@appland/scanner 1.56.0 → 1.57.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (247) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/built/algorithms/dataStructures/graph/Graph.js +53 -62
  3. package/built/algorithms/dataStructures/graph/GraphEdge.js +13 -16
  4. package/built/algorithms/dataStructures/graph/GraphVertex.js +37 -42
  5. package/built/algorithms/dataStructures/linked-list/LinkedList.js +33 -38
  6. package/built/algorithms/dataStructures/linked-list/LinkedListNode.js +6 -10
  7. package/built/algorithms/graph/depth-first-search/index.js +7 -8
  8. package/built/algorithms/graph/detect-cycle/index.js +15 -16
  9. package/built/algorithms/utils/Comparator.js +19 -21
  10. package/built/analyzer/recordSecrets.js +7 -30
  11. package/built/analyzer/secretsRegexes.js +8 -9
  12. package/built/appMapIndex.js +18 -20
  13. package/built/check.js +16 -18
  14. package/built/checkInstance.js +26 -48
  15. package/built/cli/ci/command.js +61 -156
  16. package/built/cli/ci/options.js +0 -1
  17. package/built/cli/codeVersionArgs.js +0 -1
  18. package/built/cli/exitCode.js +0 -1
  19. package/built/cli/fail.js +2 -3
  20. package/built/cli/merge/command.js +21 -63
  21. package/built/cli/merge/options.js +0 -1
  22. package/built/cli/reportUploadURL.js +2 -3
  23. package/built/cli/resolveAppId.js +34 -85
  24. package/built/cli/scan/command.js +52 -94
  25. package/built/cli/scan/formatReport.js +16 -89
  26. package/built/cli/scan/options.js +0 -1
  27. package/built/cli/scan/scanner.js +38 -117
  28. package/built/cli/scan/singleScan.js +61 -109
  29. package/built/cli/scan/watchScan.js +32 -82
  30. package/built/cli/scan.js +39 -132
  31. package/built/cli/scanArgs.js +0 -1
  32. package/built/cli/scanOptions.js +0 -1
  33. package/built/cli/updateCommitStatus.js +10 -47
  34. package/built/cli/upload/command.js +20 -64
  35. package/built/cli/upload/options.js +0 -1
  36. package/built/cli/upload/pruneAppMap.js +16 -0
  37. package/built/cli/upload.js +91 -172
  38. package/built/cli/validateFile.js +13 -52
  39. package/built/cli.js +34 -21
  40. package/built/configuration/configurationProvider.js +148 -233
  41. package/built/configuration/schema/options.json +76 -76
  42. package/built/configuration/types/checkConfig.js +0 -1
  43. package/built/configuration/types/configuration.js +0 -1
  44. package/built/configuration/types/matchEventConfig.js +0 -1
  45. package/built/configuration/types/matchPatternConfig.js +0 -1
  46. package/built/database/index.js +33 -127
  47. package/built/database/visit.js +16 -66
  48. package/built/errors.js +4 -30
  49. package/built/eventUtil.js +10 -35
  50. package/built/findings.js +3 -4
  51. package/built/integration/appland/app/exists.js +33 -76
  52. package/built/integration/appland/app/listFindingStatus.js +3 -36
  53. package/built/integration/appland/appMap/create.js +38 -89
  54. package/built/integration/appland/location.js +0 -1
  55. package/built/integration/appland/mapset/create.js +34 -85
  56. package/built/integration/appland/retry.js +10 -11
  57. package/built/integration/appland/retryOptions.js +0 -1
  58. package/built/integration/appland/scannerJob/create.js +34 -84
  59. package/built/integration/appland/scannerJob/merge.js +28 -74
  60. package/built/integration/appland/scannerJob.js +0 -1
  61. package/built/integration/github/commitStatus.js +3 -4
  62. package/built/integration/vars.js +1 -2
  63. package/built/openapi/index.js +39 -83
  64. package/built/report/appMapMetadata.js +0 -1
  65. package/built/report/findingSummary.js +0 -1
  66. package/built/report/findingsReport.js +14 -16
  67. package/built/report/scanResults.js +18 -45
  68. package/built/report/scanSummary.js +0 -1
  69. package/built/report/summaryReport.js +12 -13
  70. package/built/ruleChecker.js +146 -297
  71. package/built/rules/authzBeforeAuthn.js +25 -59
  72. package/built/rules/circularDependency.js +69 -101
  73. package/built/rules/deserializationOfUntrustedData.js +29 -63
  74. package/built/rules/execOfUntrustedCommand.js +28 -62
  75. package/built/rules/http-500/metadata.js +0 -1
  76. package/built/rules/http-500/rule.js +2 -3
  77. package/built/rules/illegalPackageDependency.js +16 -18
  78. package/built/rules/incompatibleHttpClientRequest.js +30 -69
  79. package/built/rules/insecureCompare.js +12 -13
  80. package/built/rules/jobNotCancelled.js +13 -45
  81. package/built/rules/lib/hasParameterOrReceiver.js +4 -7
  82. package/built/rules/lib/matchEvent.js +12 -13
  83. package/built/rules/lib/matchPattern.js +6 -7
  84. package/built/rules/lib/metadata.js +0 -1
  85. package/built/rules/lib/parseRuleDescription.js +5 -6
  86. package/built/rules/lib/precedingEvents.js +7 -75
  87. package/built/rules/lib/rpcWithoutProtection.js +5 -28
  88. package/built/rules/lib/sanitizesData.js +0 -1
