@contrast/assess - npm Package Compare versions

Comparing version 1.11.0 to 1.12.0

lib/dataflow/index.js

@@ -23,3 +23,2 @@ /*
 
-  require('./event-factory')(core);
   require('./tracker')(core);
@@ -26,0 +25,0 @@ require('./sources')(core);

lib/dataflow/propagation/install/array-prototype-join.js

@@ -29,3 +29,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -32,0 +33,0 @@ } = core;

lib/dataflow/propagation/install/buffer.js

@@ -22,6 +22,4 @@ /*
     assess: {
-      dataflow: {
-        eventFactory,
-        tracker
-      }
+      eventFactory,
+      dataflow: { tracker }
     },
@@ -28,0 +26,0 @@ patcher,

lib/dataflow/propagation/install/contrast-methods/add.js

@@ -29,3 +29,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -32,0 +33,0 @@ } = core;

lib/dataflow/propagation/install/contrast-methods/string.js

@@ -35,6 +35,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     }
@@ -41,0 +39,0 @@ } = core;

lib/dataflow/propagation/install/contrast-methods/tag.js

@@ -23,6 +23,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -29,0 +27,0 @@ patcher,

lib/dataflow/propagation/install/decode-uri-component.js

@@ -31,3 +31,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -34,0 +35,0 @@ } = core;

lib/dataflow/propagation/install/ejs/escape-xml.js

@@ -32,3 +32,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -35,0 +36,0 @@ } = core;

lib/dataflow/propagation/install/encode-uri-component.js

@@ -31,3 +31,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -34,0 +35,0 @@ } = core;

lib/dataflow/propagation/install/escape-html.js

@@ -32,3 +32,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -35,0 +36,0 @@ } = core;

lib/dataflow/propagation/install/escape.js

@@ -31,3 +31,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -34,0 +35,0 @@ } = core;

lib/dataflow/propagation/install/handlebars-utils-escape-expression.js

@@ -32,3 +32,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -35,0 +36,0 @@ } = core;

lib/dataflow/propagation/install/JSON/parse.js

@@ -55,6 +55,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -61,0 +59,0 @@ } = core;

lib/dataflow/propagation/install/JSON/stringify.js

@@ -79,3 +79,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -82,0 +83,0 @@ } = core;

lib/dataflow/propagation/install/mongoose/schema-map.js

@@ -27,5 +27,5 @@ /*
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { mongooseInstrumentation },
@@ -32,0 +32,0 @@ },

lib/dataflow/propagation/install/mongoose/schema-mixed.js

@@ -27,5 +27,5 @@ /*
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { mongooseInstrumentation },
@@ -32,0 +32,0 @@ },

lib/dataflow/propagation/install/mongoose/schema-string.js

@@ -31,6 +31,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -37,0 +35,0 @@ } = core;

lib/dataflow/propagation/install/mysql-connection-escape.js

@@ -32,3 +32,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -35,0 +36,0 @@ } = core;

lib/dataflow/propagation/install/path/basename.js

@@ -30,6 +30,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -36,0 +34,0 @@ } = core;

lib/dataflow/propagation/install/path/join-and-resolve.js

@@ -31,6 +31,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -37,0 +35,0 @@ } = core;

lib/dataflow/propagation/install/path/normalize.js

@@ -30,6 +30,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -36,0 +34,0 @@ } = core;

lib/dataflow/propagation/install/pug-runtime-escape.js

@@ -32,3 +32,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -35,0 +36,0 @@ } = core;

lib/dataflow/propagation/install/querystring/parse.js

@@ -34,3 +34,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -37,0 +38,0 @@ } = core;

lib/dataflow/propagation/install/reg-exp-prototype-exec.js

@@ -26,6 +26,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -32,0 +30,0 @@ } = core;

lib/dataflow/propagation/install/sequelize.js

@@ -30,6 +30,4 @@ /*
     assess: {
-      dataflow: {
-        tracker,
-        eventFactory: { createPropagationEvent },
-      },
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker },
     },
@@ -36,0 +34,0 @@ } = core;

lib/dataflow/propagation/install/sql-template-strings.js

@@ -29,3 +29,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -32,0 +33,0 @@ } = core;

lib/dataflow/propagation/install/string/concat.js

@@ -29,3 +29,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -32,0 +33,0 @@ } = core;

lib/dataflow/propagation/install/string/format-methods.js

@@ -25,3 +25,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -28,0 +29,0 @@ } = core;

lib/dataflow/propagation/install/string/html-methods.js

@@ -39,3 +39,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -42,0 +43,0 @@ } = core;

lib/dataflow/propagation/install/string/index.js

@@ -26,3 +26,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -29,0 +30,0 @@ } = core;

lib/dataflow/propagation/install/string/match-all.js

@@ -26,5 +26,5 @@ /*
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { stringInstrumentation },
@@ -31,0 +31,0 @@ },

