@contrast/protect 1.54.0 → 1.54.2

package/lib/input-tracing/handlers/index.test.js

@@ -1,1237 +0,0 @@
-'use strict';
-
-const { expect } = require('chai');
-const agentLib = require('@contrast/agent-lib');
-const mocks = require('@contrast/test/mocks');
-const { agentLibIDListTypes } = require('@contrast/common');
-
-describe('protect input-tracing handlers', function () {
-  let handlers;
-
-  // each test should be asserting this at least
-  const TEST_DESCRIPTION = 'captures findings and sinkContext in result.exploitMetadata array';
-
-  // for additional assertions that might happen in tests, add to description
-  function makeTestDescription(blocks) {
-    const addl = blocks ? ' and blocks when in BLOCK mode' : '';
-    return `${TEST_DESCRIPTION}${addl}`;
-  }
-
-  function makeSourceContext(resultsList, ruleModes) {
-    const resultsMap = Object.create(null);
-
-    if (resultsList) {
-      for (const result of resultsList) {
-        if (!resultsMap[result.ruleId]) {
-          resultsMap[result.ruleId] = [];
-        }
-        resultsMap[result.ruleId].push(result);
-      }
-    }
-
-    const testRuleIds = [
-      'cmd-injection',
-      'path-traversal',
-      'sql-injection',
-      'ssjs-injection',
-      'nosql-injection',
-      'nosql-injection-mongo',
-      'reflected-xss',
-    ];
-
-    return {
-      policy: {
-        rulesMask: testRuleIds.reduce((acc, ruleId) => acc | agentLib.constants.RuleType[ruleId]),
-        ...testRuleIds.reduce((acc, ruleId) => ({ ...acc, [ruleId]: 'monitor' }), {}),
-        ...ruleModes,
-      },
-      trackRequest: true,
-      resultsMap,
-    };
-  }
-
-  beforeEach(function () {
-    const core = mocks.core();
-    core.logger = mocks.logger();
-    core.protect = mocks.protect();
-    core.protect.throwSecurityException = require('../../throw-security-exception');
-
-    handlers = require('.')(core);
-  });
-
-  describe('handlePathTraversal()', function () {
-    const sinkContextPositive = {
-      name: 'fs.readFileSync',
-      value: './../../../etc/passwd',
-      stack: []
-    };
-    const sinkContextNegative = {
-      name: 'fs.readFileSync',
-      value: 'index.js',
-      stack: []
-    };
-    const findings = {
-      path: './../../../etc/passwd',
-    };
-
-    [
-      {
-        blocks: false,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId: 'path-traversal',
-            value: '../../../etc/passwd',
-            exploitMetadata: [],
-          }]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          },
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          }
-        ]
-      },
-      {
-        blocks: true,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId: 'path-traversal',
-            value: '../../../etc/passwd',
-            exploitMetadata: [],
-          }],
-          {
-            'path-traversal': 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          },
-        ]
-      },
-      {
-        blocks: false,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId: 'path-traversal',
-            value: '../../../etc/passwd',
-            exploitMetadata: [],
-          }],
-          {
-            ['path-traversal']: 'off'
-          }
-        ),
-        expectedDetails: []
-      }
-    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
-      it(makeTestDescription(blocks), function () {
-        const testFn = () => {
-          handlers.handlePathTraversal(sourceContext, sinkContextPositive);
-          handlers.handlePathTraversal(sourceContext, sinkContextPositive);
-          handlers.handlePathTraversal(sourceContext, sinkContextNegative);
-        };
-
-        const test = expect(testFn);
-        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
-
-        expect(sourceContext.resultsMap['path-traversal'][0].exploitMetadata).to.deep.equal(expectedDetails);
-      });
-    });
-  });
-
-  describe('handleCmdInjection()', function () {
-    const sinkContextPositive = {
-      name: 'child_process.execSync',
-      value: 'ls; cat /etc/passwd',
-      stack: [],
-    };
-    const sinkContextNegative = {
-      name: 'child_process.execSync',
-      value: 'foo',
-      stack: []
-    };
-    const findings = {
-      boundaryIndex: 2,
-      endIndex: 19,
-      overrunIndex: 4,
-      startIndex: 2,
-    };
-
-    [
-      {
-        blocks: false,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId: 'cmd-injection',
-            value: '; cat /etc/passwd',
-            exploitMetadata: [],
-          }]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          },
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          }