  89. package/built/rules/lib/util.js +33 -73
  90. package/built/rules/logoutWithoutSessionReset.js +24 -58
  91. package/built/rules/missingAuthentication.js +28 -28
  92. package/built/rules/missingContentType.js +8 -9
  93. package/built/rules/nPlusOneQuery.js +35 -87
  94. package/built/rules/queryFromInvalidPackage.js +17 -19
  95. package/built/rules/queryFromView.js +13 -16
  96. package/built/rules/rpcWithoutCircuitBreaker.js +14 -84
  97. package/built/rules/saveWithoutValidation.js +8 -9
  98. package/built/rules/secretInLog.js +29 -92
  99. package/built/rules/slowFunctionCall.js +16 -20
  100. package/built/rules/slowHttpServerRequest.js +9 -11
  101. package/built/rules/slowQuery.js +9 -12
  102. package/built/rules/tooManyJoins.js +26 -51
  103. package/built/rules/tooManyUpdates.js +25 -105
  104. package/built/rules/unbatchedMaterializedQuery.js +26 -30
  105. package/built/rules/updateInGetRequest.js +30 -45
  106. package/built/scope/commandScope.js +24 -144
  107. package/built/scope/httpClientRequestScope.js +11 -98
  108. package/built/scope/httpServerRequestScope.js +11 -98
  109. package/built/scope/rootScope.js +11 -98
  110. package/built/scope/scopeImpl.js +10 -82
  111. package/built/scope/scopeIterator.js +6 -10
  112. package/built/scope/sqlTransactionScope.js +24 -122
  113. package/built/sqlWarning.js +9 -35
  114. package/built/telemetry.js +215 -0
  115. package/built/wellKnownLabels.js +0 -1
  116. package/package.json +7 -3
  117. package/built/algorithms/dataStructures/graph/Graph.js.map +0 -1
  118. package/built/algorithms/dataStructures/graph/GraphEdge.js.map +0 -1
  119. package/built/algorithms/dataStructures/graph/GraphVertex.js.map +0 -1
  120. package/built/algorithms/dataStructures/linked-list/LinkedList.js.map +0 -1
  121. package/built/algorithms/dataStructures/linked-list/LinkedListNode.js.map +0 -1
  122. package/built/algorithms/graph/depth-first-search/index.js.map +0 -1
  123. package/built/algorithms/graph/detect-cycle/index.js.map +0 -1
  124. package/built/algorithms/utils/Comparator.js.map +0 -1
  125. package/built/analyzer/recordSecrets.js.map +0 -1
  126. package/built/analyzer/secretsRegexes.js.map +0 -1
  127. package/built/appMapIndex.js.map +0 -1
  128. package/built/check.js.map +0 -1
  129. package/built/checkInstance.js.map +0 -1
  130. package/built/cli/ci/command.js.map +0 -1
  131. package/built/cli/ci/options.js.map +0 -1
  132. package/built/cli/codeVersionArgs.js.map +0 -1
  133. package/built/cli/exitCode.js.map +0 -1
  134. package/built/cli/fail.js.map +0 -1
  135. package/built/cli/merge/command.js.map +0 -1
  136. package/built/cli/merge/options.js.map +0 -1
  137. package/built/cli/reportUploadURL.js.map +0 -1
  138. package/built/cli/resolveAppId.js.map +0 -1
  139. package/built/cli/scan/command.js.map +0 -1
  140. package/built/cli/scan/formatReport.js.map +0 -1
  141. package/built/cli/scan/options.js.map +0 -1
  142. package/built/cli/scan/scanner.js.map +0 -1
  143. package/built/cli/scan/singleScan.js.map +0 -1
  144. package/built/cli/scan/watchScan.js.map +0 -1
  145. package/built/cli/scan.js.map +0 -1
  146. package/built/cli/scanArgs.js.map +0 -1
  147. package/built/cli/scanOptions.js.map +0 -1
  148. package/built/cli/updateCommitStatus.js.map +0 -1
  149. package/built/cli/upload/command.js.map +0 -1
  150. package/built/cli/upload/options.js.map +0 -1
  151. package/built/cli/upload.js.map +0 -1
  152. package/built/cli/validateFile.js.map +0 -1
  153. package/built/cli.js.map +0 -1
  154. package/built/configuration/configurationProvider.js.map +0 -1
  155. package/built/configuration/types/checkConfig.js.map +0 -1
  156. package/built/configuration/types/configuration.js.map +0 -1
  157. package/built/configuration/types/matchEventConfig.js.map +0 -1
  158. package/built/configuration/types/matchPatternConfig.js.map +0 -1
  159. package/built/database/index.js.map +0 -1
  160. package/built/database/visit.js.map +0 -1
  161. package/built/errors.js.map +0 -1
  162. package/built/eventUtil.js.map +0 -1
  163. package/built/findings.js.map +0 -1
  164. package/built/integration/appland/app/exists.js.map +0 -1
  165. package/built/integration/appland/app/listFindingStatus.js.map +0 -1
  166. package/built/integration/appland/appMap/create.js.map +0 -1
  167. package/built/integration/appland/location.js.map +0 -1
  168. package/built/integration/appland/mapset/create.js.map +0 -1
  169. package/built/integration/appland/retry.js.map +0 -1
  170. package/built/integration/appland/retryOptions.js.map +0 -1
  171. package/built/integration/appland/scannerJob/create.js.map +0 -1
  172. package/built/integration/appland/scannerJob/merge.js.map +0 -1
  173. package/built/integration/appland/scannerJob.js.map +0 -1
  174. package/built/integration/github/commitStatus.js.map +0 -1