lib/dataflow/propagation/install/string/match.js

@@ -26,5 +26,5 @@ /*
     assess: {
+      eventFactory: { createPropagationEvent },
       dataflow: {
         tracker,
-        eventFactory: { createPropagationEvent },
         propagation: { stringInstrumentation },
@@ -31,0 +31,0 @@ },

lib/dataflow/propagation/install/string/replace.js

@@ -31,3 +31,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     },
@@ -34,0 +35,0 @@ scopes: { sources, instrumentation }

lib/dataflow/propagation/install/string/slice.js

@@ -25,3 +25,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -28,0 +29,0 @@ } = core;

lib/dataflow/propagation/install/string/split.js

@@ -28,3 +28,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -31,0 +32,0 @@ } = core;

lib/dataflow/propagation/install/string/substring.js

@@ -27,3 +27,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -30,0 +31,0 @@ } = core;

lib/dataflow/propagation/install/string/trim.js

@@ -28,3 +28,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -31,0 +32,0 @@ } = core;

lib/dataflow/propagation/install/unescape.js

@@ -31,3 +31,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -34,0 +35,0 @@ } = core;

lib/dataflow/propagation/install/url/domain-parsers.js

@@ -29,3 +29,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -32,0 +33,0 @@ } = core;

lib/dataflow/propagation/install/url/parse.js

 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: [e-mail]
@@ -27,3 +27,4 @@ * License: Commercial
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -30,0 +31,0 @@ } = core;

lib/dataflow/propagation/install/url/searchParams.js

 /*
- * Copyright: 2022 Contrast Security, Inc
+ * Copyright: 2023 Contrast Security, Inc
  * Contact: [e-mail]
@@ -27,3 +27,4 @@ * License: Commercial
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -79,14 +80,20 @@ } = core;
                 const param = query.substring(endIdx + 1, query.length);
+
+                const keyInfo = tracker.getData(key);
                 const paramInfo = tracker.getData(param);
-                if (!paramInfo) return;
 
-                const event = getPropagationEvent(params, paramInfo, data);
-                if (!event);
+                if (keyInfo) {
+                  const event = getPropagationEvent(params, keyInfo, data);
+                  if (event) Object.assign(keyInfo, event);
+                }
 
-                Object.assign(paramInfo, event);
-                const { extern } = paramInfo || tracker.track(param, event);
+                if (paramInfo) {
+                  const event = getPropagationEvent(params, paramInfo, data);
+                  if (event) Object.assign(paramInfo, event);
+                }
 
-                if (extern) {
-                  result.set(key, extern);
-                }
+                const trackedKey = keyInfo?.extern;
+                const trackedParam = paramInfo?.extern;
+                if (trackedKey) result.delete(key);
+                result.set(trackedKey || key, trackedParam || param);
               });
@@ -93,0 +100,0 @@ }

lib/dataflow/propagation/install/url/url.js

@@ -27,3 +27,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -30,0 +31,0 @@ } = core;

lib/dataflow/propagation/install/validator/hooks.js

@@ -26,3 +26,4 @@ /*
     assess: {
-      dataflow: { tracker, eventFactory: { createPropagationEvent } }
+      eventFactory: { createPropagationEvent },
+      dataflow: { tracker }
     }
@@ -29,0 +30,0 @@ } = core;

lib/dataflow/sinks/install/child-process.js

@@ -33,6 +33,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
@@ -39,0 +39,0 @@ },

lib/dataflow/sinks/install/eval.js

@@ -47,6 +47,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -53,0 +53,0 @@ },

lib/dataflow/sinks/install/express/unvalidated-redirect.js

@@ -42,6 +42,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
+        sinks: { isVulnerable, reportFindings, reportSafePositive }
       },
@@ -48,0 +48,0 @@ },

lib/dataflow/sinks/install/fastify/unvalidated-redirect.js

@@ -61,6 +61,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -67,0 +67,0 @@ },

lib/dataflow/sinks/install/fs.js

@@ -39,6 +39,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
@@ -45,0 +45,0 @@ },

lib/dataflow/sinks/install/function.js

@@ -49,6 +49,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -55,0 +55,0 @@ },

lib/dataflow/sinks/install/http/request.js

@@ -41,2 +41,3 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
@@ -48,3 +49,2 @@ tracker,
         },
-        eventFactory: { createSinkEvent },
       },
@@ -51,0 +51,0 @@ },

lib/dataflow/sinks/install/http/server-response.js

@@ -43,2 +43,3 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
@@ -52,3 +53,2 @@ tracker,
         },
-        eventFactory: { createSinkEvent },
       },
@@ -55,0 +55,0 @@ },

lib/dataflow/sinks/install/koa/unvalidated-redirect.js

@@ -42,6 +42,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -48,0 +48,0 @@ },

