0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-7DQEV5QI.js

@@ -0,0 +1,287 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  allowlistedChildEnv
+} from "./chunk-KLTNTE2Z.js";
+
+// packages/core/dist/stages/npm-detectors/osv-lookup.js
+var DEFAULT_ENDPOINT = "https://api.osv.dev/v1/querybatch";
+var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_RETRIES = 1;
+var RETRY_BACKOFF_MS = 400;
+var OsvLookupError = class extends Error {
+  cause;
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "OsvLookupError";
+  }
+};
+function deriveForkSiblings(name) {
+  const out = /* @__PURE__ */ new Set();
+  const dotted = /^([a-z0-9][a-z0-9-]*)\.[a-z0-9.-]+$/.exec(name);
+  if (dotted)
+    out.add(dotted[1]);
+  const scoped = /^@([a-z0-9][a-z0-9-]*)\/([a-z0-9][a-z0-9._-]*)$/.exec(name);
+  if (scoped && scoped[1] !== "types")
+    out.add(scoped[2]);
+  out.delete(name);
+  return [...out];
+}
+function createOsvAdvisoryLookup(options = {}) {
+  const endpoint = options.endpoint ?? DEFAULT_ENDPOINT;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const retries = options.retries ?? DEFAULT_RETRIES;
+  const deriveSiblings = options.deriveSiblings ?? deriveForkSiblings;
+  return async (name, version, _cwe) => {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+      throw new OsvLookupError("no fetch implementation available for OSV lookup");
+    }
+    const siblings = deriveSiblings(name).filter((s) => s && s !== name);
+    const queries = [
+      { package: { ecosystem: "npm", name }, ...version ? { version } : {} },
+      ...siblings.map((s) => ({ package: { ecosystem: "npm", name: s } }))
+    ];
+    const data = await postBatch(fetchImpl, endpoint, { queries }, timeoutMs, retries);
+    const results = data.results ?? [];
+    const advisories = [];
+    for (const v of results[0]?.vulns ?? []) {
+      if (v?.id)
+        advisories.push(v.id);
+    }
+    siblings.forEach((sib, i) => {
+      for (const v of results[i + 1]?.vulns ?? []) {
+        if (v?.id)
+          advisories.push(`sibling:${sib}:${v.id}`);
+      }
+    });
+    return [...new Set(advisories)];
+  };
+}
+async function postBatch(fetchImpl, endpoint, body, timeoutMs, retries) {
+  let lastErr;
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (res.status === 429 || res.status >= 500) {
+        lastErr = new OsvLookupError(`OSV transient status ${res.status}`);
+        if (attempt < retries) {
+          await delay(RETRY_BACKOFF_MS * (attempt + 1));
+          continue;
+        }
+        throw lastErr;
+      }
+      if (!res.ok) {
+        throw new OsvLookupError(`OSV lookup failed: HTTP ${res.status}`);
+      }
+      const json = await res.json();
+      if (!json || typeof json !== "object" || !("results" in json)) {
+        throw new OsvLookupError("OSV lookup returned a malformed response (no `results`)");
+      }
+      return json;
+    } catch (err) {
+      lastErr = err;
+      const transient = isAbortOrNetwork(err);
+      if (transient && attempt < retries) {
+        await delay(RETRY_BACKOFF_MS * (attempt + 1));
+        continue;
+      }
+      if (err instanceof OsvLookupError)
+        throw err;
+      throw new OsvLookupError(`OSV lookup errored: ${errMsg(err)}`, err);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  throw new OsvLookupError(`OSV lookup exhausted retries: ${errMsg(lastErr)}`, lastErr);
+}
+function isAbortOrNetwork(err) {
+  if (err instanceof OsvLookupError)
+    return false;
+  const name = err?.name;
+  return name === "AbortError" || name === "TypeError" || err instanceof Error;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function errMsg(e) {
+  return e instanceof Error ? e.message.split("\n")[0].slice(0, 160) : String(e);
+}
+
+// packages/core/dist/stages/npm-detectors/probe.js
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+function inProcessProbe(pkg, baseDir, note) {
+  const req = createRequire(pathToFileURL(baseDir.endsWith("/") ? baseDir : `${baseDir}/`).href);
+  return {
+    pkg,
+    baseDir,
+    load(moduleId) {
+      try {
+        return req(moduleId);
+      } catch {
+        return void 0;
+      }
+    },
+    note
+  };
+}
+function staticProbe(pkg, modules, note) {
+  return {
+    pkg,
+    baseDir: "/dev/null",
+    load(moduleId) {
+      return Object.prototype.hasOwnProperty.call(modules, moduleId) ? modules[moduleId] : void 0;
+    },
+    note
+  };
+}
+
+// packages/core/dist/stages/npm-detectors/sandbox-probe.js
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+var DEFAULT_INSTALL_TIMEOUT_MS = 18e4;
+var DEFAULT_RUN_TIMEOUT_MS = 12e4;
+function defaultHarnessPath() {
+  return fileURLToPath(new URL("./sandbox-harness.js", import.meta.url));
+}
+function localSandboxProvider() {
+  return {
+    async create() {
+      const workdir = await mkdtemp(join(tmpdir(), "0sec-npm-dyn-"));
+      return {
+        workdir,
+        run(cmd, args, runOpts) {
+          return new Promise((resolve, reject) => {
+            execFile(cmd, args, {
+              cwd: runOpts?.cwd ?? workdir,
+              timeout: runOpts?.timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS,
+              maxBuffer: 64 * 1024 * 1024,
+              // This child runs UNTRUSTED npm package code (install + harness
+              // exec). Inheriting process.env would hand every provider /
+              // cloud credential to attacker-authored package code via one
+              // `process.env` read. Build from the allowlist instead; a fresh
+              // npm install needs only PATH/HOME/TMPDIR, all carried there.