-        ]
-      },
-      {
-        blocks: true,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId: 'cmd-injection',
-            value: '; cat /etc/passwd',
-            exploitMetadata: [],
-          }], {
-            ['cmd-injection']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          },
-        ]
-      },
-      {
-        blocks: false,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId: 'cmd-injection',
-            value: '; cat /etc/passwd',
-            exploitMetadata: [],
-          }], {
-            ['cmd-injection']: 'off'
-          }
-        ),
-        expectedDetails: []
-      }
-    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
-      it(makeTestDescription(blocks), function () {
-        const testFn = () => {
-          handlers.handleCommandInjection(sourceContext, sinkContextPositive);
-          handlers.handleCommandInjection(sourceContext, sinkContextPositive);
-          handlers.handleCommandInjection(sourceContext, sinkContextNegative);
-        };
-
-        const test = expect(testFn);
-        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
-
-        const cmdiResults = sourceContext.resultsMap['cmd-injection'];
-
-        expect(cmdiResults[0].exploitMetadata).to.deep.equal(expectedDetails);
-      });
-    });
-  });
-
-  describe('handleSqlInjection()', function () {
-    const sinkContextPositive = {
-      name: 'mysql.query',
-      //      0123456789*123456789*123456789*123456789*123456789*123456789*1234567890123
-      value: 'select * from foo where col = """ and 1 = 1; --" or col = "" and 1 = 1; --',
-      stack: [],
-    };
-    const sinkContextNegative = {
-      name: 'mysql.query',
-      value: 'select * from foo where col = """ and 1 = 1; --"',
-      stack: [],
-    };
-    const findings = {
-      boundaryIndex: 58,
-      endIndex: 74,
-      overrunIndex: 60,
-      startIndex: 59,
-    };
-
-    [
-      {
-        blocks: false,
-        findings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'sql-injection',
-              value: '" and 1 = 1; --',
-              exploitMetadata: [],
-            }
-          ]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          },
-          {
-            sinkContext: sinkContextPositive,
-            findings,
-          }
-        ]
-      },
-      {
-        blocks: true,
-        findings: {
-          startIndex: 0,
-          endIndex: 30,
-          overrunIndex: 0,
-          boundaryIndex: 0,
-        },
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'sql-injection',
-              // this is the exact value of the query - this is to get coverage
-              value: 'select * from foo where col = """ and 1 = 1; --" or col = "" and 1 = 1; --',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['sql-injection']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings: {
-              startIndex: 0,
-              endIndex: 73,
-              overrunIndex: 0,
-              boundaryIndex: 0,
-            },
-          },
-        ]
-      },
-      {
-        blocks: false,
-        findings: {
-          startIndex: 0,
-          endIndex: 30,
-          overrunIndex: 0,
-          boundaryIndex: 0,
-        },
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'sql-injection',
-              value: '" and 1 = 1; --',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['sql-injection']: 'off'
-          }
-        ),
-        expectedDetails: []
-      }
-    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
-      it(makeTestDescription(blocks), function () {
-        const testFn = () => {
-          handlers.handleSqlInjection(sourceContext, sinkContextPositive);
-          handlers.handleSqlInjection(sourceContext, sinkContextPositive);
-          handlers.handleSqlInjection(sourceContext, sinkContextNegative);
-        };
-
-        const test = expect(testFn);
-        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
-
-        const sqliResults = sourceContext.resultsMap['sql-injection'];
-        expect(sqliResults[0].exploitMetadata).to.deep.equal(expectedDetails);
-      });
-    });
-  });
-
-  describe('nosqlInjectionMongo()', function () {
-    const expansionSinkContextPositive = {
-      name: 'mongodb.find',
-      value: { id: { '$ne': 0 }, name: 'testValue' },
-      stack: [],
-    };
-    const expansionSinkContextNegative = {
-      name: 'mongodb.find',
-      value: { id: 1 },
-      stack: [],
-    };
-    const expansionSinkContextWrong = {
-      name: 'mongodb.find',
-      value: '{ id: { "$ne": 0 }, name: "testValue" }',
