@contrast/protect 1.39.0 → 1.40.0

package/lib/input-tracing/handlers/index.test.js

@@ -0,0 +1,1236 @@
+'use strict';
+
+const { expect } = require('chai');
+const agentLib = require('@contrast/agent-lib');
+const mocks = require('@contrast/test/mocks');
+const { agentLibIDListTypes } = require('@contrast/common');
+
+describe('protect input-tracing handlers', function () {
+  let handlers;
+
+  // each test should be asserting this at least
+  const TEST_DESCRIPTION = 'captures findings and sinkContext in result.exploitMetadata array';
+
+  // for additional assertions that might happen in tests, add to description
+  function makeTestDescription(blocks) {
+    const addl = blocks ? ' and blocks when in BLOCK mode' : '';
+    return `${TEST_DESCRIPTION}${addl}`;
+  }
+
+  function makeSourceContext(resultsList, ruleModes) {
+    const resultsMap = Object.create(null);
+
+    if (resultsList) {
+      for (const result of resultsList) {
+        if (!resultsMap[result.ruleId]) {
+          resultsMap[result.ruleId] = [];
+        }
+        resultsMap[result.ruleId].push(result);
+      }
+    }
+
+    const testRuleIds = [
+      'cmd-injection',
+      'path-traversal',
+      'sql-injection',
+      'ssjs-injection',
+      'nosql-injection',
+      'nosql-injection-mongo',
+      'reflected-xss',
+    ];
+
+    return {
+      policy: {
+        rulesMask: testRuleIds.reduce((acc, ruleId) => acc | agentLib.constants.RuleType[ruleId]),
+        ...testRuleIds.reduce((acc, ruleId) => ({ ...acc, [ruleId]: 'monitor' }), {}),
+        ...ruleModes,
+      },
+      trackRequest: true,
+      resultsMap,
+    };
+  }
+
+  beforeEach(function () {
+    const core = mocks.core();
+    core.logger = mocks.logger();
+    core.protect = mocks.protect();
+    core.protect.throwSecurityException = require('../../throw-security-exception');
+
+    handlers = require('.')(core);
+  });
+
+  describe('handlePathTraversal()', function () {
+    const sinkContextPositive = {
+      name: 'fs.readFileSync',
+      value: './../../../etc/passwd',
+      stack: []
+    };
+    const sinkContextNegative = {
+      name: 'fs.readFileSync',
+      value: 'index.js',
+      stack: []
+    };
+    const findings = {
+      path: './../../../etc/passwd',
+    };
+
+    [
+      {
+        blocks: false,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId: 'path-traversal',
+            value: '../../../etc/passwd',
+            exploitMetadata: [],
+          }]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          },
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          }
+        ]
+      },
+      {
+        blocks: true,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId: 'path-traversal',
+            value: '../../../etc/passwd',
+            exploitMetadata: [],
+          }],
+          {
+            'path-traversal': 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          },
+        ]
+      },
+      {
+        blocks: false,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId: 'path-traversal',
+            value: '../../../etc/passwd',
+            exploitMetadata: [],
+          }],
+          {
+            ['path-traversal']: 'off'
+          }
+        ),
+        expectedDetails: []
+      }
+    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
+      it(makeTestDescription(blocks), function () {
+        const testFn = () => {
+          handlers.handlePathTraversal(sourceContext, sinkContextPositive);
+          handlers.handlePathTraversal(sourceContext, sinkContextPositive);
+          handlers.handlePathTraversal(sourceContext, sinkContextNegative);
+        };
+
+        const test = expect(testFn);
+        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
+
+        expect(sourceContext.resultsMap['path-traversal'][0].exploitMetadata).to.deep.equal(expectedDetails);
+      });
+    });
+  });
+
+  describe('handleCmdInjection()', function () {
+    const sinkContextPositive = {
+      name: 'child_process.execSync',
+      value: 'ls; cat /etc/passwd',
+      stack: [],
+    };
+    const sinkContextNegative = {
+      name: 'child_process.execSync',
+      value: 'foo',
+      stack: []
+    };
+    const findings = {
+      boundaryIndex: 2,
+      endIndex: 19,
+      overrunIndex: 4,
+      startIndex: 2,
+    };
+
+    [
+      {
+        blocks: false,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId: 'cmd-injection',
+            value: '; cat /etc/passwd',
+            exploitMetadata: [],
+          }]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          },
