@appland/scanner 1.56.0 → 1.59.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +29 -0
- package/built/algorithms/dataStructures/graph/Graph.js +53 -62
- package/built/algorithms/dataStructures/graph/GraphEdge.js +13 -16
- package/built/algorithms/dataStructures/graph/GraphVertex.js +37 -42
- package/built/algorithms/dataStructures/linked-list/LinkedList.js +33 -38
- package/built/algorithms/dataStructures/linked-list/LinkedListNode.js +6 -10
- package/built/algorithms/graph/depth-first-search/index.js +7 -8
- package/built/algorithms/graph/detect-cycle/index.js +15 -16
- package/built/algorithms/utils/Comparator.js +19 -21
- package/built/analyzer/recordSecrets.js +7 -30
- package/built/analyzer/secretsRegexes.js +8 -9
- package/built/appMapIndex.js +19 -21
- package/built/check.js +17 -21
- package/built/checkInstance.js +26 -48
- package/built/cli/ci/command.js +61 -156
- package/built/cli/ci/options.js +0 -1
- package/built/cli/codeVersionArgs.js +0 -1
- package/built/cli/exitCode.js +0 -1
- package/built/cli/fail.js +2 -3
- package/built/cli/merge/command.js +21 -63
- package/built/cli/merge/options.js +0 -1
- package/built/cli/reportUploadURL.js +2 -3
- package/built/cli/resolveAppId.js +34 -85
- package/built/cli/scan/command.js +52 -94
- package/built/cli/scan/formatReport.js +16 -89
- package/built/cli/scan/options.js +0 -1
- package/built/cli/scan/scanner.js +38 -117
- package/built/cli/scan/singleScan.js +61 -109
- package/built/cli/scan/watchScan.js +53 -85
- package/built/cli/scan.js +39 -132
- package/built/cli/scanArgs.js +0 -1
- package/built/cli/scanOptions.js +0 -1
- package/built/cli/updateCommitStatus.js +10 -47
- package/built/cli/upload/command.js +20 -64
- package/built/cli/upload/options.js +0 -1
- package/built/cli/upload/pruneAppMap.js +20 -0
- package/built/cli/upload.js +93 -172
- package/built/cli/validateFile.js +13 -52
- package/built/cli.js +34 -21
- package/built/configuration/configurationProvider.js +151 -233
- package/built/configuration/schema/options.json +76 -76
- package/built/configuration/types/checkConfig.js +0 -1
- package/built/configuration/types/configuration.js +0 -1
- package/built/configuration/types/matchEventConfig.js +0 -1
- package/built/configuration/types/matchPatternConfig.js +0 -1
- package/built/database/index.js +35 -128
- package/built/database/visit.js +20 -68
- package/built/errors.js +4 -30
- package/built/eventUtil.js +10 -35
- package/built/findings.js +3 -4
- package/built/integration/appland/app/exists.js +33 -76
- package/built/integration/appland/app/listFindingStatus.js +3 -36
- package/built/integration/appland/appMap/create.js +38 -89
- package/built/integration/appland/location.js +0 -1
- package/built/integration/appland/mapset/create.js +34 -85
- package/built/integration/appland/retry.js +10 -11
- package/built/integration/appland/retryOptions.js +0 -1
- package/built/integration/appland/scannerJob/create.js +34 -84
- package/built/integration/appland/scannerJob/merge.js +28 -74
- package/built/integration/appland/scannerJob.js +0 -1
- package/built/integration/github/commitStatus.js +3 -4
- package/built/integration/vars.js +1 -2
- package/built/openapi/index.js +39 -83
- package/built/report/appMapMetadata.js +0 -1
- package/built/report/findingSummary.js +0 -1
- package/built/report/findingsReport.js +14 -16
- package/built/report/scanResults.js +50 -72
- package/built/report/scanSummary.js +0 -1
- package/built/report/summaryReport.js +12 -13
