@contrast/assess 1.8.0 → 1.9.0

package/lib/dataflow/propagation/install/url/domain-parsers.js

@@ -34,8 +34,10 @@ module.exports = function(core) {
     install() {
       depHooks.resolve({ name: 'url' }, (url, version) => {
         ['domainToASCII', 'domainToUnicode'].forEach((method) => {
+          const name = `url.${method}`;
+
           patcher.patch(url, method, {
-            name: `url.${method}`,
+            name,
             patchType,
             post(data) {
               const { args, result, hooked, orig } = data;
@@ -49,7 +51,10 @@ module.exports = function(core) {
               const history = [argInfo];
 
               const event = createPropagationEvent({
-                name: `url.${method}`,
+                name,
+                moduleName: 'url',
+                methodName: method,
+                context: `url.${method}('${argInfo.value}')`,
                 object: {
                   value: createModuleLabel('url', version),
                   tracked: false

package/lib/dataflow/propagation/install/validator/hooks.js

@@ -30,9 +30,12 @@ module.exports = function(core) {
   function createValidatorPropagationEvent(method, data, trackingData, newTags, target) {
     return createPropagationEvent({
       name: `validator.${method}`,
+      moduleName: 'validator',
+      methodName: method,
+      context: `validator.${method}('${trackingData.value}')`,
       history: [{ ...trackingData }],
       args: [{
-        value: data.args[0],
+        value: trackingData.value,
         tracked: true
       }],
       result: {
@@ -59,8 +62,9 @@ module.exports = function(core) {
           { name: 'validator', file: `lib/${validator}` },
           (index) => {
             const patchFn = typeof index === 'object' ? index.default : index;
+            const name = `validator.${validator}`;
             return patcher.patch(patchFn, {
-              name: `validator.${validator}`,
+              name,
               patchType,
               post(data) {
                 const matches = validator === 'matches';

package/lib/dataflow/sinks/install/child-process.js

@@ -15,13 +15,16 @@
 
 'use strict';
 const {
-  DataflowTag: { UNTRUSTED }
+  DataflowTag: { UNTRUSTED },
+  join,
+  Rule,
+  isString,
+  inspect,
 } = require('@contrast/common');
 
 const { patchType } = require('../common');
-const { Rule, isString, inspect } = require('@contrast/common');
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     depHooks,
     patcher,
@@ -37,38 +40,53 @@ module.exports = function (core) {
 
   const safeTags = [];
 
-  function commandCheck(name, command, secondArg, thirdArg, hooked) {
+  function commandCheck(
+    name,
+    method,
+    command,
+    secondArg,
+    thirdArg,
+    hooked,
+    orig
+  ) {
     const strInfo = tracker.getData(command);
-    if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) return {
-      strInfo: null,
-      reported: false
-    };
+    if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags))
+      return {
+        strInfo: null,
+        reported: false,
+      };
+
+    const args = [
+      {
+        value: strInfo.value,
+        tracked: true,
+      },
+      secondArg && {
+        value: inspect(secondArg),
+        tracked: false,
+      },
+      thirdArg && {
+        value: inspect(thirdArg),
+        tracked: false,
+      },
+    ].filter(Boolean);
 
     const event = createSinkEvent({
       name,
+      moduleName: 'child_process',
+      methodName: method,
+      context: `child_process.${method}(${join(args.map((a, idx) => idx === 0 ? `'${a.value}'` : a.value), ', ')})`,
       history: [strInfo],
       object: {
         value: 'child_process',
         tracked: false,
       },
-      args: [
-        {
-          value: strInfo.value,
-          tracked: true,
-        },
-        (secondArg && {
-          value: inspect(secondArg),
-          tracked: false
-        }),
-        (thirdArg && {
-          value: inspect(thirdArg),
-          tracked: false
-        })
-      ].filter(Boolean),
+      args,
       tags: strInfo.tags,
       source: 'P0',
       stacktraceOpts: {
         constructorOpt: hooked,
+        prependFrames: [orig],
       },
     });
 