  175. package/built/integration/vars.js.map +0 -1
  176. package/built/openapi/index.js.map +0 -1
  177. package/built/openapi/method.js +0 -120
  178. package/built/openapi/method.js.map +0 -1
  179. package/built/openapi/model.js +0 -49
  180. package/built/openapi/model.js.map +0 -1
  181. package/built/openapi/path.js +0 -36
  182. package/built/openapi/path.js.map +0 -1
  183. package/built/openapi/provider.js +0 -133
  184. package/built/openapi/provider.js.map +0 -1
  185. package/built/openapi/response.js +0 -59
  186. package/built/openapi/response.js.map +0 -1
  187. package/built/openapi/rpcRequest.js +0 -130
  188. package/built/openapi/rpcRequest.js.map +0 -1
  189. package/built/openapi/schema.js +0 -42
  190. package/built/openapi/schema.js.map +0 -1
  191. package/built/openapi/securitySchemes.js +0 -32
  192. package/built/openapi/securitySchemes.js.map +0 -1
  193. package/built/openapi/statusCodes.js +0 -68
  194. package/built/openapi/statusCodes.js.map +0 -1
  195. package/built/openapi/util.js +0 -91
  196. package/built/openapi/util.js.map +0 -1
  197. package/built/report/appMapMetadata.js.map +0 -1
  198. package/built/report/findingSummary.js.map +0 -1
  199. package/built/report/findingsReport.js.map +0 -1
  200. package/built/report/scanResults.js.map +0 -1
  201. package/built/report/scanSummary.js.map +0 -1
  202. package/built/report/summaryReport.js.map +0 -1
  203. package/built/ruleChecker.js.map +0 -1
  204. package/built/rules/authzBeforeAuthn.js.map +0 -1
  205. package/built/rules/circularDependency.js.map +0 -1
  206. package/built/rules/deserializationOfUntrustedData.js.map +0 -1
  207. package/built/rules/execOfUntrustedCommand.js.map +0 -1
  208. package/built/rules/http-500/metadata.js.map +0 -1
  209. package/built/rules/http-500/rule.js.map +0 -1
  210. package/built/rules/illegalPackageDependency.js.map +0 -1
  211. package/built/rules/incompatibleHttpClientRequest.js.map +0 -1
  212. package/built/rules/insecureCompare.js.map +0 -1
  213. package/built/rules/jobNotCancelled.js.map +0 -1
  214. package/built/rules/lib/hasParameterOrReceiver.js.map +0 -1
  215. package/built/rules/lib/matchEvent.js.map +0 -1
  216. package/built/rules/lib/matchPattern.js.map +0 -1
  217. package/built/rules/lib/metadata.js.map +0 -1
  218. package/built/rules/lib/parseRuleDescription.js.map +0 -1
  219. package/built/rules/lib/precedingEvents.js.map +0 -1
  220. package/built/rules/lib/rpcWithoutProtection.js.map +0 -1
  221. package/built/rules/lib/sanitizesData.js.map +0 -1
  222. package/built/rules/lib/util.js.map +0 -1
  223. package/built/rules/logoutWithoutSessionReset.js.map +0 -1
  224. package/built/rules/missingAuthentication.js.map +0 -1
  225. package/built/rules/missingContentType.js.map +0 -1
  226. package/built/rules/nPlusOneQuery.js.map +0 -1
  227. package/built/rules/queryFromInvalidPackage.js.map +0 -1
  228. package/built/rules/queryFromView.js.map +0 -1
  229. package/built/rules/rpcWithoutCircuitBreaker.js.map +0 -1
  230. package/built/rules/saveWithoutValidation.js.map +0 -1
  231. package/built/rules/secretInLog.js.map +0 -1
  232. package/built/rules/slowFunctionCall.js.map +0 -1
  233. package/built/rules/slowHttpServerRequest.js.map +0 -1
  234. package/built/rules/slowQuery.js.map +0 -1
  235. package/built/rules/tooManyJoins.js.map +0 -1
  236. package/built/rules/tooManyUpdates.js.map +0 -1
  237. package/built/rules/unbatchedMaterializedQuery.js.map +0 -1
  238. package/built/rules/updateInGetRequest.js.map +0 -1
  239. package/built/scope/commandScope.js.map +0 -1
  240. package/built/scope/httpClientRequestScope.js.map +0 -1
  241. package/built/scope/httpServerRequestScope.js.map +0 -1
  242. package/built/scope/rootScope.js.map +0 -1
  243. package/built/scope/scopeImpl.js.map +0 -1
  244. package/built/scope/scopeIterator.js.map +0 -1
  245. package/built/scope/sqlTransactionScope.js.map +0 -1
  246. package/built/sqlWarning.js.map +0 -1
  247. package/built/wellKnownLabels.js.map +0 -1
@@ -1,63 +1,37 @@
1
1
  "use strict";
2
- var __read = (this && this.__read) || function (o, n) {
3
- var m = typeof Symbol === "function" && o[Symbol.iterator];
4
- if (!m) return o;
5
- var i = m.call(o), r, ar = [], e;
6
- try {
7
- while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
8
- }
9
- catch (error) { e = { error: error }; }
10
- finally {
11
- try {
12
- if (r && !r.done && (m = i["return"])) m.call(i);
13
- }
14
- finally { if (e) throw e.error; }
15
- }
16
- return ar;
17
- };
18
- var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
19
- if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
20
- if (ar || !(i in from)) {
21
- if (!ar) ar = Array.prototype.slice.call(from, 0, i);
22
- ar[i] = from[i];
23
- }
24
- }
25
- return to.concat(ar || Array.prototype.slice.call(from));
26
- };
