# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true

require 'contrast/components/interface'

module Contrast
  module Agent
    module Assess
      module Policy
        module Trigger
          # This acts a trigger to handle the special cases of the XPath
          # library gem and the Oga gem. Untrusted data may come into the
          # trigger methods from these classes as an array or hash,
          # respectively. Since untrusted user input comes into these triggers
          # as a splat argument or an options hash, we need to iterate through
          # these objects to see if we were tracking on any of them and report
          # a finding if so.
          class Xpath
            include Contrast::Components::Interface

            class << self
              def xpath_expression_trigger context, trigger_node, _source, object, ret, *args
                return ret unless args

                process(context, trigger_node, object, ret, *args)
              end

              def xpath_oga_trigger context, trigger_node, _source, object, ret, *args
                return ret unless args

                # convert the options arg in Oga::XML::CharacterNode#initialize into an
                # array of its values so we can check if any are unsafe
                args = args.first.values if args.first.cs__is_a?(Hash)
                process(context, trigger_node, object, ret, *args)
              end

              private

              def process context, trigger_node, object, ret, *args
                args.each do |arg|
                  next unless arg.cs__is_a?(String) || arg.cs__is_a?(Symbol)
                  next unless arg.cs__tracked?
                  next unless trigger_node.violated?(arg)

                  Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
                      context, trigger_node, arg, object, ret, args)
                end

                ret
              end
            end
          end
        end
      end
    end
  end
end