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          }
+        ]
+      },
+      {
+        blocks: true,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId: 'cmd-injection',
+            value: '; cat /etc/passwd',
+            exploitMetadata: [],
+          }], {
+            ['cmd-injection']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          },
+        ]
+      },
+      {
+        blocks: false,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId: 'cmd-injection',
+            value: '; cat /etc/passwd',
+            exploitMetadata: [],
+          }], {
+            ['cmd-injection']: 'off'
+          }
+        ),
+        expectedDetails: []
+      }
+    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
+      it(makeTestDescription(blocks), function () {
+        const testFn = () => {
+          handlers.handleCommandInjection(sourceContext, sinkContextPositive);
+          handlers.handleCommandInjection(sourceContext, sinkContextPositive);
+          handlers.handleCommandInjection(sourceContext, sinkContextNegative);
+        };
+
+        const test = expect(testFn);
+        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
+
+        const cmdiResults = sourceContext.resultsMap['cmd-injection'];
+
+        expect(cmdiResults[0].exploitMetadata).to.deep.equal(expectedDetails);
+      });
+    });
+  });
+
+  describe('handleSqlInjection()', function () {
+    const sinkContextPositive = {
+      name: 'mysql.query',
+      value: 'select * from foo where col = """ and 1 = 1; --" or col = "" and 1 = 1; --',
+      stack: [],
+    };
+    const sinkContextNegative = {
+      name: 'mysql.query',
+      value: 'select * from foo where col = """ and 1 = 1; --"',
+      stack: [],
+    };
+    const findings = {
+      boundaryIndex: 59,
+      endIndex: 74,
+      overrunIndex: 61,
+      startIndex: 59,
+    };
+
+    [
+      {
+        blocks: false,
+        findings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'sql-injection',
+              value: '" and 1 = 1; --',
+              exploitMetadata: [],
+            }
+          ]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          },
+          {
+            sinkContext: sinkContextPositive,
+            findings,
+          }
+        ]
+      },
+      {
+        blocks: true,
+        findings: {
+          startIndex: 0,
+          endIndex: 30,
+          overrunIndex: 0,
+          boundaryIndex: 0,
+        },
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'sql-injection',
+              // this is the exact value of the query - this is to get coverage
+              value: 'select * from foo where col = """ and 1 = 1; --" or col = "" and 1 = 1; --',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['sql-injection']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings: {
+              startIndex: 0,
+              endIndex: 73,
+              overrunIndex: 0,
+              boundaryIndex: 0,
+            },
+          },
+        ]
+      },
+      {
+        blocks: false,
+        findings: {
+          startIndex: 0,
+          endIndex: 30,
+          overrunIndex: 0,
+          boundaryIndex: 0,
+        },
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'sql-injection',
+              value: '" and 1 = 1; --',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['sql-injection']: 'off'
+          }
+        ),
+        expectedDetails: []
+      }
+    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
+      it(makeTestDescription(blocks), function () {
+        const testFn = () => {
+          handlers.handleSqlInjection(sourceContext, sinkContextPositive);
+          handlers.handleSqlInjection(sourceContext, sinkContextPositive);
+          handlers.handleSqlInjection(sourceContext, sinkContextNegative);
+        };
+
+        const test = expect(testFn);
+        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
+
+        const sqliResults = sourceContext.resultsMap['sql-injection'];
+        expect(sqliResults[0].exploitMetadata).to.deep.equal(expectedDetails);
+      });
+    });
+  });
+
+  describe('nosqlInjectionMongo()', function () {
+    const expansionSinkContextPositive = {
+      name: 'mongodb.find',
+      value: { id: { '$ne': 0 }, name: 'testValue' },
+      stack: [],
+    };
+    const expansionSinkContextNegative = {
+      name: 'mongodb.find',
+      value: { id: 1 },
+      stack: [],
+    };
+    const expansionSinkContextWrong = {
+      name: 'mongodb.find',
+      value: '{ id: { "$ne": 0 }, name: "testValue" }',
+      stack: [],
+    };
+    const expansionFindings = {