27
2
  var __importDefault = (this && this.__importDefault) || function (mod) {
28
3
  return (mod && mod.__esModule) ? mod : { "default": mod };
29
4
  };
30
5
  Object.defineProperty(exports, "__esModule", { value: true });
31
- var GraphEdge_1 = __importDefault(require("../algorithms/dataStructures/graph/GraphEdge"));
32
- var GraphVertex_1 = __importDefault(require("../algorithms/dataStructures/graph/GraphVertex"));
33
- var Graph_1 = __importDefault(require("../algorithms/dataStructures/graph/Graph"));
34
- var detect_cycle_1 = __importDefault(require("../algorithms/graph/detect-cycle"));
35
- var path_1 = require("path");
36
- var util_1 = require("./lib/util");
37
- var matchPattern_1 = require("./lib/matchPattern");
38
- var url_1 = require("url");
39
- var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
40
- var Cycle = /** @class */ (function () {
41
- function Cycle(packages, events) {
6
+ const GraphEdge_1 = __importDefault(require("../algorithms/dataStructures/graph/GraphEdge"));
7
+ const GraphVertex_1 = __importDefault(require("../algorithms/dataStructures/graph/GraphVertex"));
8
+ const Graph_1 = __importDefault(require("../algorithms/dataStructures/graph/Graph"));
9
+ const detect_cycle_1 = __importDefault(require("../algorithms/graph/detect-cycle"));
10
+ const path_1 = require("path");
11
+ const util_1 = require("./lib/util");
12
+ const matchPattern_1 = require("./lib/matchPattern");
13
+ const url_1 = require("url");
14
+ const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
15
+ class Cycle {
16
+ constructor(packages, events) {
42
17
  this.packages = packages;
43
18
  this.events = events;
44
19
  }
45
- return Cycle;
46
- }());
20
+ }
47
21
  function ignorePackage(event, ignoredPackages) {
48
- var myPackage = event.codeObject.packageOf;
22
+ const myPackage = event.codeObject.packageOf;
49
23
  return (myPackage === '' ||
50
- ignoredPackages.some(function (filter) { return filter(myPackage); }) ||
24
+ ignoredPackages.some((filter) => filter(myPackage)) ||
51
25
  !event.codeObject.location ||
52
26
  (0, path_1.isAbsolute)(event.codeObject.location));
53
27
  }
54
28
  function detectCycles(root, ignoredPackages) {
55
- var graph = new Graph_1.default(true);
56
- var vertices = new Map();
57
- var edges = new Set();
58
- var vertexEvents = new Map();
59
- var makeVertex = function (pkg, event) {
60
- var result = vertices.get(pkg);
29
+ const graph = new Graph_1.default(true);
30
+ const vertices = new Map();
31
+ const edges = new Set();
32
+ const vertexEvents = new Map();
33
+ const makeVertex = (pkg, event) => {
34
+ let result = vertices.get(pkg);
61
35
  if (!result) {
62
36
  result = new GraphVertex_1.default(pkg);
63
37
  vertices.set(pkg, result);
@@ -68,18 +42,18 @@ function detectCycles(root, ignoredPackages) {
68
42
  }
69
43
  return result;
70
44
  };
71
- var collectEvent = function (event, parentEvent, parentPackage) {
72
- var myPackage = event.codeObject.packageOf;
45
+ const collectEvent = (event, parentEvent, parentPackage) => {
46
+ let myPackage = event.codeObject.packageOf;
73
47
  if (ignorePackage(event, ignoredPackages)) {
74
48
  myPackage = null;
75
49
  }
76
50
  if (myPackage) {
77
- var vertex = makeVertex(myPackage, event);
51
+ const vertex = makeVertex(myPackage, event);
78
52
  if (parentPackage && parentPackage !== myPackage) {
79
- var edge = new GraphEdge_1.default(vertices.get(parentPackage), vertex);
53
+ const edge = new GraphEdge_1.default(vertices.get(parentPackage), vertex);
80
54
  if (!edges.has(edge.getKey())) {
81
55
  if ((0, util_1.verbose)()) {
82
- console.warn("New edge: ".concat(parentPackage, "/").concat(parentEvent, " -> ").concat(myPackage, "/").concat(event));
56
+ console.warn(`New edge: ${parentPackage}/${parentEvent} -> ${myPackage}/${event}`);
83
57
  }
84
58
  edges.add(edge.getKey());
85
59
  graph.addEdge(edge);
@@ -87,14 +61,14 @@ function detectCycles(root, ignoredPackages) {
87
61
  }
88
62
  parentPackage = myPackage;
89
63
  }
90
- event.children.forEach(function (child) { return collectEvent(child, event, parentPackage); });
64
+ event.children.forEach((child) => collectEvent(child, event, parentPackage));
91
65
  };
92
66
  if (root.codeObject.packageOf !== '') {
93
67
  makeVertex(root.codeObject.packageOf, root);
94
68
  }
95
69
  collectEvent(root, null, null);
96
- return (0, detect_cycle_1.default)(graph).map(function (cycle) {
97
- return new Cycle(cycle.map(function (vertex) { return vertex.getKey(); }), vertexEvents);
70
+ return (0, detect_cycle_1.default)(graph).map((cycle) => {
71
+ return new Cycle(cycle.map((vertex) => vertex.getKey()), vertexEvents);
98
72
  });
99
73
  }
100
74
  /**
@@ -103,46 +77,42 @@ function detectCycles(root, ignoredPackages) {
103
77
 
104
78
  * @returns Sequence of events whose package names match the cyclePath.
