@contrast/assess 1.9.0 → 1.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/lib/dataflow/propagation/index.js +1 -0
  2. package/lib/dataflow/propagation/install/path/basename.js +124 -0
  3. package/lib/dataflow/propagation/install/path/common.js +176 -0
  4. package/lib/dataflow/propagation/install/path/index.js +32 -0
  5. package/lib/dataflow/propagation/install/path/join-and-resolve.js +141 -0
  6. package/lib/dataflow/propagation/install/path/normalize.js +123 -0
  7. package/lib/dataflow/propagation/install/querystring/parse.js +1 -1
  8. package/lib/dataflow/propagation/install/string/match.js +2 -2
  9. package/lib/dataflow/propagation/install/string/replace.js +1 -1
  10. package/lib/dataflow/propagation/install/string/slice.js +1 -1
  11. package/lib/dataflow/propagation/install/string/split.js +1 -1
  12. package/lib/dataflow/propagation/install/string/substring.js +2 -2
  13. package/lib/dataflow/propagation/install/string/trim.js +1 -1
  14. package/lib/dataflow/propagation/install/url/index.js +1 -0
  15. package/lib/dataflow/propagation/install/url/url.js +228 -0
  16. package/lib/dataflow/sinks/index.js +8 -4
  17. package/lib/dataflow/sinks/install/eval.js +138 -0
  18. package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +1 -1
  19. package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +2 -1
  20. package/lib/dataflow/sinks/install/fs.js +3 -3
  21. package/lib/dataflow/sinks/install/function.js +160 -0
  22. package/lib/dataflow/sinks/install/http/index.js +31 -0
  23. package/lib/dataflow/sinks/install/http/request.js +152 -0
  24. package/lib/dataflow/sinks/install/{http.js → http/server-response.js} +2 -2
  25. package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +1 -1
  26. package/lib/dataflow/sinks/install/mongodb.js +4 -23
  27. package/lib/dataflow/sinks/install/mssql.js +44 -31
  28. package/lib/dataflow/sinks/install/vm.js +276 -0
  29. package/lib/dataflow/tag-utils.js +70 -1
  30. package/package.json +2 -2
@@ -44,7 +44,7 @@ function atomicAppend(firstTagRanges, secondTagRanges, offset) {
44
44
 
45
45
  function atomicSubset(tags, subsetStart, len) {
46
46
  const ret = [];
47
- const subsetStop = subsetStart + len;
47
+ const subsetStop = subsetStart + len - 1;
48
48
 
49
49
  for (let idx = 0; idx < tags.length - 1; idx += 2) {
50
50
  const tagStart = tags[idx];
@@ -119,6 +119,42 @@ function atomicMerge(firstTagRanges, secondTagRanges) {
119
119
  return finalMergedRanges;
120
120
  }
121
121
 
122
+ function atomicExclude(tags, exclusionRange) {
123
+ const ret = [];
124
+ const [exclusionStart, exclusionStop] = exclusionRange;
125
+
126
+ for (let idx = 0; idx < tags.length - 1; idx += 2) {
127
+ const tagStart = tags[idx];
128
+ const tagStop = tags[idx + 1];
129
+
130
+ if (tagStop < exclusionStart) {
131
+ ret.push(tagStart, tagStop);
132
+ // exlusion is below - continue to check next range
133
+ continue;
134
+ }
135
+
136
+ if (tagStart > exclusionStop) {
137
+ ret.push(...tags.slice(idx));
138
+ // all other ranges are above exclusion so we can stop
139
+ break;
140
+ }
141
+
142
+ if (exclusionStart <= tagStart && exclusionStop < tagStop) {
143
+ ret.push(exclusionStop + 1, tagStop);
144
+ }
145
+
146
+ if (exclusionStart > tagStart) {
147
+ ret.push(tagStart, exclusionStart - 1);
148
+
149
+ if (exclusionStop < tagStop) {
150
+ ret.push(exclusionStop + 1, tagStop);
151
+ }
152
+ }
153
+ }
154
+
155
+ return ret;
156
+ }
157
+
122
158
  function createAppendTags(firstTags, secondTags, offset) {
123
159
  const ret = Object.create(null);
124
160
  const firstTagsObject = ensureObject(firstTags);
@@ -204,10 +240,43 @@ function createMergedTags(firstTags, secondTags) {
204
240
  return Object.keys(ret).length ? ret : null;
205
241
  }
206
242
 
243
+ function createTagsWithExclusion(tags, exclusionRange) {
244
+ if (!exclusionRange.length) return;
245
+
246
+ const ret = Object.create(null);
247
+ const tagsObject = ensureObject(tags);
248
+
249
+ for (const tagName of Object.keys(tagsObject)) {
250
+ const newTagRanges = atomicExclude(ensureTagsImmutable(tagsObject, tagName), exclusionRange);
251
+
252
+ newTagRanges.length && (ret[tagName] = newTagRanges);
253
+ }
254
+
255
+ return Object.keys(ret).length ? ret : null;
256
+ }
257
+
258
+ function createAdjustedQueryTags(path, tags, value, argString) {
259
+ let idx = -1;
260
+ for (const str of [...path, value]) {
261
+ // This is the case where the argument is an array
262
+ if (str === 0) continue;
263
+
264
+ idx = argString.indexOf(str, idx);
265
+ if (idx == -1) {
266
+ idx = -1;
267
+ break;
268
+ }
269
+ }
270
+
271
+ return idx > 0 ? createAppendTags([], tags, idx) : [...tags];
272
+ }
273
+
207
274
  module.exports = {
208
275
  createSubsetTags,
209
276
  createAppendTags,
210
277
  createFullLengthCopyTags,
211
278
  createMergedTags,
279
+ createTagsWithExclusion,
280
+ createAdjustedQueryTags,
212
281
  createOverlappingTags
213
282
  };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@contrast/assess",
3
- "version": "1.9.0",
3
+ "version": "1.10.0",
4
4
  "description": "",
5
5
  "main": "lib/index.js",
6
6
  "scripts": {
@@ -15,7 +15,7 @@
15
15
  "dependencies": {
16
16
  "@contrast/distringuish": "^4.1.0",
17
17
  "@contrast/scopes": "1.4.0",
18
- "@contrast/common": "1.12.0",
18
+ "@contrast/common": "1.13.0",
19
19
  "parseurl": "^1.3.3"
20
20
  }
21
21
  }