+      start: 8,
+      end: 11,
+      inputBoundaryIndex: 0,
+      boundaryOverrunIndex: 8
+    };
+    const stringSinkContextPositive = {
+      name: 'mongodb.Db.eval',
+      value: 'function() { console.log(`function() { return "hi"; }`)  (function() { return "hi"; })() }',
+      stack: [],
+    };
+    const stringSinkContextNegative = {
+      name: 'mongodb.Db.eval',
+      value: 'function() { console.log(`function() { return "hi"; }`) }',
+      stack: [],
+    };
+    const stringSinkContextWrong = {
+      name: 'mongodb.Db.eval',
+      value: { id: { '$ne': 0 }, name: 'testValue' },
+      stack: [],
+    };
+    const stringFindings = {
+      start: 58,
+      end: 84,
+      boundaryOverrunIndex: 0,
+      inputBoundaryIndex: 0,
+    };
+
+    [
+      {
+        blocks: false,
+        type: 'expansionInjection',
+        findings: expansionFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'nosql-injection-mongo',
+              value: { '$ne': 0 },
+              key: '$ne',
+              exploitMetadata: [],
+              mongoContext: { inputToCheck: 0 },
+            }
+          ]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: expansionSinkContextPositive,
+            findings: expansionFindings,
+          },
+          {
+            sinkContext: expansionSinkContextPositive,
+            findings: expansionFindings,
+          }
+        ]
+      },
+      {
+        blocks: true,
+        type: 'expansionInjection',
+        findings: expansionFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'nosql-injection-mongo',
+              // this is the exact value of the query - this is to get coverage
+              value: { '$ne': 0 },
+              key: '$ne',
+              exploitMetadata: [],
+              mongoContext: { inputToCheck: 0 },
+            }
+          ],
+          {
+            ['nosql-injection-mongo']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: expansionSinkContextPositive,
+            findings: expansionFindings,
+          },
+        ]
+      },
+      {
+        blocks: false,
+        type: 'expansionInjection',
+        findings: expansionFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'nosql-injection-mongo',
+              value: { '$ne': 0 },
+              key: '$ne',
+              exploitMetadata: [],
+              mongoContext: { inputToCheck: 0 },
+            }
+          ],
+          {
+            ['nosql-injection-mongo']: 'off'
+          }
+        ),
+        expectedDetails: []
+      },
+      {
+        blocks: false,
+        type: 'stringInjection',
+        stringFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { return "hi"; }',
+              exploitMetadata: [],
+            }
+          ]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: stringSinkContextPositive,
+            findings: stringFindings,
+          },
+          {
+            sinkContext: stringSinkContextPositive,
+            findings: stringFindings,
+          }
+        ]
+      },
+      {
+        blocks: true,
+        type: 'stringInjection',
+        findings: stringFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { return "hi"; }',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['nosql-injection-mongo']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: stringSinkContextPositive,
+            findings: stringFindings,
+          },
+        ]
+      },
+      {
+        blocks: false,
+        type: 'stringInjection',
+        findings: stringFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { return "hi"; }',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['ssjs-injection']: 'off'
+          }
+        ),
+        expectedDetails: []
+      },
+    ].forEach(({ blocks, type, sourceContext, expectedDetails }) => {
+      it(makeTestDescription(blocks), function () {
+        const testFn = () => {
+          if (type == 'expansionInjection') {
+            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextPositive);
+            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextPositive);
+            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextNegative);
+            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextWrong);
+          } else {
+            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextPositive);
+            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextPositive);
+            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextNegative);
+            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextWrong);
+          }
+        };
+