-      stack: [],
-    };
-    const expansionFindings = {
-      start: 8,
-      end: 11,
-      inputBoundaryIndex: 0,
-      boundaryOverrunIndex: 8
-    };
-    const stringSinkContextPositive = {
-      name: 'mongodb.Db.eval',
-      value: 'function() { console.log(`function() { return "hi"; }`)  (function() { return "hi"; })() }',
-      stack: [],
-    };
-    const stringSinkContextNegative = {
-      name: 'mongodb.Db.eval',
-      value: 'function() { console.log(`function() { return "hi"; }`) }',
-      stack: [],
-    };
-    const stringSinkContextWrong = {
-      name: 'mongodb.Db.eval',
-      value: { id: { '$ne': 0 }, name: 'testValue' },
-      stack: [],
-    };
-    const stringFindings = {
-      start: 58,
-      end: 84,
-      boundaryOverrunIndex: 0,
-      inputBoundaryIndex: 0,
-    };
-
-    [
-      {
-        blocks: false,
-        type: 'expansionInjection',
-        findings: expansionFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'nosql-injection-mongo',
-              value: { '$ne': 0 },
-              key: '$ne',
-              exploitMetadata: [],
-              mongoContext: { inputToCheck: 0 },
-            }
-          ]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: expansionSinkContextPositive,
-            findings: expansionFindings,
-          },
-          {
-            sinkContext: expansionSinkContextPositive,
-            findings: expansionFindings,
-          }
-        ]
-      },
-      {
-        blocks: true,
-        type: 'expansionInjection',
-        findings: expansionFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'nosql-injection-mongo',
-              // this is the exact value of the query - this is to get coverage
-              value: { '$ne': 0 },
-              key: '$ne',
-              exploitMetadata: [],
-              mongoContext: { inputToCheck: 0 },
-            }
-          ],
-          {
-            ['nosql-injection-mongo']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: expansionSinkContextPositive,
-            findings: expansionFindings,
-          },
-        ]
-      },
-      {
-        blocks: false,
-        type: 'expansionInjection',
-        findings: expansionFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'nosql-injection-mongo',
-              value: { '$ne': 0 },
-              key: '$ne',
-              exploitMetadata: [],
-              mongoContext: { inputToCheck: 0 },
-            }
-          ],
-          {
-            ['nosql-injection-mongo']: 'off'
-          }
-        ),
-        expectedDetails: []
-      },
-      {
-        blocks: false,
-        type: 'stringInjection',
-        stringFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { return "hi"; }',
-              exploitMetadata: [],
-            }
-          ]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: stringSinkContextPositive,
-            findings: stringFindings,
-          },
-          {
-            sinkContext: stringSinkContextPositive,
-            findings: stringFindings,
-          }
-        ]
-      },
-      {
-        blocks: true,
-        type: 'stringInjection',
-        findings: stringFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { return "hi"; }',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['nosql-injection-mongo']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: stringSinkContextPositive,
-            findings: stringFindings,
-          },
-        ]
-      },
-      {
-        blocks: false,
-        type: 'stringInjection',
-        findings: stringFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { return "hi"; }',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['ssjs-injection']: 'off'
-          }
-        ),
-        expectedDetails: []
-      },
-    ].forEach(({ blocks, type, sourceContext, expectedDetails }) => {
-      it(makeTestDescription(blocks), function () {
-        const testFn = () => {
-          if (type == 'expansionInjection') {
-            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextPositive);
-            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextPositive);
-            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextNegative);
-            handlers.nosqlInjectionMongo(sourceContext, expansionSinkContextWrong);
-          } else {
-            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextPositive);
-            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextPositive);
-            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextNegative);
-            handlers.nosqlInjectionMongo(sourceContext, stringSinkContextWrong);