lib/dataflow/sinks/install/marsdb.js

@@ -46,6 +46,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, reportFindings },
-        eventFactory: { createSinkEvent },
       },
@@ -52,0 +52,0 @@ },

lib/dataflow/sinks/install/mongodb.js

@@ -77,6 +77,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, runInActiveSink, isLocked, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent }
+        sinks: { isVulnerable, runInActiveSink, isLocked, reportFindings, reportSafePositive }
       }
@@ -83,0 +83,0 @@ }

lib/dataflow/sinks/install/mssql.js

@@ -42,6 +42,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, isLocked, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -48,0 +48,0 @@ },

lib/dataflow/sinks/install/mysql.js

@@ -49,6 +49,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
-        sinks: { isVulnerable, isLocked, reportFindings },
-        eventFactory: { createSinkEvent },
+        sinks: { isVulnerable, isLocked, reportFindings }
       },
@@ -55,0 +55,0 @@ },

lib/dataflow/sinks/install/postgres.js

@@ -33,6 +33,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, isLocked, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -39,0 +39,0 @@ },

lib/dataflow/sinks/install/sequelize.js

@@ -38,6 +38,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, runInActiveSink, reportFindings, reportSafePositive },
-        eventFactory: { createSinkEvent },
       },
@@ -44,0 +44,0 @@ },

lib/dataflow/sinks/install/sqlite3.js

@@ -38,6 +38,6 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
         tracker,
         sinks: { isVulnerable, isLocked, reportFindings },
-        eventFactory: { createSinkEvent },
       },
@@ -44,0 +44,0 @@ },

lib/dataflow/sinks/install/vm.js

@@ -51,2 +51,3 @@ /*
     assess: {
+      eventFactory: { createSinkEvent },
       dataflow: {
@@ -61,3 +62,2 @@ tracker,
         },
-        eventFactory: { createSinkEvent },
       },
@@ -64,0 +64,0 @@ },

lib/dataflow/sources/handler.js

@@ -28,6 +28,6 @@ /*
     assess: {
+      eventFactory,
       dataflow: {
         sources,
-        tracker,
-        eventFactory
+        tracker
       }
@@ -34,0 +34,0 @@ },

lib/dataflow/sources/install/http.js

@@ -83,3 +83,3 @@ /*
           if (toLowerCase(name) === 'content-type' && value) {
-            scopes.sources.getStore().assess.responseData.contentType = value;
+            store.assess.responseData.contentType = value;
           }
@@ -86,0 +86,0 @@ }

lib/dataflow/tracker.js

@@ -24,7 +24,3 @@ /*
     assess: {
-      dataflow: {
-        eventFactory: {
-          createdEvents
-        }
-      }
+      eventFactory: { createdEvents },
     },
@@ -31,0 +27,0 @@ logger

lib/index.js

@@ -22,2 +22,3 @@ /*
 const responseScanning = require('./response-scanning');
+const eventFactory = require('./event-factory');
 
@@ -31,5 +32,6 @@ module.exports = function assess(core) {
   // 1. dataflow
-  sessionConfiguration(core);
+  eventFactory(core);
   dataflow(core);
   responseScanning(core);
+  sessionConfiguration(core);
 
@@ -36,0 +38,0 @@ // crypto

lib/session-configuration/index.js

@@ -18,13 +18,10 @@ /*
 
-const { callChildComponentMethodsSync, Event } = require('@contrast/common');
+const { callChildComponentMethodsSync } = require('@contrast/common');
 
 module.exports = function(core) {
-  const { messages } = core;
-  const sessionConfiguration = core.assess.sessionConfiguration = {
-    reportFindings(_sourceContext, vulnerabilityMetadata) {
-      messages.emit(Event.ASSESS_SESSION_CONFIGURATION_FINDING, vulnerabilityMetadata);
-    },
-  };
-  require('./install/http')(core);
+  const sessionConfiguration = core.assess.sessionConfiguration = {};
 
+  require('./handlers')(core);
+  require('./install/express-session')(core);
+
   sessionConfiguration.install = function() {
@@ -31,0 +28,0 @@ callChildComponentMethodsSync(sessionConfiguration, 'install');

package.json

 {
   "name": "@contrast/assess",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "",
@@ -16,3 +16,3 @@ "main": "lib/index.js",
   "dependencies": {
-    "@contrast/distringuish": "^4.1.0",
+    "@contrast/distringuish": "^4.4.0",
     "@contrast/scopes": "1.4.0",
@@ -19,0 +19,0 @@ "@contrast/common": "1.14.0",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

426751

increased by1.36%

Number of package files

118

increased by1.72%

Lines of code

12237

increased by1.57%

Dependency changes

• Updated@contrast/distringuish@^4.4.0