@contrast/assess 1.9.0 → 1.11.0

package/lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -17,32 +17,23 @@
 
 const { DataflowTag, substring } = require('@contrast/common');
 const { patchType } = require('../../common');
+const { userDefinedType } = require('./common');
 
-module.exports = function(core) {
+module.exports = function (core) {
   const {
+    config: {
+      assess: { trust_custom_validators },
+    },
     scopes: { sources },
     patcher,
     depHooks,
     assess: {
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent }
-      }
-    }
-  } = core;
-
-  return core.assess.dataflow.propagation.mongooseInstrumentation.schemaString = {
-    install() {
-      depHooks.resolve(
-        { name: 'mongoose', file: 'lib/schema/string.js', version: '>=6.0.0' },
-        (SchemaString) => {
-          patchEnum(SchemaString);
-          patchDoValidate(SchemaString);
-          patchDoValidateSync(SchemaString);
-        }
-      );
+        eventFactory: { createPropagationEvent },
+      },
     },
-  };
+  } = core;
 
   function patchEnum(SchemaString) {
     patcher.patch(SchemaString.prototype, 'enum', {
@@ -67,9 +58,9 @@ module.exports = function(core) {
             if (data.result) {
               tracker.untrack(data.args[0]);
             }
-          }
+          },
         });
-      }
+      },
     });
   }
 
@@ -81,16 +72,38 @@ module.exports = function(core) {
       patchType,
       pre(data) {
         const [value, cb] = data.args;
-        if (value && typeof cb === 'function' && sources.getStore()?.assess) {
-          data.args[1] = patcher.patch(cb, {
-            name,
-            patchType,
-            pre({ args: [err] }) {
-              if (!err) propagate(name, data.orig, value);
-            }
-          });
+        if (!value || typeof cb !== 'function' || !sources.getStore()?.assess) {
+          return;
         }
-      }
+
+        const hasCustomValidator = data.obj.validators.some(
+          (validator) => validator.type === userDefinedType
+        );
+
+        data.args[1] = patcher.patch(cb, {
+          name,
+          patchType,
+          pre(data) {
+            const {
+              args: [err],
+            } = data;
+
+            if (!err) {
+              propagate(
+                name,
+                data.orig,
+                value,
+                trust_custom_validators
+                  ? hasCustomValidator
+                  : false
+              );
+            }
+
+            if (err && err.kind === userDefinedType)
+              propagate(name, data.orig, value, false);
+          },
+        });
+      },
     });
   }
 
@@ -99,16 +112,34 @@ module.exports = function(core) {
     patcher.patch(SchemaString.prototype, 'doValidateSync', {
       name,
       patchType,
-      post({ orig, args: [value] }) {
-        if (value?.length) {
-          propagate(name, orig, value);
+      post(data) {
+        const {
+          args: [value],
+          result
+        } = data;
+
+        const hasCustomValidator = data.obj.validators.some(
+          (validator) => validator.type === userDefinedType
+        );
+
+        if (!result) {
+          propagate(
+            name,
+            data.orig,
+            value,
+            trust_custom_validators
+              ? hasCustomValidator
+              : false
+          );
         }
-      }
-    });
 
+        if (result && result.kind === userDefinedType)
+          propagate(name, data.orig, value, false);
+      },
+    });
   }
 
-  function propagate(name, orig, value) {
+  function propagate(name, orig, value, customValidated = false) {
     const strInfo = tracker.getData(value);
     if (!strInfo) return;
 