- package/built/ruleChecker.js +146 -297
- package/built/rules/authzBeforeAuthn.js +25 -59
- package/built/rules/circularDependency.js +69 -101
- package/built/rules/deserializationOfUntrustedData.js +29 -63
- package/built/rules/execOfUntrustedCommand.js +28 -62
- package/built/rules/http-500/metadata.js +0 -1
- package/built/rules/http-500/rule.js +2 -3
- package/built/rules/illegalPackageDependency.js +16 -18
- package/built/rules/incompatibleHttpClientRequest.js +30 -69
- package/built/rules/insecureCompare.js +12 -13
- package/built/rules/jobNotCancelled.js +13 -45
- package/built/rules/lib/hasParameterOrReceiver.js +4 -7
- package/built/rules/lib/matchEvent.js +12 -13
- package/built/rules/lib/matchPattern.js +6 -7
- package/built/rules/lib/metadata.js +0 -1
- package/built/rules/lib/parseRuleDescription.js +5 -6
- package/built/rules/lib/precedingEvents.js +7 -75
- package/built/rules/lib/rpcWithoutProtection.js +5 -28
- package/built/rules/lib/sanitizesData.js +0 -1
- package/built/rules/lib/util.js +34 -73
- package/built/rules/logoutWithoutSessionReset.js +24 -58
- package/built/rules/missingAuthentication.js +28 -28
- package/built/rules/missingContentType.js +8 -9
- package/built/rules/nPlusOneQuery.js +35 -87
- package/built/rules/queryFromInvalidPackage.js +17 -19
- package/built/rules/queryFromView.js +13 -16
- package/built/rules/rpcWithoutCircuitBreaker.js +14 -84
- package/built/rules/saveWithoutValidation.js +8 -9
- package/built/rules/secretInLog.js +29 -92
- package/built/rules/slowFunctionCall.js +16 -20
- package/built/rules/slowHttpServerRequest.js +9 -11
- package/built/rules/slowQuery.js +9 -12
- package/built/rules/tooManyJoins.js +26 -51
- package/built/rules/tooManyUpdates.js +25 -105
- package/built/rules/unbatchedMaterializedQuery.js +26 -30
- package/built/rules/updateInGetRequest.js +30 -45
- package/built/scope/commandScope.js +24 -144
- package/built/scope/httpClientRequestScope.js +11 -98
- package/built/scope/httpServerRequestScope.js +11 -98
- package/built/scope/rootScope.js +11 -98
- package/built/scope/scopeImpl.js +10 -82
- package/built/scope/scopeIterator.js +6 -10
- package/built/scope/sqlTransactionScope.js +24 -122
- package/built/sqlWarning.js +9 -35
- package/built/telemetry.js +215 -0
- package/built/wellKnownLabels.js +0 -1
- package/package.json +7 -3
- package/built/algorithms/dataStructures/graph/Graph.js.map +0 -1
- package/built/algorithms/dataStructures/graph/GraphEdge.js.map +0 -1
- package/built/algorithms/dataStructures/graph/GraphVertex.js.map +0 -1
- package/built/algorithms/dataStructures/linked-list/LinkedList.js.map +0 -1
- package/built/algorithms/dataStructures/linked-list/LinkedListNode.js.map +0 -1
- package/built/algorithms/graph/depth-first-search/index.js.map +0 -1
- package/built/algorithms/graph/detect-cycle/index.js.map +0 -1
- package/built/algorithms/utils/Comparator.js.map +0 -1
- package/built/analyzer/recordSecrets.js.map +0 -1
- package/built/analyzer/secretsRegexes.js.map +0 -1
- package/built/appMapIndex.js.map +0 -1
- package/built/check.js.map +0 -1
- package/built/checkInstance.js.map +0 -1
- package/built/cli/ci/command.js.map +0 -1
- package/built/cli/ci/options.js.map +0 -1
- package/built/cli/codeVersionArgs.js.map +0 -1
- package/built/cli/exitCode.js.map +0 -1
- package/built/cli/fail.js.map +0 -1
- package/built/cli/merge/command.js.map +0 -1
- package/built/cli/merge/options.js.map +0 -1