+        const test = expect(testFn);
+        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
+
+        const nosqliResults = sourceContext.resultsMap['nosql-injection-mongo'];
+        const ssjsResult = sourceContext.resultsMap['ssjs-injection'];
+        if (type == 'expansionInjection') {
+          expect(nosqliResults[0].exploitMetadata).to.deep.equal(expectedDetails);
+        } else {
+          expect(ssjsResult[0].exploitMetadata).to.deep.equal(expectedDetails);
+        }
+      });
+    });
+
+    [
+      {
+        userInput: 'function() ',
+        cmd: 'function() { return true; }',
+        start: 0,
+        end: 10,
+      },
+      {
+        userInput: '(function() { return true })()',
+        cmd: 'function() { return (function() { return true })(); }',
+        start: 20,
+        end: 49,
+      }
+    ].forEach(({ userInput, cmd, start, end }, index) => {
+      it(`sourceContext-injection as function execution - case ${index + 1}`, function () {
+        const sinkContexts = [
+          {
+            value: { $where: cmd },
+            name: 'mongodb.query'
+          },
+          {
+            value: {
+              $expr: {
+                $function: {
+                  body: cmd,
+                  args: [],
+                  lang: 'js',
+                }
+              }
+            },
+            name: 'mongodb.query'
+          },
+        ];
+
+        sinkContexts.forEach(sc => {
+          const data = {
+            sourceContext: makeSourceContext(
+              [
+                {
+                  ruleId: 'ssjs-injection',
+                  value: userInput,
+                  idsList: [],
+                  exploitMetadata: [],
+                }
+              ]
+            ),
+          };
+
+          handlers.nosqlInjectionMongo(data.sourceContext, sc);
+          expect(data.sourceContext.resultsMap['nosql-injection-mongo']).to.have.lengthOf(1);
+          expect(data.sourceContext.resultsMap['ssjs-injection']).to.have.lengthOf(1);
+          expect(data.sourceContext.resultsMap['nosql-injection-mongo'][0]).to.eql({
+            ruleId: 'nosql-injection-mongo',
+            value: userInput,
+            idsList: [],
+            exploitMetadata: [
+              {
+                sinkContext: sc,
+                findings: {
+                  start,
+                  end,
+                  boundaryOverrunIndex: 0,
+                  inputBoundaryIndex: 0
+                }
+              }
+            ],
+            mappedId: 'nosql-injection-mongo'
+          });
+        });
+      });
+    });
+
+    it('sourceContext-injection as function execution - $accumulator', function () {
+      const sinkContext = {
+        value: {
+          $group: {
+            _id: null,
+            count: {
+              $accumulator: {
+                init: 'function() { return { count: 0 } }',
+                accumulate: 'function(state) { return { count: state.count + 1 } }',
+                merge: 'function(state1, state2) { return { count: state1.count + state2.count } }',
+                finalize: 'function(state) { return state; }',
+                lang: 'js',
+              }
+            }
+          }
+        },
+        name: 'mongodb.query'
+      };
+
+      [
+        {
+          value: 'function() { return { count: 0 } }',
+          findings: {
+            boundaryOverrunIndex: 0,
+            end: 33,
+            inputBoundaryIndex: 0,
+            start: 0,
+          }
+        },
+        {
+          value: 'function(state) { return { count: state.count + 1 } }',
+          findings: {
+            boundaryOverrunIndex: 0,
+            end: 52,
+            inputBoundaryIndex: 0,
+            start: 0,
+          }
+        },
+        {
+          value: 'function(state1, state2) { return { count: state1.count + state2.count } }',
+          findings: {
+            boundaryOverrunIndex: 0,
+            end: 73,
+            inputBoundaryIndex: 0,
+            start: 0,
+          }
+        },
+        {
+          value: 'function(state) { return state; }',
+          findings: {
+            boundaryOverrunIndex: 0,
+            end: 32,
+            inputBoundaryIndex: 0,
+            start: 0,
+          }
+        },
+      ].forEach((obj) => {
+        [sinkContext, Object.assign({}, sinkContext, { value: [sinkContext.value] })]
+          .forEach(sc => {
+            const sourceContext = makeSourceContext(
+              [
+                {
+                  ruleId: 'ssjs-injection',
+                  value: obj.value,
+                  exploitMetadata: [],