105
79
  */
106
- var searchForCycle = function (cycle, ignoredPackages) {
107
- var traverseEvent = function (event, recordEvent, cyclePath, cyclePathIndex, path) {
108
- if (cyclePathIndex === void 0) { cyclePathIndex = 0; }
109
- if (path === void 0) { path = []; }
80
+ const searchForCycle = (cycle, ignoredPackages) => {
81
+ const traverseEvent = (event, recordEvent, cyclePath, cyclePathIndex = 0, path = []) => {
110
82
  if (recordEvent) {
111
83
  if ((0, util_1.verbose)()) {
112
- console.warn("".concat(Array(path.length).fill('').join(' '), "push: ").concat(event));
84
+ console.warn(`${Array(path.length).fill('').join(' ')}push: ${event}`);
113
85
  }
114
86
  path.push(event);
115
87
  }
116
88
  else {
117
89
  if ((0, util_1.verbose)()) {
118
- console.warn("".concat(Array(path.length).fill('').join(' '), "traverse: ").concat(event));
90
+ console.warn(`${Array(path.length).fill('').join(' ')}traverse: ${event}`);
119
91
  }
120
92
  }
121
93
  if (cyclePathIndex === cyclePath.length - 1) {
122
94
  if ((0, util_1.verbose)()) {
123
- console.warn("".concat(Array(path.length).fill('').join(' '), "result: ").concat(path));
95
+ console.warn(`${Array(path.length).fill('').join(' ')}result: ${path}`);
124
96
  }
125
- return __spreadArray([], __read(path), false);
97
+ return [...path];
126
98
  }
127
- var myPackage = event.codeObject.packageOf;
99
+ const myPackage = event.codeObject.packageOf;
128
100
  if ((0, util_1.verbose)()) {
129
- console.warn(event.children.map(function (child) { return child.codeObject.fqid; }));
101
+ console.warn(event.children.map((child) => child.codeObject.fqid));
130
102
  }
131
103
  // Traverse children of ignored or same package
132
- var result = event.children
133
- .filter(function (child) { return child.codeObject.packageOf === myPackage || ignorePackage(child, ignoredPackages); })
134
- .map(function (child) { return traverseEvent(child, false, cyclePath, cyclePathIndex, path); })
104
+ let result = event.children
105
+ .filter((child) => child.codeObject.packageOf === myPackage || ignorePackage(child, ignoredPackages))
106
+ .map((child) => traverseEvent(child, false, cyclePath, cyclePathIndex, path))
135
107
  .filter(Boolean);
136
108
  // Traverse children of the next package in the graph
137
109
  if (result.length === 0) {
138
110
  result = event.children
139
- .filter(function (child) {
140
- return child.codeObject.packageOf !== myPackage &&
141
- !ignorePackage(child, ignoredPackages) &&
142
- cyclePath[cyclePathIndex + 1] === child.codeObject.packageOf;
143
- })
144
- .map(function (child) { return traverseEvent(child, true, cyclePath, cyclePathIndex + 1, path); })
145
- .filter(function (path) { return path; });
111
+ .filter((child) => child.codeObject.packageOf !== myPackage &&
112
+ !ignorePackage(child, ignoredPackages) &&
113
+ cyclePath[cyclePathIndex + 1] === child.codeObject.packageOf)
114
+ .map((child) => traverseEvent(child, true, cyclePath, cyclePathIndex + 1, path))
115
+ .filter((path) => path);
146
116
  }
147
117
  if (result.length > 0) {
148
118
  return result[0];
@@ -150,17 +120,17 @@ var searchForCycle = function (cycle, ignoredPackages) {
150
120
  else {
151
121
  if (recordEvent) {
152
122
  if ((0, util_1.verbose)()) {
153
- console.warn("".concat(Array(path.length - 1)
123
+ console.warn(`${Array(path.length - 1)
154
124
  .fill('')
155
- .join(' '), "pop"));
125
+ .join(' ')}pop`);
156
126
  }
157
127
  path.pop();
158
128
  }
159
129
  else {
160
130
  if ((0, util_1.verbose)()) {
161
- console.warn("".concat(Array(path.length - 1)
131
+ console.warn(`${Array(path.length - 1)
162
132
  .fill('')
163
- .join(' '), "untraverse"));
133
+ .join(' ')}untraverse`);
164
134
  }
165
135
  }
166
136
  return null;
@@ -168,20 +138,20 @@ var searchForCycle = function (cycle, ignoredPackages) {
168
138
  };
169
139
  // Look for a cycle starting at each package name. For each package name, consider the
170
140
  // events that have that package.