- package/built/cli/reportUploadURL.js.map +0 -1
- package/built/cli/resolveAppId.js.map +0 -1
- package/built/cli/scan/command.js.map +0 -1
- package/built/cli/scan/formatReport.js.map +0 -1
- package/built/cli/scan/options.js.map +0 -1
- package/built/cli/scan/scanner.js.map +0 -1
- package/built/cli/scan/singleScan.js.map +0 -1
- package/built/cli/scan/watchScan.js.map +0 -1
- package/built/cli/scan.js.map +0 -1
- package/built/cli/scanArgs.js.map +0 -1
- package/built/cli/scanOptions.js.map +0 -1
- package/built/cli/updateCommitStatus.js.map +0 -1
- package/built/cli/upload/command.js.map +0 -1
- package/built/cli/upload/options.js.map +0 -1
- package/built/cli/upload.js.map +0 -1
- package/built/cli/validateFile.js.map +0 -1
- package/built/cli.js.map +0 -1
- package/built/configuration/configurationProvider.js.map +0 -1
- package/built/configuration/types/checkConfig.js.map +0 -1
- package/built/configuration/types/configuration.js.map +0 -1
- package/built/configuration/types/matchEventConfig.js.map +0 -1
- package/built/configuration/types/matchPatternConfig.js.map +0 -1
- package/built/database/index.js.map +0 -1
- package/built/database/visit.js.map +0 -1
- package/built/errors.js.map +0 -1
- package/built/eventUtil.js.map +0 -1
- package/built/findings.js.map +0 -1
- package/built/integration/appland/app/exists.js.map +0 -1
- package/built/integration/appland/app/listFindingStatus.js.map +0 -1
- package/built/integration/appland/appMap/create.js.map +0 -1
- package/built/integration/appland/location.js.map +0 -1
- package/built/integration/appland/mapset/create.js.map +0 -1
- package/built/integration/appland/retry.js.map +0 -1
- package/built/integration/appland/retryOptions.js.map +0 -1
- package/built/integration/appland/scannerJob/create.js.map +0 -1
- package/built/integration/appland/scannerJob/merge.js.map +0 -1
- package/built/integration/appland/scannerJob.js.map +0 -1
- package/built/integration/github/commitStatus.js.map +0 -1
- package/built/integration/vars.js.map +0 -1
- package/built/openapi/index.js.map +0 -1
- package/built/openapi/method.js +0 -120
- package/built/openapi/method.js.map +0 -1
- package/built/openapi/model.js +0 -49
- package/built/openapi/model.js.map +0 -1
- package/built/openapi/path.js +0 -36
- package/built/openapi/path.js.map +0 -1
- package/built/openapi/provider.js +0 -133
- package/built/openapi/provider.js.map +0 -1
- package/built/openapi/response.js +0 -59
- package/built/openapi/response.js.map +0 -1
- package/built/openapi/rpcRequest.js +0 -130
- package/built/openapi/rpcRequest.js.map +0 -1
- package/built/openapi/schema.js +0 -42
- package/built/openapi/schema.js.map +0 -1
- package/built/openapi/securitySchemes.js +0 -32
- package/built/openapi/securitySchemes.js.map +0 -1
- package/built/openapi/statusCodes.js +0 -68
- package/built/openapi/statusCodes.js.map +0 -1
- package/built/openapi/util.js +0 -91
- package/built/openapi/util.js.map +0 -1
- package/built/report/appMapMetadata.js.map +0 -1
- package/built/report/findingSummary.js.map +0 -1
- package/built/report/findingsReport.js.map +0 -1
- package/built/report/scanResults.js.map +0 -1
- package/built/report/scanSummary.js.map +0 -1
- package/built/report/summaryReport.js.map +0 -1
- package/built/ruleChecker.js.map +0 -1
- package/built/rules/authzBeforeAuthn.js.map +0 -1
- package/built/rules/circularDependency.js.map +0 -1
- package/built/rules/deserializationOfUntrustedData.js.map +0 -1