@@ -116,7 +147,10 @@ module.exports = function(core) {
     // copy because we mutate the metadata value inline
     const history = [{ ...strInfo }];
     const event = createPropagationEvent({
-      addedTags: [DataflowTag.STRING_TYPE_CHECKED],
+      addedTags: [
+        DataflowTag.STRING_TYPE_CHECKED,
+        customValidated ? DataflowTag.CUSTOM_VALIDATED : null,
+      ].filter(Boolean),
       name,
       moduleName: 'mongoose',
       methodName,
@@ -134,11 +168,14 @@ module.exports = function(core) {
       tags: {
         ...strInfo.tags,
         [DataflowTag.STRING_TYPE_CHECKED]: [0, value.length - 1],
+        ...(customValidated
+          ? { [DataflowTag.CUSTOM_VALIDATED]: [0, value.length - 1] }
+          : {}),
       },
       target: 'P0',
       stacktraceOpts: {
         prependFrames: [orig],
-      }
+      },
     });
 
     if (!event) {
@@ -153,4 +190,21 @@ module.exports = function(core) {
 
     Object.assign(strInfo, event);
   }
+
+  return core.assess.dataflow.propagation.mongooseInstrumentation.schemaString = {
+    install() {
+      depHooks.resolve(
+        {
+          name: 'mongoose',
+          file: 'lib/schema/string.js',
+          version: '>=6.0.0',
+        },
+        (SchemaString) => {
+          patchEnum(SchemaString);
+          patchDoValidate(SchemaString);
+          patchDoValidateSync(SchemaString);
+        }
+      );
+    },
+  };
 };

package/lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/parse-int.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/path/basename.js

@@ -0,0 +1,124 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { isString, join } = require('@contrast/common');
+const { patchType } = require('../../common');
+const {
+  excludeExtensionDotFromTags,
+  createBasenameTagsInResult,
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.basename = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'basename', {
+            name: `path.${os}.basename`,
+            patchType,
+            post(data) {
+              const { args: origArgs, result, name, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const [pathStr, suffixStr] = origArgs;
+
+              if (!pathStr || !isString(pathStr)) return;
+
+              const strInfo = tracker.getData(pathStr);
+
+              if (!strInfo) return;
+
+              const suffixInfo = tracker.getData(suffixStr);
+              const args = [
+                { value: strInfo.value, tracked: true },
+                suffixStr && { value: suffixInfo ? suffixInfo.value : suffixStr, tracked: !!suffixInfo }
+              ].filter(Boolean);
+
+              let tags = createBasenameTagsInResult({
+                argStr: strInfo.value,
+                argTags: strInfo.tags,
+                suffixStr,
+                result,
+                isWin32
+              });
+
+              tags = excludeExtensionDotFromTags({
+                result,
+                tags,
+                isWin32,
+              });
+
+              const event = tags && createPropagationEvent({
+                name,
+                moduleName: 'path',
+                methodName: 'basename',
+                context: `path.basename(${join(args.map(a => `'${a.value}'`))})`,
+                history: [strInfo],
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args,
+                result: {
+                  value: result,
+                  tracked: true,
+                },
+                tags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) {
+                return;
+              }
+
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.basename;
+};