171
- for (var i = 0; i < cycle.packages.length; i++) {
172
- var packageName = cycle.packages[i];
173
- var startEvents = cycle.events.get(packageName);
174
- var cyclePath = [];
175
- for (var k = 0; k < cycle.packages.length; k++) {
141
+ for (let i = 0; i < cycle.packages.length; i++) {
142
+ const packageName = cycle.packages[i];
143
+ const startEvents = cycle.events.get(packageName);
144
+ const cyclePath = [];
145
+ for (let k = 0; k < cycle.packages.length; k++) {
176
146
  cyclePath[k] = cycle.packages[(i + k) % cycle.packages.length];
177
147
  }
178
148
  cyclePath.push(packageName);
179
149
  if ((0, util_1.verbose)()) {
180
- console.warn("Searching for event path for cycle ".concat(cyclePath));
150
+ console.warn(`Searching for event path for cycle ${cyclePath}`);
181
151
  }
182
- for (var j = 0; j < startEvents.length; j++) {
183
- var startEvent = startEvents[j];
184
- var path = traverseEvent(startEvent, true, cyclePath);
152
+ for (let j = 0; j < startEvents.length; j++) {
153
+ const startEvent = startEvents[j];
154
+ const path = traverseEvent(startEvent, true, cyclePath);
185
155
  if (path) {
186
156
  return path;
187
157
  }
@@ -189,39 +159,38 @@ var searchForCycle = function (cycle, ignoredPackages) {
189
159
  }
190
160
  return null;
191
161
  };
192
- var Options = /** @class */ (function () {
193
- function Options() {
162
+ class Options {
163
+ constructor() {
194
164
  this.ignoredPackages = [];
195
165
  this.depth = 4;
196
166
  }
197
- return Options;
198
- }());
167
+ }
199
168
  function build(options) {
200
- var ignoredPackages = (0, matchPattern_1.buildFilters)(options.ignoredPackages);
169
+ const ignoredPackages = (0, matchPattern_1.buildFilters)(options.ignoredPackages);
201
170
  function matcher(event) {
202
171
  return detectCycles(event, ignoredPackages)
203
- .filter(function (cycle) { return cycle.packages.length + 1 >= options.depth; })
204
- .map(function (cycle) { return searchForCycle(cycle, ignoredPackages); })
205
- .filter(function (path) { return path; })
206
- .map(function (path) {
172
+ .filter((cycle) => cycle.packages.length + 1 >= options.depth)
173
+ .map((cycle) => searchForCycle(cycle, ignoredPackages))
174
+ .filter((path) => path)
175
+ .map((path) => {
207
176
  return {
208
177
  event: path[0],
209
178
  message: [
210
179
  'Cycle in package dependency graph',
211
- path.map(function (event) { return event.codeObject.packageOf; }).join(' -> '),
180
+ path.map((event) => event.codeObject.packageOf).join(' -> '),
212
181
  ].join(': '),
213
182
  relatedEvents: path,
214
183
  };
215
184
  });
216
185
  }
217
186
  return {
218
- matcher: matcher,
187
+ matcher,
219
188
  };
220
189
  }
221
190
  exports.default = {
222
191
  id: 'circular-dependency',
223
192
  title: 'Circular package dependency',
224
- Options: Options,
193
+ Options,
225
194
  impactDomain: 'Maintainability',
226
195
  references: {
227
196
  'CWE-1047': new url_1.URL('https://cwe.mitre.org/data/definitions/1047.html'),
@@ -229,6 +198,5 @@ exports.default = {
229
198
  enumerateScope: false,
230
199
  description: (0, parseRuleDescription_1.default)('circularDependency'),
231
200
  url: 'https://appland.com/docs/analysis/rules-reference.html#circular-dependency',
232
- build: build,
201
+ build,
233
202
  };
234
- //# sourceMappingURL=circularDependency.js.map
@@ -1,85 +1,52 @@
1
1
  "use strict";
2
- var __values = (this && this.__values) || function(o) {
3
- var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
4
- if (m) return m.call(o);
5
- if (o && typeof o.length === "number") return {
6
- next: function () {
7
- if (o && i >= o.length) o = void 0;
8
- return { value: o && o[i++], done: !o };
9
- }
10
- };
11
- throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
12
- };
13
2
  var __importDefault = (this && this.__importDefault) || function (mod) {
14
3
  return (mod && mod.__esModule) ? mod : { "default": mod };
15
4
  };
16
5
  Object.defineProperty(exports, "__esModule", { value: true });
17
- var models_1 = require("@appland/models");
18
- var url_1 = require("url");
19
- var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
20
- var precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
21
- var sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
6
+ const models_1 = require("@appland/models");
7
+ const url_1 = require("url");
8
+ const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
9
+ const precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
10
+ const sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
22
11
  function allArgumentsSanitized(rootEvent, event) {
23
12
  return (event.parameters || [])
24
- .filter(function (parameter) { return parameter.object_id; })
25
- .every(function (parameter) {
26
- var e_1, _a;
27
- try {
28
- for (var _b = __values((0, precedingEvents_1.default)(rootEvent, event)), _c = _b.next(); !_c.done; _c = _b.next()) {
29
- var candidate = _c.value;
30
- if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, DeserializeSanitize)) {
31
- return true;
32
- }
13
+ .filter((parameter) => parameter.object_id)
14
+ .every((parameter) => {
15
+ for (const candidate of (0, precedingEvents_1.default)(rootEvent, event)) {
16