- package/built/rules/execOfUntrustedCommand.js.map +0 -1
- package/built/rules/http-500/metadata.js.map +0 -1
- package/built/rules/http-500/rule.js.map +0 -1
- package/built/rules/illegalPackageDependency.js.map +0 -1
- package/built/rules/incompatibleHttpClientRequest.js.map +0 -1
- package/built/rules/insecureCompare.js.map +0 -1
- package/built/rules/jobNotCancelled.js.map +0 -1
- package/built/rules/lib/hasParameterOrReceiver.js.map +0 -1
- package/built/rules/lib/matchEvent.js.map +0 -1
- package/built/rules/lib/matchPattern.js.map +0 -1
- package/built/rules/lib/metadata.js.map +0 -1
- package/built/rules/lib/parseRuleDescription.js.map +0 -1
- package/built/rules/lib/precedingEvents.js.map +0 -1
- package/built/rules/lib/rpcWithoutProtection.js.map +0 -1
- package/built/rules/lib/sanitizesData.js.map +0 -1
- package/built/rules/lib/util.js.map +0 -1
- package/built/rules/logoutWithoutSessionReset.js.map +0 -1
- package/built/rules/missingAuthentication.js.map +0 -1
- package/built/rules/missingContentType.js.map +0 -1
- package/built/rules/nPlusOneQuery.js.map +0 -1
- package/built/rules/queryFromInvalidPackage.js.map +0 -1
- package/built/rules/queryFromView.js.map +0 -1
- package/built/rules/rpcWithoutCircuitBreaker.js.map +0 -1
- package/built/rules/saveWithoutValidation.js.map +0 -1
- package/built/rules/secretInLog.js.map +0 -1
- package/built/rules/slowFunctionCall.js.map +0 -1
- package/built/rules/slowHttpServerRequest.js.map +0 -1
- package/built/rules/slowQuery.js.map +0 -1
- package/built/rules/tooManyJoins.js.map +0 -1
- package/built/rules/tooManyUpdates.js.map +0 -1
- package/built/rules/unbatchedMaterializedQuery.js.map +0 -1
- package/built/rules/updateInGetRequest.js.map +0 -1
- package/built/scope/commandScope.js.map +0 -1
- package/built/scope/httpClientRequestScope.js.map +0 -1
- package/built/scope/httpServerRequestScope.js.map +0 -1
- package/built/scope/rootScope.js.map +0 -1
- package/built/scope/scopeImpl.js.map +0 -1
- package/built/scope/scopeIterator.js.map +0 -1
- package/built/scope/sqlTransactionScope.js.map +0 -1
- package/built/sqlWarning.js.map +0 -1
- package/built/wellKnownLabels.js.map +0 -1
|
@@ -1,63 +1,37 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
-
var __read = (this && this.__read) || function (o, n) {
|
|
3
|
-
var m = typeof Symbol === "function" && o[Symbol.iterator];
|
|
4
|
-
if (!m) return o;
|
|
5
|
-
var i = m.call(o), r, ar = [], e;
|
|
6
|
-
try {
|
|
7
|
-
while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
|
|
8
|
-
}
|
|
9
|
-
catch (error) { e = { error: error }; }
|
|
10
|
-
finally {
|
|
11
|
-
try {
|
|
12
|
-
if (r && !r.done && (m = i["return"])) m.call(i);
|
|
13
|
-
}
|
|
14
|
-
finally { if (e) throw e.error; }
|
|
15
|
-
}
|
|
16
|
-
return ar;
|
|
17
|
-
};
|
|
18
|
-
var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
|
|
19
|
-
if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
|
|
20
|
-
if (ar || !(i in from)) {
|
|
21
|
-
if (!ar) ar = Array.prototype.slice.call(from, 0, i);
|
|
22
|
-
ar[i] = from[i];
|
|
23
|
-
}
|
|
24
|
-
}
|
|
25
|
-
return to.concat(ar || Array.prototype.slice.call(from));
|
|
26
|
-
};
|
|
27
2
|
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
28
3
|
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
29
4
|
};
|
|
30
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
6
|
+
const GraphEdge_1 = __importDefault(require("../algorithms/dataStructures/graph/GraphEdge"));
|
|
7
|
+