-          }
-        };
-
-        const test = expect(testFn);
-        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
-
-        const nosqliResults = sourceContext.resultsMap['nosql-injection-mongo'];
-        const ssjsResult = sourceContext.resultsMap['ssjs-injection'];
-        if (type == 'expansionInjection') {
-          expect(nosqliResults[0].exploitMetadata).to.deep.equal(expectedDetails);
-        } else {
-          expect(ssjsResult[0].exploitMetadata).to.deep.equal(expectedDetails);
-        }
-      });
-    });
-
-    [
-      {
-        userInput: 'function() ',
-        cmd: 'function() { return true; }',
-        start: 0,
-        end: 10,
-      },
-      {
-        userInput: '(function() { return true })()',
-        cmd: 'function() { return (function() { return true })(); }',
-        start: 20,
-        end: 49,
-      }
-    ].forEach(({ userInput, cmd, start, end }, index) => {
-      it(`sourceContext-injection as function execution - case ${index + 1}`, function () {
-        const sinkContexts = [
-          {
-            value: { $where: cmd },
-            name: 'mongodb.query'
-          },
-          {
-            value: {
-              $expr: {
-                $function: {
-                  body: cmd,
-                  args: [],
-                  lang: 'js',
-                }
-              }
-            },
-            name: 'mongodb.query'
-          },
-        ];
-
-        sinkContexts.forEach(sc => {
-          const data = {
-            sourceContext: makeSourceContext(
-              [
-                {
-                  ruleId: 'ssjs-injection',
-                  value: userInput,
-                  idsList: [],
-                  exploitMetadata: [],
-                }
-              ]
-            ),
-          };
-
-          handlers.nosqlInjectionMongo(data.sourceContext, sc);
-          expect(data.sourceContext.resultsMap['nosql-injection-mongo']).to.have.lengthOf(1);
-          expect(data.sourceContext.resultsMap['ssjs-injection']).to.have.lengthOf(1);
-          expect(data.sourceContext.resultsMap['nosql-injection-mongo'][0]).to.eql({
-            ruleId: 'nosql-injection-mongo',
-            value: userInput,
-            idsList: [],
-            exploitMetadata: [
-              {
-                sinkContext: sc,
-                findings: {
-                  start,
-                  end,
-                  boundaryOverrunIndex: 0,
-                  inputBoundaryIndex: 0
-                }
-              }
-            ],
-            mappedId: 'nosql-injection-mongo'
-          });
-        });
-      });
-    });
-
-    it('sourceContext-injection as function execution - $accumulator', function () {
-      const sinkContext = {
-        value: {
-          $group: {
-            _id: null,
-            count: {
-              $accumulator: {
-                init: 'function() { return { count: 0 } }',
-                accumulate: 'function(state) { return { count: state.count + 1 } }',
-                merge: 'function(state1, state2) { return { count: state1.count + state2.count } }',
-                finalize: 'function(state) { return state; }',
-                lang: 'js',
-              }
-            }
-          }
-        },
-        name: 'mongodb.query'
-      };
-
-      [
-        {
-          value: 'function() { return { count: 0 } }',
-          findings: {
-            boundaryOverrunIndex: 0,
-            end: 33,
-            inputBoundaryIndex: 0,
-            start: 0,
-          }
-        },
-        {
-          value: 'function(state) { return { count: state.count + 1 } }',
-          findings: {
-            boundaryOverrunIndex: 0,
-            end: 52,
-            inputBoundaryIndex: 0,
-            start: 0,
-          }
-        },
-        {
-          value: 'function(state1, state2) { return { count: state1.count + state2.count } }',
-          findings: {
-            boundaryOverrunIndex: 0,
-            end: 73,
-            inputBoundaryIndex: 0,
-            start: 0,
-          }
-        },
-        {
-          value: 'function(state) { return state; }',
-          findings: {
-            boundaryOverrunIndex: 0,
-            end: 32,
-            inputBoundaryIndex: 0,
-            start: 0,
-          }
-        },
-      ].forEach((obj) => {
-        [sinkContext, Object.assign({}, sinkContext, { value: [sinkContext.value] })]
-          .forEach(sc => {
-            const sourceContext = makeSourceContext(
-              [
-                {
-                  ruleId: 'ssjs-injection',
-                  value: obj.value,