+                }
+              ]
+            );
+
+            handlers.nosqlInjectionMongo(sourceContext, sc);
+            expect(sourceContext.resultsMap['nosql-injection-mongo']).to.have.lengthOf(1);
+            expect(sourceContext.resultsMap['ssjs-injection']).to.have.lengthOf(1);
+            expect(sourceContext.resultsMap['nosql-injection-mongo'][0]).to.eql({
+              ruleId: 'nosql-injection-mongo',
+              value: obj.value,
+              exploitMetadata: [
+                {
+                  sinkContext: sc,
+                  findings: obj.findings,
+                }
+              ],
+              mappedId: 'nosql-injection-mongo'
+            });
+          });
+      });
+    });
+
+    it('sourceContext-injection as function execution - not an attack', function () {
+      const data = {
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: ' ',
+              idsList: [],
+              exploitMetadata: [],
+            }
+          ]
+        ),
+      };
+
+      const sinkContext = {
+        value: { $where: 'function() { return true; } ' },
+      };
+
+      handlers.nosqlInjectionMongo(data.sourceContext, sinkContext);
+      expect(data.sourceContext.resultsMap['nosql-injection-mongo']).to.be.undefined;
+      expect(data.sourceContext.resultsMap['ssjs-injection']).to.have.lengthOf(1);
+    });
+
+    it(`nosql-injection-mongo - ${agentLibIDListTypes.TRUE_CLAUSE_1} - object`, function () {
+      const vector = "' || true || '";
+
+      const sinkContext = {
+        name: 'mongodb.FindCursor',
+        value: {
+          $where: `this.orderId === '${vector}'`
+        }
+      };
+
+      const expectedDetails = {
+        start: 18,
+        end: 31,
+        boundaryOverrunIndex: 0,
+        inputBoundaryIndex: 0,
+      };
+
+      const data = {
+        blocks: true,
+        type: 'expansionInjection',
+        findings: expansionFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'nosql-injection-mongo',
+              inputType: 'JsonValue',
+              path: [
+                'input',
+              ],
+              key: 'input',
+              value: '\' || true || \'',
+              score: 10,
+              idsList: [
+                agentLibIDListTypes.TRUE_CLAUSE_1,
+              ],
+              mappedId: 'nosql-injection',
+              blocked: false,
+              exploitMetadata: [
+              ],
+            }
+          ],
+          {
+            ['nosql-injection-mongo']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: {
+              name: 'mongodb.FindCursor',
+              value: {
+                $where: `this.orderId === '${vector}'`,
+              }
+            },
+            findings: expansionFindings,
+          },
+        ]
+      };
+
+      const test = expect(() => handlers.nosqlInjectionMongo(data.sourceContext, sinkContext));
+      test.to.throw('SecurityException');
+
+      const nosqliResults = data.sourceContext.resultsMap['nosql-injection-mongo'];
+      expect(nosqliResults[0].exploitMetadata).to.deep.equal([
+        {
+          sinkContext: {
+            name: 'mongodb.FindCursor',
+            value: {
+              $where: `this.orderId === '${vector}'`,
+            },
+            stack: [],
+          },
+          findings: expectedDetails,
+        },
+      ]);
+    });
+
+    it(`nosql-injection-mongo - ${agentLibIDListTypes.MONGO_SLEEP} - object`, function () {
+      const sinkContext = {
+        name: 'mongodb.FindCursor',
+        value: {
+          $where: 'this.title ==sleep(500)',
+        }
+      };
+
+      const expectedDetails = {
+        start: 13,
+        end: 22,
+        boundaryOverrunIndex: 0,
+        inputBoundaryIndex: 0,
+      };
+
+      const data = {
+        blocks: true,
+        type: 'expansionInjection',
+        findings: expansionFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'nosql-injection-mongo',
+              inputType: 'JsonValue',
+              path: [
+                'input',
+              ],
+              key: 'input',
+              value: 'sleep(500)',
+              score: 10,
+              idsList: [
+                agentLibIDListTypes.MONGO_SLEEP,
+              ],
+              mappedId: 'nosql-injection',
+              blocked: false,
+              exploitMetadata: [
+              ],
+            }
+          ],
+          {
+            ['nosql-injection-mongo']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: {
+              name: 'mongodb.FindCursor',
+              value: {
+                $where: 'this.title ==sleep(500)',