const GraphVertex_1 = __importDefault(require("../algorithms/dataStructures/graph/GraphVertex"));
|
|
8
|
+
const Graph_1 = __importDefault(require("../algorithms/dataStructures/graph/Graph"));
|
|
9
|
+
const detect_cycle_1 = __importDefault(require("../algorithms/graph/detect-cycle"));
|
|
10
|
+
const path_1 = require("path");
|
|
11
|
+
const util_1 = require("./lib/util");
|
|
12
|
+
const matchPattern_1 = require("./lib/matchPattern");
|
|
13
|
+
const url_1 = require("url");
|
|
14
|
+
const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
|
|
15
|
+
class Cycle {
|
|
16
|
+
constructor(packages, events) {
|
|
42
17
|
this.packages = packages;
|
|
43
18
|
this.events = events;
|
|
44
19
|
}
|
|
45
|
-
|
|
46
|
-
}());
|
|
20
|
+
}
|
|
47
21
|
function ignorePackage(event, ignoredPackages) {
|
|
48
|
-
|
|
22
|
+
const myPackage = event.codeObject.packageOf;
|
|
49
23
|
return (myPackage === '' ||
|
|
50
|
-
ignoredPackages.some(
|
|
24
|
+
ignoredPackages.some((filter) => filter(myPackage)) ||
|
|
51
25
|
!event.codeObject.location ||
|
|
52
26
|
(0, path_1.isAbsolute)(event.codeObject.location));
|
|
53
27
|
}
|
|
54
28
|
function detectCycles(root, ignoredPackages) {
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
29
|
+
const graph = new Graph_1.default(true);
|
|
30
|
+
const vertices = new Map();
|
|
31
|
+
const edges = new Set();
|
|
32
|
+
const vertexEvents = new Map();
|
|
33
|
+
const makeVertex = (pkg, event) => {
|
|
34
|
+
let result = vertices.get(pkg);
|
|
61
35
|
if (!result) {
|
|
62
36
|
result = new GraphVertex_1.default(pkg);
|
|
63
37
|
vertices.set(pkg, result);
|
|
@@ -68,18 +42,18 @@ function detectCycles(root, ignoredPackages) {
|
|
|
68
42
|
}
|
|
69
43
|
return result;
|
|
70
44
|
};
|
|
71
|
-
|
|
72
|
-
|
|
45
|
+
const collectEvent = (event, parentEvent, parentPackage) => {
|
|
46
|
+
let myPackage = event.codeObject.packageOf;
|
|
73
47
|
if (ignorePackage(event, ignoredPackages)) {
|
|
74
48
|
myPackage = null;
|
|
75
49
|
}
|
|
76
50
|
if (myPackage) {
|
|
77
|
-
|
|
51
|
+
const vertex = makeVertex(myPackage, event);
|
|
78
52
|
if (parentPackage && parentPackage !== myPackage) {
|
|
79
|
-
|
|
53
|
+
const edge = new GraphEdge_1.default(vertices.get(parentPackage), vertex);
|
|
80
54
|
if (!edges.has(edge.getKey())) {
|
|
81
55
|
if ((0, util_1.verbose)()) {
|
|
82
|
-
console.warn(
|
|
56
|
+
console.warn(`New edge: ${parentPackage}/${parentEvent} -> ${myPackage}/${event}`);
|
|
83
57
|
}
|
|
84
58
|
edges.add(edge.getKey());
|
|
85
59
|
graph.addEdge(edge);
|
|
@@ -87,14 +61,14 @@ function detectCycles(root, ignoredPackages) {
|
|
|
87
61
|
}
|
|
88
62
|
parentPackage = myPackage;
|
|
89
63
|
}
|
|
90
|
-
event.children.forEach(
|
|
64
|
+
event.children.forEach((child) => collectEvent(child, event, parentPackage));
|
|
91
65
|
};
|
|
92
66
|
if (root.codeObject.packageOf !== '') {
|
|
93
67
|
makeVertex(root.codeObject.packageOf, root);
|
|
94
68
|
}
|
|
95
69
|
collectEvent(root, null, null);
|
|
96
|
-
return (0, detect_cycle_1.default)(graph).map(
|
|
97
|
-
return new Cycle(cycle.map(
|
|
70
|
+
return (0, detect_cycle_1.default)(graph).map((cycle) => {
|
|
71
|
+
return new Cycle(cycle.map((vertex) => vertex.getKey()), vertexEvents);
|
|
98
72
|
});
|
|
99
73
|
}
|
|
100
74
|
/**
|
|
@@ -103,46 +77,42 @@ function detectCycles(root, ignoredPackages) {
|
|
|
103
77
|
|
|
104
78
|
* @returns Sequence of events whose package names match the cyclePath.