+ if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, DeserializeSanitize)) {
17
+ return true;
33
18
  }
34
19
  }
35
- catch (e_1_1) { e_1 = { error: e_1_1 }; }
36
- finally {
37
- try {
38
- if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
39
- }
40
- finally { if (e_1) throw e_1.error; }
41
- }
42
20
  return false;
43
21
  });
44
22
  }
45
23
  function build() {
46
24
  function matcher(rootEvent) {
47
- var e_2, _a;
48
- try {
49
- for (var _b = __values(new models_1.EventNavigator(rootEvent).descendants()), _c = _b.next(); !_c.done; _c = _b.next()) {
50
- var event = _c.value;
51
- // events: //*[@authorization && truthy?(returnValue) && not(preceding::*[@authentication]) && not(descendant::*[@authentication])]
52
- if (event.event.labels.has(DeserializeUnsafe) &&
53
- !event.event.ancestors().find(function (ancestor) { return ancestor.labels.has(DeserializeSafe); })) {
54
- if (allArgumentsSanitized(rootEvent, event.event)) {
55
- return;
56
- }
57
- else {
58
- return [
59
- {
60
- event: event.event,
61
- message: "".concat(event.event, " deserializes untrusted data"),
62
- },
63
- ];
64
- }
25
+ for (const event of new models_1.EventNavigator(rootEvent).descendants()) {
26
+ // events: //*[@authorization && truthy?(returnValue) && not(preceding::*[@authentication]) && not(descendant::*[@authentication])]
27
+ if (event.event.labels.has(DeserializeUnsafe) &&
28
+ !event.event.ancestors().find((ancestor) => ancestor.labels.has(DeserializeSafe))) {
29
+ if (allArgumentsSanitized(rootEvent, event.event)) {
30
+ return;
31
+ }
32
+ else {
33
+ return [
34
+ {
35
+ event: event.event,
36
+ message: `${event.event} deserializes untrusted data`,
37
+ },
38
+ ];
65
39
  }
66
40
  }
67
41
  }
68
- catch (e_2_1) { e_2 = { error: e_2_1 }; }
69
- finally {
70
- try {
71
- if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
72
- }
73
- finally { if (e_2) throw e_2.error; }
74
- }
75
42
  }
76
43
  return {
77
- matcher: matcher,
44
+ matcher,
78
45
  };
79
46
  }
80
- var DeserializeUnsafe = 'deserialize.unsafe';
81
- var DeserializeSafe = 'deserialize.safe';
82
- var DeserializeSanitize = 'deserialize.sanitize';
47
+ const DeserializeUnsafe = 'deserialize.unsafe';
48
+ const DeserializeSafe = 'deserialize.safe';
49
+ const DeserializeSanitize = 'deserialize.sanitize';
83
50
  exports.default = {
84
51
  id: 'deserialization-of-untrusted-data',
85
52
  title: 'Deserialization of untrusted data',
@@ -92,6 +59,5 @@ exports.default = {
92
59
  },
93
60
  description: (0, parseRuleDescription_1.default)('deserializationOfUntrustedData'),
94
61
  url: 'https://appland.com/docs/analysis/rules-reference.html#deserialization-of-untrusted-data',
95
- build: build,
62
+ build,
96
63
  };
97
- //# sourceMappingURL=deserializationOfUntrustedData.js.map
@@ -1,84 +1,51 @@
1
1
  "use strict";
2
- var __values = (this && this.__values) || function(o) {
3
- var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
4
- if (m) return m.call(o);
5
- if (o && typeof o.length === "number") return {
6
- next: function () {
7
- if (o && i >= o.length) o = void 0;
8
- return { value: o && o[i++], done: !o };
9
- }
10
- };
11
- throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
12
- };
13
2
  var __importDefault = (this && this.__importDefault) || function (mod) {
14
3
  return (mod && mod.__esModule) ? mod : { "default": mod };
15
4
  };
16
5
  Object.defineProperty(exports, "__esModule", { value: true });
17
- var models_1 = require("@appland/models");
18
- var url_1 = require("url");
19
- var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
20
- var precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
21
- var sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
6
+ const models_1 = require("@appland/models");
7
+ const url_1 = require("url");
8
+ const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
9
+ const precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
10
+ const sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
22
11
  function allArgumentsSanitized(rootEvent, event) {
23
12
  return (event.parameters || [])
24
- .filter(function (parameter) { return parameter.object_id; })
25
- .every(function (parameter) {
26
- var e_1, _a;
27
- try {
28
- for (var _b = __values((0, precedingEvents_1.default)(rootEvent, event)), _c = _b.next(); !_c.done; _c = _b.next()) {
29
- var candidate = _c.value;
30
- if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, ExecSanitize)) {
31
- return true;
32
- }
13
+ .filter((parameter) => parameter.object_id)
14
+ .every((parameter) => {
15
+ for (const candidate of (0, precedingEvents_1.default)(rootEvent, event)) {
16
+ if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, ExecSanitize)) {
17
+ return true;
33
18
  }
34
19
  }
35
- catch (e_1_1) { e_1 = { error: e_1_1 }; }
36
- finally {
37
- try {
38
- if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
39
- }
40
- finally { if (e_1) throw e_1.error; }
41
- }
42
20
  return false;
43
21
  });
44
22
  }
45
23
  function build() {
46
24
  function matcher(rootEvent) {
47
- var e_2, _a;
48
- try {
49
- for (var _b = __values(new models_1.EventNavigator(rootEvent).descendants()), _c = _b.next(); !_c.done; _c = _b.next()) {
50