package/lib/dataflow/propagation/install/path/common.js

@@ -0,0 +1,176 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { matchAll, substring, replace } = require('@contrast/common');
+const {
+  createSubsetTags,
+  createAppendTags,
+  createMergedTags,
+  createTagsWithExclusion,
+} = require('../../../tag-utils');
+
+const posixRegExp = /(?:^|\/)([^/]+?)(?=(?:\/|$))/g;
+// Windows accepts both '/' and '\' as path separators
+const win32RegExp = /(?:^|\/|\\)([^/\\]+?)(?=(?:\/|\\|$))/g;
+
+function createBasenameTagsInResult({
+  argStr,
+  argTags,
+  suffixStr,
+  result,
+  isWin32,
+}) {
+  const segments = Array.from(
+    matchAll(argStr, isWin32 ? win32RegExp : posixRegExp)
+  );
+  const basename = segments[segments.length - 1][1];
+  const isExtensionRemoved = suffixStr && basename.includes(suffixStr);
+
+  const startIdx = isExtensionRemoved
+    ? argStr.lastIndexOf(`${result}${suffixStr}`)
+    : argStr.lastIndexOf(result);
+
+  return createSubsetTags(argTags, startIdx, result.length);
+}
+
+/**
+ * createArgTagsInResult()
+ *
+ * "Transfers" the tags from a path method argument to the result.
+ * This method needs to be called on all arguments in reverse order
+ *
+ * @param {Object} input
+ * @param {String} input.argStr the argument string value
+ * @param {Object} input.argTags the tags object of the argument
+ * @param {Object} input.argTags the tags object of the argument
+ * @param {String} input.result the result string value
+ * @param {Number} input.lastIndex the index from wich we should look
+ *                 for (backwards) for a segment match usually
+ *                 starting with the argument length
+ * @param {Boolean} input.isWin32 a boolean for the platform
+ */
+function createArgTagsInResult({
+  argStr,
+  argTags,
+  result,
+  lastIndex,
+  isWin32,
+}) {
+  let newTags = {};
+  let tempTags = Object.assign({}, argTags);
+
+  // The matched segments are going to be the segments between
+  // the separators eventually including
+  // only 1 path separator at the start
+  const matchedSegments = Array.from(
+    matchAll(argStr, isWin32 ? win32RegExp : posixRegExp)
+  ).reverse();
+
+  for (let i = 0; i < matchedSegments.length; i++) {
+    if (lastIndex < 0) break;
+    const [match, segment] = matchedSegments[i];
+    let { index: startIdx } = matchedSegments[i];
+    if (
+      ['.', '..'].includes(segment) &&
+      result.substring(lastIndex - segment.length, lastIndex + 1) !== segment
+    )
+      continue;
+    let idxInResult = result.lastIndexOf(segment, lastIndex);
+
+    if (idxInResult === -1) continue;
+
+    /*
+     * Up to the call to `createSubsetTags` the logic is
+     * mainly accounting for two things:
+     * - eventual separators that are transfered to the result
+     * - Windows replacing '/' with '\' thus making it non-user supplied
+     *   and required to be excluded from the tags
+     */
+    const replacedSeparatorsIdxs = [];
+    const previousSegmentIdx =
+      i === matchedSegments.length - 1 ? 0 : matchedSegments[i + 1].index;
+    const previousSegmentLength =
+      i === matchedSegments.length - 1 ? 0 : matchedSegments[i + 1][0].length;
+    const segmentStartIdx = startIdx + match.length - segment.length;
+    const separators =
+      substring(
+        argStr,
+        previousSegmentIdx + previousSegmentLength,
+        segmentStartIdx
+      ) || '';
+    const separatorsInResult = isWin32
+      ? replace(separators, /\//g, (_match, idx) => {
+        replacedSeparatorsIdxs.push(startIdx - idx);
+
+        return '\\';
+      })
+      : separators;
+    let foundInResultLength = segment.length;
+
+    let sepIdxInResult;
+    const separatorsLastIdx = separators.length - 1;
+    for (let j = separatorsLastIdx; j >= 0; j--) {
+      if (j === separators.length - 1) {
+        sepIdxInResult = idxInResult + j - separators.length;
+      } else {
+        --sepIdxInResult;
+      }
+      if (result[sepIdxInResult] === separatorsInResult[j]) {
+        idxInResult--;
+        foundInResultLength++;
+      } else if (j === separatorsLastIdx) {
+        startIdx++;
+      }
+    }
+
+    lastIndex = idxInResult - 1;
+    if (replacedSeparatorsIdxs.length) {
+      replacedSeparatorsIdxs.forEach((idx) => {
+        tempTags = createTagsWithExclusion(tempTags, [idx, idx]);
+      });
+    }
+
+    const segmentTags = createSubsetTags(
+      tempTags,
+      startIdx,
+      foundInResultLength
+    );
+
+    const tagsInResult = createAppendTags({}, segmentTags, idxInResult);
+    newTags = createMergedTags(newTags, tagsInResult);
+  }
+
+  return {
+    newTags,
+    lastIndex,
+  };
+}
+
+function excludeExtensionDotFromTags({ result, tags, isWin32 }) {
+  const extensionDotIdx = result.lastIndexOf('.');
+  const separatorLastIdx = result.lastIndexOf(isWin32 ? '\\' : '/');
+
+  return extensionDotIdx > separatorLastIdx
+    ? createTagsWithExclusion(tags, [extensionDotIdx, extensionDotIdx])
+    : tags;
+}
+
+module.exports = {
+  createBasenameTagsInResult,
+  createArgTagsInResult,
+  excludeExtensionDotFromTags,
+};