@@ -80,24 +98,33 @@ module.exports = function (core) {
 
       return {
         strInfo,
-        reported: true
+        reported: true,
       };
     }
 
     return {
       strInfo,
-      reported: false
+      reported: false,
     };
   }
 
-  function argumentsCheck(name, command, commandInfo, args, options, hooked) {
-    if (!Array.isArray(args) || !args?.length) return;
+  function argumentsCheck(
+    name,
+    method,
+    command,
+    commandInfo,
+    origArgs,
+    options,
+    hooked,
+    orig
+  ) {
+    if (!Array.isArray(origArgs) || !origArgs?.length) return;
 
     const trackedArgs = [];
     let vulnerableArgIdx;
 
-    for (let i = 0; i < args.length; i++) {
-      const trackData = tracker.getData(args[i]);
+    for (let i = 0; i < origArgs.length; i++) {
+      const trackData = tracker.getData(origArgs[i]);
 
       trackedArgs.push(trackData);
 
@@ -116,31 +143,36 @@ module.exports = function (core) {
 
     if (vulnerableArgIdx != 0 && !vulnerableArgIdx) return;
 
+    const args = [
+      {
+        value: commandInfo?.value || command,
+        tracked: !!commandInfo,
+      },
+      {
+        value: inspect(origArgs),
+        tracked: true,
+      },
+      {
+        value: inspect(options),
+        tracked: false,
+      },
+    ];
     const event = createSinkEvent({
       name,
+      moduleName: 'child_process',
+      methodName: method,
+      context: `child_process.${method}(${join(args.map((a, idx) => idx === 0 ? `'${a.value}'` : a.value), ', ')})`,
       history: [trackedArgs[vulnerableArgIdx]],
       object: {
         value: 'child_process',
         tracked: false,
       },
-      args: [
-        {
-          value: commandInfo?.value || command,
-          tracked: !!commandInfo,
-        },
-        {
-          value: inspect(args),
-          tracked: true
-        },
-        {
-          value: inspect(options),
-          tracked: false
-        }
-      ],
+      args,
       tags: trackedArgs[vulnerableArgIdx].tags,
       source: 'P1',
       stacktraceOpts: {
         contructorOpt: hooked,
+        prependFrames: [orig],
       },
     });
 
@@ -154,7 +186,7 @@ module.exports = function (core) {
 
   core.assess.dataflow.sinks.cmdInjection = {
     install() {
-      depHooks.resolve({ name: 'child_process' }, cp => {
+      depHooks.resolve({ name: 'child_process' }, (cp) => {
         ['spawn', 'spawnSync'].forEach((method) => {
           const name = `child_process.${method}`;
           patcher.patch(cp, method, {
@@ -169,12 +201,29 @@ module.exports = function (core) {
               const cpArgs = Array.isArray(data.args[1]) && data.args[1];
               const options = cpArgs ? data.args[2] : data.args[1];
 
-              const cmdCheck = commandCheck(name, command, cpArgs, options, data.hooked);
+              const cmdCheck = commandCheck(
+                name,
+                method,
+                command,
+                cpArgs,
+                options,
+                data.hooked,
+                data.orig
+              );
 
               if (cmdCheck.reported || !options?.shell) return;
 
-              argumentsCheck(name, command, cmdCheck.strInfo, cpArgs, options, data.hooked);
-            }
+              argumentsCheck(
+                name,
+                method,
+                command,
+                cmdCheck.strInfo,
+                cpArgs,
+                options,
+                data.hooked,
+                data.orig
+              );
+            },
           });
         });
 
@@ -189,8 +238,16 @@ module.exports = function (core) {
 
               if (!store || !command || !isString(command)) return;
 
-              commandCheck(name, command, secondArg, thirdArg, data.hooked);
-            }
+              commandCheck(
+                name,
+                method,
+                command,
+                secondArg,
+                thirdArg,
+                data.hooked,
+                data.orig
+              );
+            },
           });
         });
 