-                  exploitMetadata: [],
-                }
-              ]
-            );
-
-            handlers.nosqlInjectionMongo(sourceContext, sc);
-            expect(sourceContext.resultsMap['nosql-injection-mongo']).to.have.lengthOf(1);
-            expect(sourceContext.resultsMap['ssjs-injection']).to.have.lengthOf(1);
-            expect(sourceContext.resultsMap['nosql-injection-mongo'][0]).to.eql({
-              ruleId: 'nosql-injection-mongo',
-              value: obj.value,
-              exploitMetadata: [
-                {
-                  sinkContext: sc,
-                  findings: obj.findings,
-                }
-              ],
-              mappedId: 'nosql-injection-mongo'
-            });
-          });
-      });
-    });
-
-    it('sourceContext-injection as function execution - not an attack', function () {
-      const data = {
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: ' ',
-              idsList: [],
-              exploitMetadata: [],
-            }
-          ]
-        ),
-      };
-
-      const sinkContext = {
-        value: { $where: 'function() { return true; } ' },
-      };
-
-      handlers.nosqlInjectionMongo(data.sourceContext, sinkContext);
-      expect(data.sourceContext.resultsMap['nosql-injection-mongo']).to.be.undefined;
-      expect(data.sourceContext.resultsMap['ssjs-injection']).to.have.lengthOf(1);
-    });
-
-    it(`nosql-injection-mongo - ${agentLibIDListTypes.TRUE_CLAUSE_1} - object`, function () {
-      const vector = "' || true || '";
-
-      const sinkContext = {
-        name: 'mongodb.FindCursor',
-        value: {
-          $where: `this.orderId === '${vector}'`
-        }
-      };
-
-      const expectedDetails = {
-        start: 18,
-        end: 31,
-        boundaryOverrunIndex: 0,
-        inputBoundaryIndex: 0,
-      };
-
-      const data = {
-        blocks: true,
-        type: 'expansionInjection',
-        findings: expansionFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'nosql-injection-mongo',
-              inputType: 'JsonValue',
-              path: [
-                'input',
-              ],
-              key: 'input',
-              value: '\' || true || \'',
-              score: 10,
-              idsList: [
-                agentLibIDListTypes.TRUE_CLAUSE_1,
-              ],
-              mappedId: 'nosql-injection',
-              blocked: false,
-              exploitMetadata: [
-              ],
-            }
-          ],
-          {
-            ['nosql-injection-mongo']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: {
-              name: 'mongodb.FindCursor',
-              value: {
-                $where: `this.orderId === '${vector}'`,
-              }
-            },
-            findings: expansionFindings,
-          },
-        ]
-      };
-
-      const test = expect(() => handlers.nosqlInjectionMongo(data.sourceContext, sinkContext));
-      test.to.throw('SecurityException');
-
-      const nosqliResults = data.sourceContext.resultsMap['nosql-injection-mongo'];
-      expect(nosqliResults[0].exploitMetadata).to.deep.equal([
-        {
-          sinkContext: {
-            name: 'mongodb.FindCursor',
-            value: {
-              $where: `this.orderId === '${vector}'`,
-            },
-            stack: [],
-          },
-          findings: expectedDetails,
-        },
-      ]);
-    });
-
-    it(`nosql-injection-mongo - ${agentLibIDListTypes.MONGO_SLEEP} - object`, function () {
-      const sinkContext = {
-        name: 'mongodb.FindCursor',
-        value: {
-          $where: 'this.title ==sleep(500)',
-        }
-      };
-
-      const expectedDetails = {
-        start: 13,
-        end: 22,
-        boundaryOverrunIndex: 0,
-        inputBoundaryIndex: 0,
-      };
-
-      const data = {
-        blocks: true,
-        type: 'expansionInjection',
-        findings: expansionFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'nosql-injection-mongo',
-              inputType: 'JsonValue',
-              path: [
-                'input',
-              ],
-              key: 'input',
-              value: 'sleep(500)',
-              score: 10,
-              idsList: [
-                agentLibIDListTypes.MONGO_SLEEP,
-              ],
-              mappedId: 'nosql-injection',
-              blocked: false,
-              exploitMetadata: [
-              ],
-            }
-          ],
-          {
-            ['nosql-injection-mongo']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: {
-              name: 'mongodb.FindCursor',
-              value: {
