('../../../tag-utils');
+const { join, inspect } = require('@contrast/common');
 const { patchType } = require('../../common');
 
 module.exports = function(core) {
@@ -60,8 +61,8 @@ module.exports = function(core) {
           name: `String.prototype.${method}`,
           patchType,
           post(data) {
-            const { obj, args, result, name, hooked, orig } = data;
-            if (!result || !sources.getStore() || instrumentation.isLocked()) return;
+            const { obj, args: origArgs, result, name, hooked, orig } = data;
+            if (!result || !sources.getStore()?.assess || instrumentation.isLocked()) return;
 
             const objInfo = tracker.getData(obj);
             if (!objInfo) return;
@@ -78,17 +79,21 @@ module.exports = function(core) {
 
             if (!tags) return;
 
+            const args = origArgs.map((arg) => ({
+              value: inspect(arg),
+              tracked: false
+            }));
             const event = createPropagationEvent({
               name,
+              moduleName: 'String',
+              methodName: 'prototype.substring',
+              context: `'${objInfo.value}'.substring(${join(args.map(a => a.value), ', ')})`,
               history: [objInfo],
               object: {
                 value: obj,
                 tracked: true,
               },
-              args: args.map((arg) => ({
-                value: arg.toString(),
-                tracked: false
-              })),
+              args,
               result: {
                 value: result,
                 tracked: true
@@ -101,6 +106,11 @@ module.exports = function(core) {
               },
               target: 'R',
             });
+
+            if (!event) {
+              return;
+            }
+
             const { extern } = tracker.track(result, event);
 
             if (extern) {

package/lib/dataflow/propagation/install/string/trim.js

@@ -60,6 +60,9 @@ module.exports = function(core) {
 
       const event = createPropagationEvent({
         name: `String.prototype.${methodName}`,
+        moduleName: 'String',
+        methodName: `prototype.${methodName}`,
+        context: `'${obj}'.${methodName}()`,
         history,
         object: {
           value: obj,

package/lib/dataflow/propagation/install/unescape.js

@@ -34,8 +34,10 @@ module.exports = function(core) {
 
   return core.assess.dataflow.propagation.unescape = {
     install() {
+      const name = 'global.unescape';
+
       patcher.patch(global, 'unescape', {
-        name: 'global.unescape',
+        name,
         patchType,
         post(data) {
           const { args, result, hooked, orig } = data;
@@ -53,7 +55,10 @@ module.exports = function(core) {
           if (!Object.keys(newTags).length) return;
 
           const event = createPropagationEvent({
-            name: 'global.unescape',
+            name,
+            moduleName: 'global',
+            methodName: 'unescape',
+            context: `unescape('${argInfo.value}')`,
             object: {
               value: createObjectLabel('global'),
               tracked: false
@@ -65,6 +70,8 @@ module.exports = function(core) {
             args: [{ value: argInfo.value, tracked: true }],
             tags: newTags,
             history,
+            source: 'P',
+            target: 'R',
             removedTags: [WEAK_URL_ENCODED],
             stacktraceOpts: {
               constructorOpt: hooked,