@@ -212,8 +269,17 @@ module.exports = function (core) {
 
               const cmdInfo = tracker.getData(command);
 
-              argumentsCheck(name, command, cmdInfo, cpArgs, options, data.hooked);
-            }
+              argumentsCheck(
+                name,
+                method,
+                command,
+                cmdInfo,
+                cpArgs,
+                options,
+                data.hooked,
+                data.orig
+              );
+            },
           });
         });
       });

package/lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -32,7 +32,7 @@ const { createSubsetTags } = require('../../../tag-utils');
 
 const ruleId = 'unvalidated-redirect';
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     depHooks,
     patcher,
@@ -59,7 +59,7 @@ module.exports = function (core) {
     URL_ENCODED,
   ];
 
-  unvalidatedRedirect.install = function () {
+  unvalidatedRedirect.install = function() {
     depHooks.resolve({ name: 'express', file: 'lib/response' }, (Response) => {
       const name = 'Express.Response.location';
       patcher.patch(Response, 'location', {
@@ -92,7 +92,9 @@ module.exports = function (core) {
               }],
               context: `response.location(${inspect(strInfo.value)})`,
               history: [strInfo],
-              name: 'Express.Response.location',
+              name,
+              moduleName: 'express',
+              methodName: 'Response.location',
               object: {
                 tracked: false,
                 value: 'Express.Response',
@@ -105,6 +107,7 @@ module.exports = function (core) {
               source: 'P0',
               stacktraceOpts: {
                 constructorOpt: data.hooked,
+                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -50,7 +50,7 @@ const getURLArgument = (args) => {
   };
 };
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     config,
     depHooks,
@@ -77,9 +77,9 @@ module.exports = function (core) {
     URL_ENCODED,
   ];
 
-  unvalidatedRedirect.install = function () {
+  unvalidatedRedirect.install = function() {
     const name = 'fastify.Reply.prototype.redirect';
-    depHooks.resolve({ name: 'fastify', file: 'lib/reply' }, (Reply, version) => {
+    depHooks.resolve({ name: 'fastify', file: 'lib/reply' }, (Reply) => {
       patcher.patch(Reply.prototype, 'redirect', {
         name,
         patchType,
@@ -119,7 +119,9 @@ module.exports = function (core) {
               args,
               context: `reply.redirect(${inspect(strInfo.value)})`,
               history: [strInfo],
-              name: 'fastify.reply.redirect',
+              name,
+              moduleName: 'fastify',
+              methodName: 'reply.redirect',
               object: {
                 tracked: false,
                 value: 'fastify.Reply',
@@ -132,6 +134,7 @@ module.exports = function (core) {
               source: `P${valueIndex}`,
               stacktraceOpts: {
                 constructorOpt: data.hooked,
+                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/fs.js

@@ -15,9 +15,22 @@
 
 'use strict';
 const { patchType } = require('../common');
-const { FS_METHODS, Rule, isString, DataflowTag: { URL_ENCODED, LIMITED_CHARS, ALPHANUM_SPACE_HYPHEN, SAFE_PATH, UNTRUSTED } } = require('@contrast/common');
+const {
+  FS_METHODS,
+  Rule,
+  isString,
+  DataflowTag: {
+    URL_ENCODED,
+    LIMITED_CHARS,
+    ALPHANUM_SPACE_HYPHEN,
+    SAFE_PATH,
+    UNTRUSTED,
+  },
+  inspect,
+  join,
+} = require('@contrast/common');
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     depHooks,
     patcher,
@@ -31,7 +44,12 @@ module.exports = function (core) {
     },
   } = core;
 
-  const safeTags = [URL_ENCODED, LIMITED_CHARS, ALPHANUM_SPACE_HYPHEN, SAFE_PATH];
+  const safeTags = [
+    URL_ENCODED,
+    LIMITED_CHARS,
+    ALPHANUM_SPACE_HYPHEN,
+    SAFE_PATH,
+  ];
 
   function getValues(indices, args) {
     return indices.reduce((acc, idx) => {
@@ -41,33 +59,47 @@ module.exports = function (core) {
     }, []);
   }
 