- var event = _c.value;
51
- if (event.event.labels.has(Exec) &&
52
- !event.event.ancestors().find(function (ancestor) { return ancestor.labels.has(ExecSafe); })) {
53
- if (allArgumentsSanitized(rootEvent, event.event)) {
54
- return;
55
- }
56
- else {
57
- return [
58
- {
59
- event: event.event,
60
- message: "".concat(event.event, " executes an untrusted command string"),
61
- },
62
- ];
63
- }
25
+ for (const event of new models_1.EventNavigator(rootEvent).descendants()) {
26
+ if (event.event.labels.has(Exec) &&
27
+ !event.event.ancestors().find((ancestor) => ancestor.labels.has(ExecSafe))) {
28
+ if (allArgumentsSanitized(rootEvent, event.event)) {
29
+ return;
30
+ }
31
+ else {
32
+ return [
33
+ {
34
+ event: event.event,
35
+ message: `${event.event} executes an untrusted command string`,
36
+ },
37
+ ];
64
38
  }
65
39
  }
66
40
  }
67
- catch (e_2_1) { e_2 = { error: e_2_1 }; }
68
- finally {
69
- try {
70
- if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
71
- }
72
- finally { if (e_2) throw e_2.error; }
73
- }
74
41
  }
75
42
  return {
76
- matcher: matcher,
43
+ matcher,
77
44
  };
78
45
  }
79
- var Exec = 'system.exec';
80
- var ExecSafe = 'system.exec.safe';
81
- var ExecSanitize = 'system.exec.sanitize';
46
+ const Exec = 'system.exec';
47
+ const ExecSafe = 'system.exec.safe';
48
+ const ExecSanitize = 'system.exec.sanitize';
82
49
  exports.default = {
83
50
  id: 'exec-of-untrusted-command',
84
51
  title: 'Execution of untrusted system command',
@@ -90,6 +57,5 @@ exports.default = {
90
57
  },
91
58
  description: (0, parseRuleDescription_1.default)('execOfUntrustedCommand'),
92
59
  url: 'https://appland.com/docs/analysis/rules-reference.html#exec-of-untrusted-command',
93
- build: build,
60
+ build,
94
61
  };
95
- //# sourceMappingURL=execOfUntrustedCommand.js.map
@@ -9,4 +9,3 @@ exports.default = {
9
9
  'CWE-392': 'https://cwe.mitre.org/data/definitions/392.html',
10
10
  },
11
11
  };
12
- //# sourceMappingURL=metadata.js.map
@@ -2,9 +2,8 @@
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
3
  function rule() {
4
4
  return {
5
- matcher: function (e) { return e.httpServerResponse.status === 500; },
6
- where: function (e) { return !!e.httpServerResponse; },
5
+ matcher: (e) => e.httpServerResponse.status === 500,
6
+ where: (e) => !!e.httpServerResponse,
7
7
  };
8
8
  }
9
9
  exports.default = rule;
10
- //# sourceMappingURL=rule.js.map
@@ -3,40 +3,39 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
3
3
  return (mod && mod.__esModule) ? mod : { "default": mod };
4
4
  };
5
5
  Object.defineProperty(exports, "__esModule", { value: true });
6
- var matchPattern_1 = require("./lib/matchPattern");
7
- var url_1 = require("url");
8
- var parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
9
- var Options = /** @class */ (function () {
10
- function Options() {
6
+ const matchPattern_1 = require("./lib/matchPattern");
7
+ const url_1 = require("url");
8
+ const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
9
+ class Options {
10
+ constructor() {
11
11
  this.callerPackages = [];
12
12
  this.calleePackage = {};
13
13
  }
14
- return Options;
15
- }());
14
+ }
16
15
  function build(options) {
17
- var callerPatterns = (0, matchPattern_1.buildFilters)(options.callerPackages || []);
18
- var calleePattern = (0, matchPattern_1.buildFilter)(options.calleePackage);
16
+ const callerPatterns = (0, matchPattern_1.buildFilters)(options.callerPackages || []);
17
+ const calleePattern = (0, matchPattern_1.buildFilter)(options.calleePackage);
19
18
  function where(e) {
20
19
  return !!e.parent && !!e.parent.codeObject.packageOf && calleePattern(e.codeObject.packageOf);
21
20
  }
22
21
  function matcher(e) {
23
- var packageNamesStr = options.callerPackages
24
- .map(function (config) { return config.equal || config.include || config.match; })
22
+ const packageNamesStr = options.callerPackages
23
+ .map((config) => config.equal || config.include || config.match)
25
24
  .map(String)
26
25
  .join(' or ');
27
- var parentPackage = e.parent.codeObject.packageOf;
26
+ const parentPackage = e.parent.codeObject.packageOf;
28
27
  if (!(e.codeObject.packageOf === parentPackage ||
29
- callerPatterns.some(function (pattern) { return pattern(parentPackage); }))) {
28
+ callerPatterns.some((pattern) => pattern(parentPackage)))) {
30
29
  return [
31
30
  {
32
31
  event: e,
33
- message: "Code object ".concat(e.codeObject.id, " was invoked from ").concat(parentPackage, ", not from ").concat(packageNamesStr),
32
+ message: `Code object ${e.codeObject.id} was invoked from ${parentPackage}, not from ${packageNamesStr}`,
34
33
  relatedEvents: [e.parent],
35
34
  },
36
35
  ];
37
36
  }
38
37
  }
39
- return { where: where, matcher: matcher };
38
+ return { where, matcher };
40
39
  }
41
40
  exports.default = {
42
41
  id: 'illegal-package-dependency',
@@ -51,7 +50,6 @@ exports.default = {
51
50
  },
52
51
  description: (0, parseRuleDescription_1.default)('illegalPackageDependency'),
53
52
  url: 'https://appland.com/docs/analysis/rules-reference.html#illegal-package-dependency',
54
- Options: Options,
55
- build: build,
53
+ Options,
54
+ build,
56
55
  };
57
- //# sourceMappingURL=illegalPackageDependency.js.map