+              env: allowlistedChildEnv(runOpts?.env ?? {})
+            }, (err, stdout, stderr) => {
+              const anyErr = err;
+              if (anyErr && typeof anyErr.code !== "number") {
+                reject(anyErr);
+                return;
+              }
+              resolve({
+                stdout: stdout?.toString() ?? "",
+                stderr: stderr?.toString() ?? "",
+                exitCode: typeof anyErr?.code === "number" ? anyErr.code : 0
+              });
+            });
+          });
+        },
+        async dispose() {
+          await rm(workdir, { recursive: true, force: true });
+        }
+      };
+    }
+  };
+}
+function parseHarnessResult(stdout) {
+  const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line.startsWith("{"))
+      continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && Array.isArray(parsed.outcomes)) {
+        return { outcomes: parsed.outcomes, warnings: Array.isArray(parsed.warnings) ? parsed.warnings : [] };
+      }
+    } catch {
+    }
+  }
+  return void 0;
+}
+function createSandboxPackageRunner(options = {}) {
+  const provider = options.provider ?? localSandboxProvider();
+  const harnessPath = options.harnessPath ?? defaultHarnessPath();
+  const nodeBin = options.nodeBin ?? process.execPath;
+  const installTimeoutMs = options.installTimeoutMs ?? DEFAULT_INSTALL_TIMEOUT_MS;
+  const runTimeoutMs = options.runTimeoutMs ?? DEFAULT_RUN_TIMEOUT_MS;
+  const log = options.log ?? (() => {
+  });
+  return async function sandboxRunner(pkg, detectorIds) {
+    let session;
+    try {
+      session = await provider.create();
+    } catch (e) {
+      log(`SKIP ${pkg.name}: sandbox create failed: ${errMsg2(e)}`);
+      return void 0;
+    }
+    let result;
+    try {
+      const spec = pkg.version ? `${pkg.name}@${pkg.version}` : pkg.name;
+      const install = await session.run("npm", ["install", "--ignore-scripts", "--no-audit", "--no-fund", "--no-package-lock", "--prefix", session.workdir, spec], { cwd: session.workdir, timeoutMs: installTimeoutMs });
+      if (install.exitCode !== 0) {
+        log(`SKIP ${pkg.name}: npm install exited ${install.exitCode}: ${firstLine(install.stderr)}`);
+        return void 0;
+      }
+      const config = JSON.stringify({
+        installDir: session.workdir,
+        pkg,
+        detectorIds,
+        offlineDedup: options.offlineDedup ?? false
+      });
+      const harness = await session.run(nodeBin, [harnessPath, config], {
+        cwd: session.workdir,
+        timeoutMs: runTimeoutMs
+      });
+      if (harness.exitCode !== 0) {
+        log(`SKIP ${pkg.name}: harness exited ${harness.exitCode}: ${firstLine(harness.stderr)}`);
+        return void 0;
+      }
+      const parsed = parseHarnessResult(harness.stdout);
+      if (!parsed) {
+        log(`SKIP ${pkg.name}: harness produced no parseable result`);
+        return void 0;
+      }
+      result = parsed;
+    } catch (e) {
+      log(`SKIP ${pkg.name}: sandbox run threw: ${errMsg2(e)}`);
+      result = void 0;
+    } finally {
+      try {
+        await session.dispose();
+      } catch (e) {
+        log(`WARN ${pkg.name}: sandbox dispose failed: ${errMsg2(e)}`);
+      }
+    }
+    return result;
+  };
+}
+function errMsg2(e) {
+  return e instanceof Error ? e.message.split("\n")[0].slice(0, 200) : String(e);
+}
+function firstLine(s) {
+  return (s.split("\n").find(Boolean) ?? "").slice(0, 200);
+}
+
+export {
+  OsvLookupError,
+  deriveForkSiblings,
+  createOsvAdvisoryLookup,
+  inProcessProbe,
+  staticProbe,
+  localSandboxProvider,
+  createSandboxPackageRunner
+};