@contrast/assess 1.9.0 → 1.11.0

package/lib/dataflow/propagation/install/path/normalize.js

@@ -0,0 +1,123 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { isString } = require('@contrast/common');
+const { patchType } = require('../../common');
+const {
+  createArgTagsInResult,
+  excludeExtensionDotFromTags,
+} = require('./common');
+
+module.exports = function(core) {
+  const {
+    depHooks,
+    patcher,
+    scopes: { sources, instrumentation },
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+  } = core;
+
+  core.assess.dataflow.propagation.pathInstrumentation.normalize = {
+    install() {
+      depHooks.resolve({ name: 'path' }, (path) => {
+        for (const os of ['posix', 'win32']) {
+          const isWin32 = os === 'win32';
+
+          patcher.patch(path[os], 'normalize', {
+            name: `path.${os}.normalize`,
+            patchType,
+            post(data) {
+              const { args, result, name, hooked, orig } = data;
+              if (
+                !result ||
+                !sources.getStore()?.assess ||
+                instrumentation.isLocked()
+              )
+                return;
+
+              const pathStr = args[0];
+
+              if (!pathStr || !isString(pathStr)) return;
+
+              const strInfo = tracker.getData(pathStr);
+
+              if (!strInfo) return;
+
+              let { newTags } = createArgTagsInResult({
+                argStr: pathStr,
+                argTags: strInfo?.tags || {},
+                result,
+                lastIndex: result.length,
+                isWin32,
+              });
+
+              newTags = excludeExtensionDotFromTags({
+                result,
+                tags: newTags,
+                isWin32,
+              });
+
+              const event = createPropagationEvent({
+                name,
+                moduleName: 'path',
+                methodName: 'normalize',
+                context: `path.normalize('${strInfo.value}')`,
+                history: [strInfo],
+                object: {
+                  value: 'path',
+                  isTracked: false,
+                },
+                args: [
+                  {
+                    value: strInfo.value,
+                    tracked: true,
+                  },
+                ],
+                result: {
+                  value: result,
+                  tracked: true,
+                },
+                tags: newTags,
+                source: 'P',
+                target: 'R',
+                stacktraceOpts: {
+                  constructorOpt: hooked,
+                  prependFrames: [orig],
+                },
+              });
+
+              if (!event) {
+                return;
+              }
+
+              const { extern } = tracker.track(result, event);
+
+              if (extern) {
+                data.result = extern;
+              }
+            },
+          });
+        }
+      });
+    },
+  };
+
+  return core.assess.dataflow.propagation.pathInstrumentation.normalize;
+};

package/lib/dataflow/propagation/install/pug/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/querystring/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/querystring/parse.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -42,7 +42,7 @@ module.exports = function(core) {
     function unescapeWrapper(part) {
       let result = unescape(part);
       const start = input.indexOf(part, data.idx);
-      const tagRanges = createSubsetTags(trackingData.tags, start, result.length - 1);
+      const tagRanges = createSubsetTags(trackingData.tags, start, result.length);
 
       if (!tagRanges) return result;
 