-                $where: 'this.title ==sleep(500)',
-              }
-            },
-            findings: expansionFindings,
-          },
-        ]
-      };
-
-      const test = expect(() => handlers.nosqlInjectionMongo(data.sourceContext, sinkContext));
-      test.to.throw('SecurityException');
-
-      const nosqliResults = data.sourceContext.resultsMap['nosql-injection-mongo'];
-      expect(nosqliResults[0].exploitMetadata).to.deep.equal([
-        {
-          sinkContext: {
-            name: 'mongodb.FindCursor',
-            value: {
-              $where: 'this.title ==sleep(500)',
-            },
-            stack: [
-            ],
-          },
-          findings: expectedDetails,
-        },
-      ]);
-    });
-
-    it(`nosql-injection-mongo - ${agentLibIDListTypes.MONGO_SLEEP} - string`, function () {
-      const sinkContext = {
-        name: 'mongodb.FindCursor',
-        value: 'sleep(500)'
-      };
-
-      const expectedDetails = {
-        start: 0,
-        end: 9,
-        boundaryOverrunIndex: 0,
-        inputBoundaryIndex: 0,
-      };
-
-      const data = {
-        blocks: true,
-        type: 'expansionInjection',
-        findings: expansionFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'nosql-injection-mongo',
-              inputType: 'JsonValue',
-              path: [
-                'input',
-              ],
-              key: 'input',
-              value: 'sleep(500)',
-              score: 10,
-              idsList: [
-                agentLibIDListTypes.MONGO_SLEEP,
-              ],
-              mappedId: 'nosql-injection',
-              blocked: false,
-              exploitMetadata: [
-              ],
-            }
-          ],
-          {
-            ['nosql-injection-mongo']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: {
-              name: 'mongodb.FindCursor',
-              value: 'sleep(500)'
-            },
-            findings: expansionFindings,
-          },
-        ]
-      };
-
-      const test = expect(() => handlers.nosqlInjectionMongo(data.sourceContext, sinkContext));
-      test.to.throw('SecurityException');
-
-      const nosqliResults = data.sourceContext.resultsMap['nosql-injection-mongo'];
-      expect(nosqliResults[0].exploitMetadata).to.deep.equal([
-        {
-          sinkContext: {
-            name: 'mongodb.FindCursor',
-            value: 'sleep(500)',
-            stack: [],
-          },
-          findings: expectedDetails,
-        },
-      ]);
-    });
-  });
-
-  describe('ssjsInjection()', function () {
-    const stringSinkContextPositive = {
-      name: 'vm.Script',
-      value: 'function() { console.log("function() { process.exit(1); }") (function() { process.exit(1); })() }',
-      stack: [],
-    };
-    const stringSinkContextPositiveV2 = {
-      name: 'vm.Script',
-      value: 'function wrapperFunction() { function() { process.exit(1); } }',
-      stack: [],
-    };
-    const stringSinkContextNegative = {
-      name: 'vm.Script',
-      value: 'function() { console.log("function() { process.exit(1); }") }',
-      stack: [],
-    };
-    const objectSinkContextPositive = {
-      name: 'vm.Script.runInNewContext',
-      value: {
-        numValue: 1,
-        strValue: 'Contrast',
-        vulnerableValue: 'function() { process.exit(1); }',
-        anotherStr: 'Security',
-        booleanValue: true
-      },
-      stack: [],
-    };
-    const objectSinkContextNegative = {
-      name: 'vm.Script.runInNewContext',
-      value: {
-        numValue: 1,
-        strValue: '',
-        booleanValue: true
-      },
-      stack: [],
-    };
-    const findings = {
-      startIndex: 61,
-      endIndex: 92,
-      boundaryIndex: 61,
-      codeString: 'function() { process.exit(1); }'
-    };
-
-    const objectFindings = {
-      startIndex: 0,
-      endIndex: 30,
-      boundaryIndex: 0,
-      codeString: 'function() { process.exit(1); }'
-    };
-
-    [
-      {
-        blocks: false,
-        type: 'codeString',
-        findings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { process.exit(1); }',
-              exploitMetadata: [],
-            }
-          ]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: stringSinkContextPositive,
-            findings,
-          },
-          {
-            sinkContext: stringSinkContextPositiveV2,
-            findings: {
-              startIndex: 29,
-              boundaryIndex: 29,
-              endIndex: 60,
-              codeString: 'function() { process.exit(1); }'
-            },
-          }
-        ]
-      },
-      {
-        blocks: true,
-        type: 'codeString',