+              }
+            },
+            findings: expansionFindings,
+          },
+        ]
+      };
+
+      const test = expect(() => handlers.nosqlInjectionMongo(data.sourceContext, sinkContext));
+      test.to.throw('SecurityException');
+
+      const nosqliResults = data.sourceContext.resultsMap['nosql-injection-mongo'];
+      expect(nosqliResults[0].exploitMetadata).to.deep.equal([
+        {
+          sinkContext: {
+            name: 'mongodb.FindCursor',
+            value: {
+              $where: 'this.title ==sleep(500)',
+            },
+            stack: [
+            ],
+          },
+          findings: expectedDetails,
+        },
+      ]);
+    });
+
+    it(`nosql-injection-mongo - ${agentLibIDListTypes.MONGO_SLEEP} - string`, function () {
+      const sinkContext = {
+        name: 'mongodb.FindCursor',
+        value: 'sleep(500)'
+      };
+
+      const expectedDetails = {
+        start: 0,
+        end: 9,
+        boundaryOverrunIndex: 0,
+        inputBoundaryIndex: 0,
+      };
+
+      const data = {
+        blocks: true,
+        type: 'expansionInjection',
+        findings: expansionFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'nosql-injection-mongo',
+              inputType: 'JsonValue',
+              path: [
+                'input',
+              ],
+              key: 'input',
+              value: 'sleep(500)',
+              score: 10,
+              idsList: [
+                agentLibIDListTypes.MONGO_SLEEP,
+              ],
+              mappedId: 'nosql-injection',
+              blocked: false,
+              exploitMetadata: [
+              ],
+            }
+          ],
+          {
+            ['nosql-injection-mongo']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: {
+              name: 'mongodb.FindCursor',
+              value: 'sleep(500)'
+            },
+            findings: expansionFindings,
+          },
+        ]
+      };
+
+      const test = expect(() => handlers.nosqlInjectionMongo(data.sourceContext, sinkContext));
+      test.to.throw('SecurityException');
+
+      const nosqliResults = data.sourceContext.resultsMap['nosql-injection-mongo'];
+      expect(nosqliResults[0].exploitMetadata).to.deep.equal([
+        {
+          sinkContext: {
+            name: 'mongodb.FindCursor',
+            value: 'sleep(500)',
+            stack: [],
+          },
+          findings: expectedDetails,
+        },
+      ]);
+    });
+  });
+
+  describe('ssjsInjection()', function () {
+    const stringSinkContextPositive = {
+      name: 'vm.Script',
+      value: 'function() { console.log("function() { process.exit(1); }") (function() { process.exit(1); })() }',
+      stack: [],
+    };
+    const stringSinkContextPositiveV2 = {
+      name: 'vm.Script',
+      value: 'function wrapperFunction() { function() { process.exit(1); } }',
+      stack: [],
+    };
+    const stringSinkContextNegative = {
+      name: 'vm.Script',
+      value: 'function() { console.log("function() { process.exit(1); }") }',
+      stack: [],
+    };
+    const objectSinkContextPositive = {
+      name: 'vm.Script.runInNewContext',
+      value: {
+        numValue: 1,
+        strValue: 'Contrast',
+        vulnerableValue: 'function() { process.exit(1); }',
+        anotherStr: 'Security',
+        booleanValue: true
+      },
+      stack: [],
+    };
+    const objectSinkContextNegative = {
+      name: 'vm.Script.runInNewContext',
+      value: {
+        numValue: 1,
+        strValue: '',
+        booleanValue: true
+      },
+      stack: [],
+    };
+    const findings = {
+      startIndex: 61,
+      endIndex: 92,
+      boundaryIndex: 61,
+      codeString: 'function() { process.exit(1); }'
+    };
+
+    const objectFindings = {
+      startIndex: 0,
+      endIndex: 30,
+      boundaryIndex: 0,
+      codeString: 'function() { process.exit(1); }'
+    };
+
+    [
+      {
+        blocks: false,
+        type: 'codeString',
+        findings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { process.exit(1); }',
+              exploitMetadata: [],
+            }
+          ]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: stringSinkContextPositive,
+            findings,
+          },
+          {
+            sinkContext: stringSinkContextPositiveV2,
+            findings: {
+              startIndex: 29,
+              boundaryIndex: 29,
+              endIndex: 60,
+              codeString: 'function() { process.exit(1); }'
+            },
+          }
+        ]
+      },
+      {
+        blocks: true,
+        type: 'codeString',