-  const pre = (name, indices) => (data) => {
+  const pre = (name, method, moduleName = 'fs', fullMethodName = '') => (data) => {
+    const { name: methodName, indices } = method;
     const store = sources.getStore()?.assess;
     if (!store) return;
 
     const values = getValues(indices, data.args);
     if (!values.length) return;
 
-    const args = [];
+    const args = values.map((v) => {
+      const strInfo = tracker.getData(v);
+      return {
+        value: strInfo ? strInfo.value : v,
+        isTracked: !!strInfo,
+        strInfo
+      };
+    });
     for (let i = 0; i < values.length; i++) {
-      const strInfo = tracker.getData(values[i]);
-      args.push({ value: strInfo ? strInfo.value : values[i], isTracked: !!strInfo });
+      const { strInfo } = args[i];
       if (!strInfo || !isVulnerable(UNTRUSTED, safeTags, strInfo.tags)) {
         continue;
       }
 
       const event = createSinkEvent({
         name,
+        moduleName,
+        methodName: fullMethodName || methodName,
+        context: `${name}(${join(
+          args.map((a) => inspect(a.value)),
+          ', '
+        )})`,
         history: [strInfo],
         object: {
           value: 'fs',
           isTracked: false,
         },
-        args,
+        args: args.map(({ value, isTracked }) => ({ value, isTracked })),
         tags: strInfo.tags,
         source: `P${i}`,
         stacktraceOpts: {
           contructorOpt: data.hooked,
+          prependFrames: [data.orig],
         },
       });
 
@@ -90,7 +122,7 @@ module.exports = function (core) {
             patcher.patch(fs, method.name, {
               name,
               patchType,
-              pre: pre(name, method.indices)
+              pre: pre(name, method),
             });
           }
 
@@ -101,7 +133,7 @@ module.exports = function (core) {
               patcher.patch(fs, syncName, {
                 name,
                 patchType,
-                pre: pre(name, method.indices)
+                pre: pre(name, method, 'fs', syncName),
               });
             }
           }
@@ -111,7 +143,7 @@ module.exports = function (core) {
             patcher.patch(fs.promises, method.name, {
               name,
               patchType,
-              pre: pre(name, method.indices)
+              pre: pre(name, method, 'fs.promises'),
             });
           }
         }
@@ -124,7 +156,7 @@ module.exports = function (core) {
             patcher.patch(fsPromises, method.name, {
               name,
               patchType,
-              pre: pre(name, method.indices)
+              pre: pre(name, method, 'fsPromises'),
             });
           }
         }

package/lib/dataflow/sinks/install/http.js

@@ -86,9 +86,11 @@ module.exports = function(core) {
           value: strInfo.value,
           tracked: true
         }],
-        context: `res.${method}(${strInfo.value})`,
+        context: `res.${method}('${strInfo.value}')`,
         history: [strInfo],
         name,
+        moduleName: 'http',
+        methodName: `ServerResponse.prototype.${method}`,
         object: {
           tracked: false,
           value: 'http.ServerResponse'
@@ -99,7 +101,8 @@ module.exports = function(core) {
         },
         source: 'P0',
         stacktraceOpts: {
-          constructorOpt: data.hooked
+          constructorOpt: data.hooked,
+          prependFrames: [data.orig]
         },
         tags: strInfo.tags,
       });

package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -32,7 +32,7 @@ const { filterSafeTags, patchType } = require('../../common');
 
 const ruleId = 'unvalidated-redirect';
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     depHooks,
     patcher,
@@ -59,11 +59,11 @@ module.exports = function (core) {
     URL_ENCODED,
   ];
 
