@hclsoftware/secagent/src/TaintedObjectData.js

IAST agent

//IASTIGNORE
/*
 * ****************************************************
 * Licensed Materials - Property of HCL.
 * (c) Copyright HCL Technologies Ltd. 2017, 2025.
 * Note to U.S. Government Users *Restricted Rights.
 * ****************************************************
 */

'use strict'

const taintedObjectDataFlow = require('./TaintedObjectDataFlow')
const StackInfo = require('./StackInfo')
const TaintTracker = require('./TaintTracker')
const {Entity} = require("./Entity");
const {keys} = require("./AdditionalInfo")

function TaintedObjectData () {
  this.flows = []

  this.addToStackList = function (stackInfo) {
    for (const flow of this.flows) {
      flow.addToStackInfoList(stackInfo)
    }
  }

  this.updateSourceStackInfo = function (stackInfo) {
    for (const flow of this.flows) {
      flow.stackInfoList[0] = stackInfo
    }
  }

  this.updateEntity = function (entityName, entityValue, entityType) {
    for (const flow of this.flows) {
      flow.entity = new Entity(entityName, entityValue, entityType)
    }
  }

  // this version for opsModPlus
  this.addDataToStackList = function (type, object, signature, args, returnValue, propagatorTargetAsString) {
    const stackInfo = new StackInfo(type, StackInfo.getParamsStringArrayPostHook(object, object, signature, args, returnValue), null, new global.origError(), propagatorTargetAsString)
    this.addToStackList(stackInfo)
  }

  this.sinkTrigger = function (vulnerability) {
    for (const flow of this.flows) { flow.sinkTrigger(vulnerability) }
  }

  this.merge = function (otherTaintedObjectData, parameters, propagatorTargetAsString, modificationsInfo) {
    if (otherTaintedObjectData !== undefined) {
      const mergeWithSelf = otherTaintedObjectData === this
      for (const flow of otherTaintedObjectData.flows) {
        const targetFlow = mergeWithSelf ? flow : flow.getCopy()
        if (modificationsInfo != null) {
          targetFlow.addAdditionalInfoElementToArray({[keys.MODIFICATIONS]: modificationsInfo})
        }
        if (!mergeWithSelf){
          this.flows.push(targetFlow) // TODO: merge based on hash
        }
        if (parameters != null){
          targetFlow.addToStackInfoList(new StackInfo(TaintTracker.HookRuleType.PROPAGATOR, parameters, null, new global.origError(), propagatorTargetAsString))
        }
      }
    }
  }

  // needed for opsModPlus to avoid the need to include more files
  this.getCopy = function () {
    const taintedData = new TaintedObjectData()
    taintedData.merge(this, null)
    return taintedData
  }

  this.addToTaskList = function (task) {
    for (const flow of this.flows) {
      flow.addToTaskList(task)
    }
  }

  this.isTainted = () => {
    for (const flow of this.flows) {
      if (flow.isTainted()) {
        return true
      }
    }
    return false
  }

  this.isTaintedForVulnerability = (vulnerability) => {
    for (const flow of this.flows) {
      if (flow.isTaintedForVulnerability(vulnerability)) {
        return true
      }
    }
    return false
  }

  this.addAdditionalInfoToFlows = (info) => {
    for (const flow of this.flows) {
      flow.addAdditionalInfo(info)
    }
  }
}

module.exports.taintedObjectDataWithFlow = (requestInfo, entityName, entityValue, entityType) => {
  const taintedData = new TaintedObjectData()
  const flow = new taintedObjectDataFlow(requestInfo, entityName, entityValue, entityType)
  taintedData.flows.push(flow)
  return taintedData
}



// module.exports.copyTaintedObjectData = (otherTaintedObjectData) => {
//     let taintedData = new TaintedObjectData()
//     if (otherTaintedObjectData !== undefined) {
//         for (let flow of otherTaintedObjectData.flows) {
//             taintedData.flows.push(JSON.origParse(JSON.origStringify(flow))) // TODO: merge based on hash
//         }
//     }
//     return taintedData
// }

module.exports.TaintedObjectData = TaintedObjectData