package/lib/dataflow/propagation/install/path/index.js

@@ -0,0 +1,32 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+
+const { callChildComponentMethodsSync } = require('@contrast/common');
+
+module.exports = function(core) {
+  const pathInstrumentation = core.assess.dataflow.propagation.pathInstrumentation = {
+    install() {
+      callChildComponentMethodsSync(pathInstrumentation, 'install');
+    },
+  };
+
+  require('./basename')(core);
+  require('./normalize')(core);
+  require('./join-and-resolve')(core);
+
+  return pathInstrumentation;
+};

package/lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -0,0 +1,141 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { isString, join } = require('@contrast/common');
+const { createMergedTags } = require('../../../tag-utils');
+const { patchType } = require('../../common');
+const {
+  createArgTagsInResult,
+  excludeExtensionDotFromTags,
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.joinAndResolve = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const method of ['join', 'resolve']) {
+          for (const os of ['posix', 'win32']) {
+            const name = `path.${os}.${method}`;
+            const isWin32 = os === 'win32';
+
+            patcher.patch(path[os], method, {
+              name,
+              patchType,
+              post(data) {
+                const { args: origArgs, result, hooked, orig } = data;
+                if (
+                  !result ||
+                  !sources.getStore()?.assess ||
+                  instrumentation.isLocked()
+                )
+                  return;
+
+                const pathSegments = [...origArgs].reverse();
+                const args = [];
+                const history = [];
+
+                if (!pathSegments.length) return;
+
+                let fullTags = {};
+                let lastIndex = result.length;
+
+                for (const segment of pathSegments) {
+                  let newTags = {};
+                  const argInfo = isString(segment) && tracker.getData(segment);
+
+                  if (!argInfo) {
+                    args.unshift({ value: segment, tracked: false });
+                    continue;
+                  }
+
+                  args.unshift({ value: argInfo.value, tracked: true });
+                  history.unshift(argInfo);
+
+                  ({ newTags, lastIndex } = createArgTagsInResult({
+                    argStr: segment,
+                    argTags: argInfo.tags,
+                    result,
+                    lastIndex,
+                    isWin32,
+                  }));
+
+                  fullTags = createMergedTags(fullTags, newTags);
+                }
+
+                fullTags = excludeExtensionDotFromTags({
+                  result,
+                  tags: fullTags,
+                  isWin32,
+                });
+
+                if (!fullTags || !Object.keys(fullTags).length) return;
+
+                const event = createPropagationEvent({
+                  name,
+                  moduleName: 'path',
+                  methodName: method,
+                  context: `path.${method}(${join(args
+                    .map((a) => `'${a.value}'`), ',')})`,
+                  history,
+                  object: {
+                    value: 'path',
+                    isTracked: false,
+                  },
+                  args,
+                  result: {
+                    value: result,
+                    tracked: true,
+                  },
+                  tags: fullTags,
+                  source: 'P',
+                  target: 'R',
+                  stacktraceOpts: {
+                    constructorOpt: hooked,
+                    prependFrames: [orig],
+                  },
+                });
+
+                if (!event) {
+                  return;
+                }
+
+                const { extern } = tracker.track(result, event);
+
+                if (extern) {
+                  data.result = extern;
+                }
+              },
+            });
+          }
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.joinAndResolve;
+};