+        findings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { process.exit(1); }',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['ssjs-injection']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: stringSinkContextPositive,
+            findings,
+          },
+        ]
+      },
+      {
+        blocks: false,
+        type: 'codeString',
+        findings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { process.exit(1); }',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['ssjs-injection']: 'off'
+          }
+        ),
+        expectedDetails: []
+      },
+      {
+        blocks: false,
+        type: 'contextObject',
+        objectFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { process.exit(1); }',
+              exploitMetadata: [],
+            }
+          ]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: objectSinkContextPositive,
+            findings: objectFindings,
+          },
+          {
+            sinkContext: objectSinkContextPositive,
+            findings: objectFindings,
+          }
+        ]
+      },
+      {
+        blocks: true,
+        type: 'contextObject',
+        objectFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { process.exit(1); }',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['ssjs-injection']: 'block'
+          }
+        ),
+        expectedDetails: [
+          {
+            sinkContext: objectSinkContextPositive,
+            findings: objectFindings,
+          },
+        ]
+      },
+      {
+        blocks: false,
+        type: 'contextObject',
+        objectFindings,
+        sourceContext: makeSourceContext(
+          [
+            {
+              ruleId: 'ssjs-injection',
+              value: 'function() { process.exit(1); }',
+              exploitMetadata: [],
+            }
+          ],
+          {
+            ['ssjs-injection']: 'off'
+          }
+        ),
+        expectedDetails: []
+      }
+    ].forEach(({ blocks, type, sourceContext, expectedDetails }) => {
+      it(makeTestDescription(blocks), function () {
+        const testFn = () => {
+          if (type == 'codeString') {
+            handlers.ssjsInjection(sourceContext, stringSinkContextPositive);
+            handlers.ssjsInjection(sourceContext, stringSinkContextPositiveV2);
+            handlers.ssjsInjection(sourceContext, stringSinkContextNegative);
+          } else {
+            handlers.ssjsInjection(sourceContext, objectSinkContextPositive);
+            handlers.ssjsInjection(sourceContext, objectSinkContextPositive);
+            handlers.ssjsInjection(sourceContext, objectSinkContextNegative);
+          }
+        };
+
+        const test = expect(testFn);
+        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
+
+        const ssjsiResults = sourceContext.resultsMap['ssjs-injection'];
+        expect(ssjsiResults[0].exploitMetadata).to.deep.equal(expectedDetails);
+      });
+    });
+  });
+
+  describe('handleReflectedXss()', function () {
+    const ruleId = 'reflected-xss';
+    const value = '" onmouseover="alert(3)"';
+    const sinkContextPositive = {
+      value,
+      stack: []
+    };
+    const sinkContextNegative = {
+      value: 'foo',
+      stack: []
+    };
+    const findings = {
+      value
+    };
+
+    [
+      {
+        blocks: false,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId,
+            value,
+            exploitMetadata: []
+          }]
+        ),
+        expectedDetails: [
+          {
+            sinkContext: sinkContextPositive,
+            findings
+          },
+          {
+            sinkContext: sinkContextPositive,
+            findings
+          }
+        ]
+      },
+      {
+        blocks: false,
+        sourceContext: makeSourceContext(
+          [{
+            ruleId,
+            value,
+            exploitMetadata: [],
+          }],
+          {
+            [ruleId]: 'off'
+          }
+        ),
+        expectedDetails: []
+      }
+    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
+      it(makeTestDescription(blocks), function () {
+        const testFn = () => {
+          handlers.handleReflectedXss(sourceContext, sinkContextPositive);
+          handlers.handleReflectedXss(sourceContext, sinkContextPositive);
+          handlers.handleReflectedXss(sourceContext, sinkContextNegative);
+        };
+
+        const test = expect(testFn);
+        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
+
+        expect(sourceContext.resultsMap['reflected-xss'][0].exploitMetadata).to.deep.equal(expectedDetails);
+      });
+    });
+  });
+});