package/lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -0,0 +1,182 @@
+/*
+ * Copyright: 2023 Contrast Security, Inc
+ * Contact: support@contrastsecurity.com
+ * License: Commercial
+
+ * NOTICE: This Software and the patented inventions embodied within may only be
+ * used as part of Contrast Security’s commercial offerings. Even though it is
+ * made available through public repositories, use of this Software is subject to
+ * the applicable End User Licensing Agreement found at
+ * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
+ * between Contrast Security and the End User. The Software may not be reverse
+ * engineered, modified, repackaged, sold, redistributed or otherwise used in a
+ * way not consistent with the End User License Agreement.
+ */
+
+'use strict';
+const { inspect } = require('@contrast/common');
+const { createSubsetTags } = require('../../tag-utils');
+const { patchType } = require('../common');
+
+module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: {
+        tracker,
+        eventFactory: { createPropagationEvent },
+      },
+    },
+  } = core;
+
+  function createPropagationEventForMatch({
+    strInfo,
+    startIdx,
+    match,
+    untrackedResult,
+    metadata,
+  }) {
+    const tags = createSubsetTags(strInfo.tags, startIdx, match.length);
+    const { name, obj, hooked, orig } = metadata;
+
+    return createPropagationEvent({
+      name,
+      moduleName: 'RegExp',
+      methodName: 'prototype.exec',
+      context: `'${obj}'.exec('${strInfo.value}')`,
+      history: [strInfo],
+      object: {
+        value: obj,
+        tracked: false,
+      },
+      args: [
+        {
+          value: strInfo.value,
+          tracked: true,
+        },
+      ],
+      tags,
+      result: {
+        value: inspect(untrackedResult),
+        tracked: false,
+      },
+      stacktraceOpts: {
+        constructorOpt: hooked,
+        prependFrames: [orig],
+      },
+      source: 'P',
+      target: 'R',
+    });
+  }
+
+  return (core.assess.dataflow.propagation.regExpExec = {
+    install() {
+      const name = 'RegExp.prototype.exec';
+
+      patcher.patch(RegExp.prototype, 'exec', {
+        name,
+        patchType,
+        post(data) {
+          const { args, obj, result, hooked, orig } = data;
+
+          if (
+            !obj ||
+            !args[0] ||
+            !result?.length ||
+            !sources.getStore()?.assess ||
+            instrumentation.isLocked()
+          )
+            return;
+
+          const strInfo = tracker.getData(args[0]);
+
+          if (!strInfo) return;
+
+          const untrackedResult = [...result];
+          untrackedResult.groups = result.groups && { ...result.groups };
+          untrackedResult.input = strInfo.value;
+          untrackedResult.index = result.index;
+          result.indices && (untrackedResult.indices = result.indices);
+
+          let searchIdx = result.index;
+          const metadata = { name, obj, hooked, orig };
+
+          for (let i = 0; i < result.length; i++) {
+            let match = result[i];
+
+            if (!match) continue;
+
+            if (match === args[0]) {
+              // There is a case where the match
+              // is the whole original string in which case the value here is
+              // externalized and we need to make sure to track
+              // the non-exterrnalized one
+              match = strInfo.value;
+            }
+
+            const startIdx = strInfo.value.indexOf(match, searchIdx);
+            const event = createPropagationEventForMatch({
+              strInfo,
+              startIdx,
+              match,
+              untrackedResult,
+              metadata
+            });
+
+            if (i > 0) {
+              // The first match is the full match of the regex so we cannot
+              // increment the search index.
+              // Every match after the first will occur in order of appearance
+              // in the original string so we should increment the search index
+              searchIdx = startIdx + match.length;
+            }
+
+            if (!event) continue;
+
+            const { extern } = tracker.track(match, event);
+
+            if (extern) {
+              result[i] = extern;
+            }
+          }
+
+          if (result.groups) {
+            Object.keys(result.groups).forEach((key) => {
+              let res = result.groups[key];
+
+              if (!res) return;
+
+              if (res === args[0]) {
+                // There is a case where the match
+                // is the whole original string in which case the value here is
+                // externalized and we need to make sure to track
+                // the non-exterrnalized one
+                res = strInfo.value;
+              }
+
+              const startIdx = strInfo.value.indexOf(res, result.index);
+              const event = createPropagationEventForMatch({
+                strInfo,
+                startIdx,
+                match: res,
+                untrackedResult,
+                metadata
+              });
+
+              if (event) {
+                const { extern } = tracker.track(res, event);
+                if (extern) {
+                  result.groups[key] = extern;
+                }
+              }
+            });
+          }
+        },
+      });
+    },
+    uninstall() {
+      RegExp.prototype.exec = patcher.unwrap(RegExp.prototype.exec);
+    },
+  });
+};

package/lib/dataflow/propagation/install/sequelize.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/sql-template-strings.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/concat.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/format-methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/html-methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/dataflow/propagation/install/string/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -16,21 +16,85 @@
 'use strict';
 
 const { callChildComponentMethodsSync } = require('@contrast/common');
+const { inspect, split } = require('@contrast/common');
 
 module.exports = function(core) {
+  const {
+    scopes: { sources, instrumentation },
+    patcher,
+    assess: {
+      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+    }
+  } = core;
   const stringInstrumentation = core.assess.dataflow.propagation.stringInstrumentation = {
     install() {
       callChildComponentMethodsSync(stringInstrumentation, 'install');
     },
     uninstall() {
       callChildComponentMethodsSync(stringInstrumentation, 'uninstall');
+    },
+    utils: {
+      patchCustomMatcher
     }
   };
 
+  function patchCustomMatcher(matcherFn, objInfo, methodArg, name, patchType) {
+    const [, , methodName] = split(name, '.');
+
+    return patcher.patch(matcherFn, {
+      name,
+      patchType,
+      pre(data) {
+        const { args: origArgs, hooked, orig } = data;
+        if (
+          !origArgs.length ||
+          typeof origArgs[0] !== 'string' ||
+          !sources.getStore()?.assess ||
+          instrumentation.isLocked()
+        ) return;
+
+        const args = [{
+          value: inspect(methodArg),
+          tracked: false
+        }];
+
+        const event = createPropagationEvent({
+          name,
+          moduleName: 'String',
+          methodName: `prototype.${methodName}`,
+          context: `'${objInfo.value}'.${methodName}(${args[0].value})`,
+          history: [objInfo],
+          object: {
+            value: objInfo.value,
+            tracked: true,
+          },
+          args,
+          tags: objInfo.tags,
+          result: undefined,
+          stacktraceOpts: {
+            constructorOpt: hooked,
+            prependFrames: [orig]
+          },
+          source: 'P',
+          target: 'P'
+        });
+
+        if (!event) return;
+
+        const { extern } = tracker.track(objInfo.value, event);
+
+        if (extern) {
+          origArgs[0] = extern;
+        }
+      }
+    });
+  }
+
   require('./concat')(core);
   require('./format-methods')(core);
   require('./html-methods')(core);
   require('./match')(core);
+  require('./match-all')(core);
   require('./replace')(core);
   require('./split')(core);
   require('./slice')(core);