|
|
105
79
|
*/
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
if (cyclePathIndex === void 0) { cyclePathIndex = 0; }
|
|
109
|
-
if (path === void 0) { path = []; }
|
|
80
|
+
const searchForCycle = (cycle, ignoredPackages) => {
|
|
81
|
+
const traverseEvent = (event, recordEvent, cyclePath, cyclePathIndex = 0, path = []) => {
|
|
110
82
|
if (recordEvent) {
|
|
111
83
|
if ((0, util_1.verbose)()) {
|
|
112
|
-
console.warn(
|
|
84
|
+
console.warn(`${Array(path.length).fill('').join(' ')}push: ${event}`);
|
|
113
85
|
}
|
|
114
86
|
path.push(event);
|
|
115
87
|
}
|
|
116
88
|
else {
|
|
117
89
|
if ((0, util_1.verbose)()) {
|
|
118
|
-
console.warn(
|
|
90
|
+
console.warn(`${Array(path.length).fill('').join(' ')}traverse: ${event}`);
|
|
119
91
|
}
|
|
120
92
|
}
|
|
121
93
|
if (cyclePathIndex === cyclePath.length - 1) {
|
|
122
94
|
if ((0, util_1.verbose)()) {
|
|
123
|
-
console.warn(
|
|
95
|
+
console.warn(`${Array(path.length).fill('').join(' ')}result: ${path}`);
|
|
124
96
|
}
|
|
125
|
-
return
|
|
97
|
+
return [...path];
|
|
126
98
|
}
|
|
127
|
-
|
|
99
|
+
const myPackage = event.codeObject.packageOf;
|
|
128
100
|
if ((0, util_1.verbose)()) {
|
|
129
|
-
console.warn(event.children.map(
|
|
101
|
+
console.warn(event.children.map((child) => child.codeObject.fqid));
|
|
130
102
|
}
|
|
131
103
|
// Traverse children of ignored or same package
|
|
132
|
-
|
|
133
|
-
.filter(
|
|
134
|
-
.map(
|
|
104
|
+
let result = event.children
|
|
105
|
+
.filter((child) => child.codeObject.packageOf === myPackage || ignorePackage(child, ignoredPackages))
|
|
106
|
+
.map((child) => traverseEvent(child, false, cyclePath, cyclePathIndex, path))
|
|
135
107
|
.filter(Boolean);
|
|
136
108
|
// Traverse children of the next package in the graph
|
|
137
109
|
if (result.length === 0) {
|
|
138
110
|
result = event.children
|
|
139
|
-
.filter(
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
.map(function (child) { return traverseEvent(child, true, cyclePath, cyclePathIndex + 1, path); })
|
|
145
|
-
.filter(function (path) { return path; });
|
|
111
|
+
.filter((child) => child.codeObject.packageOf !== myPackage &&
|
|
112
|
+
!ignorePackage(child, ignoredPackages) &&
|
|
113
|
+
cyclePath[cyclePathIndex + 1] === child.codeObject.packageOf)
|
|
114
|
+
.map((child) => traverseEvent(child, true, cyclePath, cyclePathIndex + 1, path))
|
|
115
|
+
.filter((path) => path);
|
|
146
116
|
}
|
|
147
117
|
if (result.length > 0) {
|
|
148
118
|
return result[0];
|
|
@@ -150,17 +120,17 @@ var searchForCycle = function (cycle, ignoredPackages) {
|
|
|
150
120
|
else {
|
|
151
121
|
if (recordEvent) {
|
|
152
122
|
if ((0, util_1.verbose)()) {
|
|
153
|
-
console.warn(
|
|
123
|
+
console.warn(`${Array(path.length - 1)
|
|
154
124
|
.fill('')
|
|
155
|
-
.join(' ')
|
|
125
|
+
.join(' ')}pop`);
|
|
156
126
|
}
|
|
157
127
|
path.pop();
|
|
158
128
|
}
|
|
159
129
|
else {
|
|
160
130
|
if ((0, util_1.verbose)()) {
|
|
161
|
-
console.warn(
|
|
131
|
+
console.warn(`${Array(path.length - 1)
|
|
162
132
|
.fill('')
|
|
163
|
-
.join(' ')
|
|
133
|
+
.join(' ')}untraverse`);
|
|
164
134
|
}
|
|
165
135
|
}
|
|
166
136
|
return null;
|
|
@@ -168,20 +138,20 @@ var searchForCycle = function (cycle, ignoredPackages) {
|
|
|
168
138
|
};
|
|
169
139
|
// Look for a cycle starting at each package name. For each package name, consider the
|
|
170
140
|
// events that have that package.