-  unvalidatedRedirect.install = function () {
+  unvalidatedRedirect.install = function() {
     depHooks.resolve({ name: 'koa', file: 'lib/response', version: '<2.9.0' }, (Response) => {
       const name = 'Koa.Response.redirect';
       patcher.patch(Response, 'redirect', {
-        name: 'Koa.Response.redirect',
+        name,
         patchType,
         pre(data) {
           const assessStore = sources.getStore()?.assess;
@@ -104,7 +104,9 @@ module.exports = function (core) {
               args,
               context: `response.redirect(${inspect(strInfo.value)})`,
               history: [strInfo],
-              name: 'Koa.Response.redirect',
+              name,
+              moduleName: 'koa',
+              methodName: 'Response.redirect',
               object: {
                 tracked: false,
                 value: 'Koa.Response',
@@ -117,6 +119,7 @@ module.exports = function (core) {
               source: `P${isBackRoute ? 1 : 0}`,
               stacktraceOpts: {
                 constructorOpt: data.hooked,
+                prependFrames: [data.orig]
               },
             });
 

package/lib/dataflow/sinks/install/marsdb.js

@@ -102,6 +102,8 @@ module.exports = function(core) {
         const sinkEvent = createSinkEvent({
           args,
           context: `marsdb.Collection.${method}(${args.map((a) => a.value)})`,
+          moduleName: 'marsdb',
+          methodName: `Collection.prototype.${method}`,
           history: [strInfo],
           object: {
             tracked: false,
@@ -112,6 +114,7 @@ module.exports = function(core) {
           source: `P${argIdx}`,
           stacktraceOpts: {
             constructorOpt: data.hooked,
+            prependFrames: [data.orig]
           },
           tags: strInfo.tags,
         });

package/lib/dataflow/sinks/install/mongodb.js

@@ -286,13 +286,15 @@ module.exports = function(core) {
         const resultVal = args[args.length - 1].value.startsWith('[Function') ? '' : 'Promise';
         const sinkEvent = createSinkEvent({
           args,
-          context: `${objName}.${method}(${args.map((a) => a.value)})`,
+          context: `${objName}.${method}(${args.map((a, idx) => isString(origArgs[idx]) ? `'${a.value}'` : a.value)})`,
           history: [strInfo],
           object: {
             tracked: false,
             value: `mongodb.${entity}`,
           },
           name,
+          moduleName: 'mongodb',
+          methodName: `${entity}.prototype.${method}`,
           result: {
             tracked: false,
             value: resultVal,

package/lib/dataflow/sinks/install/mssql.js

@@ -30,7 +30,7 @@ const safeTags = [
   CUSTOM_ENCODED,
 ];
 
-module.exports = function (core) {
+module.exports = function(core) {
   const {
     depHooks,
     patcher,
@@ -44,7 +44,7 @@ module.exports = function (core) {
     },
   } = core;
 
-  const pre = (name, obj, version) => (data) => {
+  const pre = (name, method, obj, version) => (data) => {
     const store = sources.getStore()?.assess;
     if (
       !store ||
@@ -60,6 +60,9 @@ module.exports = function (core) {
 
     const event = createSinkEvent({
       name,
+      moduleName: 'mssql',
+      methodName: `PreparedStatement.prototype.${method}`,
+      context: `mssql.PreparedStatement.${method}('${strInfo.value}')`,
       history: [strInfo],
       object: {
         value: `[${createModuleLabel('mssql', version)}].${obj}`,
@@ -75,6 +78,7 @@ module.exports = function (core) {
       source: 'P0',
       stacktraceOpts: {
         contructorOpt: data.hooked,
+        prependFrames: [data.orig]
       },
     });
 
@@ -96,6 +100,7 @@ module.exports = function (core) {
             patchType,
             pre: pre(
               'mssql/lib/base/prepared-statement.prototype.prepare',
+              'prepare',
               'PreparedStatement',
               version,
             ),
@@ -111,6 +116,7 @@ module.exports = function (core) {
             patchType,
             pre: pre(
               'mssql/lib/base/request.prototype.batch',
+              'batch',
               'Request',
               version,
             ),
@@ -121,6 +127,7 @@ module.exports = function (core) {
             patchType,
             pre: pre(
               'mssql/lib/base/request.prototype.query',
+              'query',
               'Request',
               version,
             ),