aws_security_viz 0.2.5.pre.alpha.pre.34 → 1.0.0

data/lib/aws_security_viz/risk.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module AwsSecurityViz
+  # Flags ingress open to the whole internet on a sensitive port. It looks at the real rule (before
+  # CIDR group mapping, merging and obfuscation), so a merged "all" label or a renamed peer cannot hide it.
+  module Risk
+    DEFAULT_PORTS = [22, 3389, 3306, 5432, 1433, 6379, 9200, 27017].freeze
+    PUBLIC_CIDRS = %w[0.0.0.0/0 ::/0].freeze
+    TCP = %w[tcp 6].freeze
+
+    def self.risky?(rule, peer, ports)
+      return false unless %i[cidr4 cidr6].include?(peer.kind) && PUBLIC_CIDRS.include?(peer.id)
+      return true if rule.protocol.to_s == "-1"
+      return false unless TCP.include?(rule.protocol.to_s) && rule.from_port && rule.to_port
+      ports.any? { |port| port.between?(rule.from_port, rule.to_port) }
+    end
+  end
+end

data/lib/aws_security_viz/vendor/cytoscape/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2016-2026, The Cytoscape Consortium.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the “Software”), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/aws_security_viz/vendor/cytoscape/README.md

@@ -0,0 +1,15 @@
+# Vendored Cytoscape.js
+
+Inlined into the self-contained `.html` output (see `Renderer::Html`) so the viewer needs no CDN and works from `file://`.
+
+1. Library: Cytoscape.js (MIT, see `LICENSE`)
+2. Version: 3.34.3
+3. Source: https://registry.npmjs.org/cytoscape/-/cytoscape-3.34.3.tgz (`package/dist/cytoscape.min.js`, `package/LICENSE`)
+4. sha256 of the tarball: `5d9e479216ed58a5f1ac639e746fd7d9770c4393f8c355dd133abc90bcc9ff3f`
+5. sha256 of `cytoscape.min.js`: `5f3b5b529546d5af1fc5628590af033b74511a5b6f789f5f4682845863228b91`
+6. sha256 of `LICENSE`: `eb319c6e6f233607f71e8e2f450391751883cfc0eeb3ca7ef574c13d1d9c2203`
+
+Layout uses Cytoscape's built-in `cose` layout (compound-node aware), so no layout extension is vendored.
+
+To upgrade: download the new tarball, replace the two files, update the version and hashes above. A spec checks the
+hash of `cytoscape.min.js` against this file.