-        findings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { process.exit(1); }',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['ssjs-injection']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: stringSinkContextPositive,
-            findings,
-          },
-        ]
-      },
-      {
-        blocks: false,
-        type: 'codeString',
-        findings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { process.exit(1); }',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['ssjs-injection']: 'off'
-          }
-        ),
-        expectedDetails: []
-      },
-      {
-        blocks: false,
-        type: 'contextObject',
-        objectFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { process.exit(1); }',
-              exploitMetadata: [],
-            }
-          ]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: objectSinkContextPositive,
-            findings: objectFindings,
-          },
-          {
-            sinkContext: objectSinkContextPositive,
-            findings: objectFindings,
-          }
-        ]
-      },
-      {
-        blocks: true,
-        type: 'contextObject',
-        objectFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { process.exit(1); }',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['ssjs-injection']: 'block'
-          }
-        ),
-        expectedDetails: [
-          {
-            sinkContext: objectSinkContextPositive,
-            findings: objectFindings,
-          },
-        ]
-      },
-      {
-        blocks: false,
-        type: 'contextObject',
-        objectFindings,
-        sourceContext: makeSourceContext(
-          [
-            {
-              ruleId: 'ssjs-injection',
-              value: 'function() { process.exit(1); }',
-              exploitMetadata: [],
-            }
-          ],
-          {
-            ['ssjs-injection']: 'off'
-          }
-        ),
-        expectedDetails: []
-      }
-    ].forEach(({ blocks, type, sourceContext, expectedDetails }) => {
-      it(makeTestDescription(blocks), function () {
-        const testFn = () => {
-          if (type == 'codeString') {
-            handlers.ssjsInjection(sourceContext, stringSinkContextPositive);
-            handlers.ssjsInjection(sourceContext, stringSinkContextPositiveV2);
-            handlers.ssjsInjection(sourceContext, stringSinkContextNegative);
-          } else {
-            handlers.ssjsInjection(sourceContext, objectSinkContextPositive);
-            handlers.ssjsInjection(sourceContext, objectSinkContextPositive);
-            handlers.ssjsInjection(sourceContext, objectSinkContextNegative);
-          }
-        };
-
-        const test = expect(testFn);
-        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
-
-        const ssjsiResults = sourceContext.resultsMap['ssjs-injection'];
-        expect(ssjsiResults[0].exploitMetadata).to.deep.equal(expectedDetails);
-      });
-    });
-  });
-
-  describe('handleReflectedXss()', function () {
-    const ruleId = 'reflected-xss';
-    const value = '" onmouseover="alert(3)"';
-    const sinkContextPositive = {
-      value,
-      stack: []
-    };
-    const sinkContextNegative = {
-      value: 'foo',
-      stack: []
-    };
-    const findings = {
-      value
-    };
-
-    [
-      {
-        blocks: false,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId,
-            value,
-            exploitMetadata: []
-          }]
-        ),
-        expectedDetails: [
-          {
-            sinkContext: sinkContextPositive,
-            findings
-          },
-          {
-            sinkContext: sinkContextPositive,
-            findings
-          }
-        ]
-      },
-      {
-        blocks: false,
-        sourceContext: makeSourceContext(
-          [{
-            ruleId,
-            value,
-            exploitMetadata: [],
-          }],
-          {
-            [ruleId]: 'off'
-          }
-        ),
-        expectedDetails: []
-      }
-    ].forEach(({ blocks, sourceContext, expectedDetails }) => {
-      it(makeTestDescription(blocks), function () {
-        const testFn = () => {
-          handlers.handleReflectedXss(sourceContext, sinkContextPositive);
-          handlers.handleReflectedXss(sourceContext, sinkContextPositive);
-          handlers.handleReflectedXss(sourceContext, sinkContextNegative);
-        };
-
-        const test = expect(testFn);
-        blocks ? test.to.throw('SecurityException') : test.not.to.throw();
-
-        expect(sourceContext.resultsMap['reflected-xss'][0].exploitMetadata).to.deep.equal(expectedDetails);
-      });
-    });
-  });
-});