TaintedObjectDataFlow.js

//IASTIGNORE

/*
 * ****************************************************
 * Licensed Materials - Property of HCL.
 * (c) Copyright HCL Technologies Ltd. 2017, 2024.
 * Note to U.S. Government Users *Restricted Rights.
 * ****************************************************
 */

'use strict'
const Entity = require('./Entity')
const TaskType  = require('./Tasks/TaskType')
const Utils = require('./Utils/Utils')

class TaintedObjectDataFlow {
  constructor(requestInfo, entityName, entityValue, entityType) {
    this.requestInfo = requestInfo
    this.sanitized = []
    this.entity = new Entity.Entity(entityName, entityValue, entityType)
    this.stackInfoList = []
    this.taskList = []
    this.hasSanitationTask = false
    this.hasValidationTask = false
    this.reported = new Set()
    this.hashValue = null
    this.stackArray = null
    this.stackString = null
    this.sinkStackString = null
  }

  isTaintedForVulnerability(vulnerability) {
    return !this.sanitized.origArrayIncludes(vulnerability)
  }

  getCopy() {
    const copy = new TaintedObjectDataFlow(this.requestInfo, this.entity.name,
      this.entity.value, this.entity.type)
    copy.sanitized = [...this.sanitized]
    copy.stackInfoList = [...this.stackInfoList]
    copy.taskList = [...this.taskList]
    copy.hasSanitationTask = this.hasSanitationTask
    copy.hasValidationTask = this.hasValidationTask
    return copy
  }

  addToTaskList(task) {
    if (task.type === TaskType.VALIDATION) {
      this.hasValidationTask = true
    } else if (task.type === TaskType.SANITIZATION) {
      this.hasSanitationTask = true
    }
    this.taskList.push(task)
  }

  addToStackInfoList(stackInfo) {
    this.stackInfoList.push(stackInfo)
  }

  sanitize(vulnerability) {
    this.sanitized.push(vulnerability)
  }

  isReported(vulnerability) { return this.reported.has(vulnerability) }

  addToReported(vulnerability) { this.reported.add(vulnerability) }

  getHashValue() { return this.hashValue }

  getStackArray() { return this.stackArray }

  getStackString() {
    if (this.stackString == null) {
      this.stackString = JSON.origStringify(this.stackArray)
    }
    return this.stackString
  }

  updateStackAndHashForReporting(vulnerability) {
    let hash = Utils.createHashObject()
    const jsonOutput = []

    if (this.requestInfo.routePath !== undefined)
      hash.update(this.requestInfo.routePath)
    else if (this.requestInfo.uri !== undefined)
      hash.update(this.requestInfo.uri)

    if (this.requestInfo.method !== undefined) { hash.update(this.requestInfo.method) }
    if (vulnerability != null) { hash.update(vulnerability) }
    if (this.entity.type !== undefined) { hash.update(this.entity.type) }
    if (this.entity.name !== undefined) { hash.update(this.entity.name) }
    
    for (const item of this.stackInfoList) {
      // must update stack before its hash:
      item.updateStack()
      jsonOutput.push(item)
      hash.update(item.updateHash(vulnerability))
    }
    // update values in flow
    this.stackArray = jsonOutput
    this.hashValue = hash.produce() // The Hash object can not be used again after hash.digest() method has been called. Multiple calls will cause an error to be thrown
  }


  getSinkStackString() {
    return this.sinkStackString
  }

  setSinkStackString(sinkStackString) {
    this.sinkStackString = sinkStackString
  }


  // const fieldsToPrint = ['request', 'entity', 'call-trace']
// function replacer(key, value) {
//     // Filtering out properties
//     if (fieldsToPrint.includes(key)) {
//       return value
//     }
//     return undefined
// }
}

module.exports = TaintedObjectDataFlow