|
|
171
|
-
for (
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
for (
|
|
141
|
+
for (let i = 0; i < cycle.packages.length; i++) {
|
|
142
|
+
const packageName = cycle.packages[i];
|
|
143
|
+
const startEvents = cycle.events.get(packageName);
|
|
144
|
+
const cyclePath = [];
|
|
145
|
+
for (let k = 0; k < cycle.packages.length; k++) {
|
|
176
146
|
cyclePath[k] = cycle.packages[(i + k) % cycle.packages.length];
|
|
177
147
|
}
|
|
178
148
|
cyclePath.push(packageName);
|
|
179
149
|
if ((0, util_1.verbose)()) {
|
|
180
|
-
console.warn(
|
|
150
|
+
console.warn(`Searching for event path for cycle ${cyclePath}`);
|
|
181
151
|
}
|
|
182
|
-
for (
|
|
183
|
-
|
|
184
|
-
|
|
152
|
+
for (let j = 0; j < startEvents.length; j++) {
|
|
153
|
+
const startEvent = startEvents[j];
|
|
154
|
+
const path = traverseEvent(startEvent, true, cyclePath);
|
|
185
155
|
if (path) {
|
|
186
156
|
return path;
|
|
187
157
|
}
|
|
@@ -189,39 +159,38 @@ var searchForCycle = function (cycle, ignoredPackages) {
|
|
|
189
159
|
}
|
|
190
160
|
return null;
|
|
191
161
|
};
|
|
192
|
-
|
|
193
|
-
|
|
162
|
+
class Options {
|
|
163
|
+
constructor() {
|
|
194
164
|
this.ignoredPackages = [];
|
|
195
165
|
this.depth = 4;
|
|
196
166
|
}
|
|
197
|
-
|
|
198
|
-
}());
|
|
167
|
+
}
|
|
199
168
|
function build(options) {
|
|
200
|
-
|
|
169
|
+
const ignoredPackages = (0, matchPattern_1.buildFilters)(options.ignoredPackages);
|
|
201
170
|
function matcher(event) {
|
|
202
171
|
return detectCycles(event, ignoredPackages)
|
|
203
|
-
.filter(
|
|
204
|
-
.map(
|
|
205
|
-
.filter(
|
|
206
|
-
.map(
|
|
172
|
+
.filter((cycle) => cycle.packages.length + 1 >= options.depth)
|
|
173
|
+
.map((cycle) => searchForCycle(cycle, ignoredPackages))
|
|
174
|
+
.filter((path) => path)
|
|
175
|
+
.map((path) => {
|
|
207
176
|
return {
|
|
208
177
|
event: path[0],
|
|
209
178
|
message: [
|
|
210
179
|
'Cycle in package dependency graph',
|
|
211
|
-
path.map(
|
|
180
|
+
path.map((event) => event.codeObject.packageOf).join(' -> '),
|
|
212
181
|
].join(': '),
|
|
213
182
|
relatedEvents: path,
|
|
214
183
|
};
|
|
215
184
|
});
|
|
216
185
|
}
|
|
217
186
|
return {
|
|
218
|
-
matcher
|
|
187
|
+
matcher,
|
|
219
188
|
};
|
|
220
189
|
}
|
|
221
190
|
exports.default = {
|
|
222
191
|
id: 'circular-dependency',
|
|
223
192
|
title: 'Circular package dependency',
|
|
224
|
-
Options
|
|
193
|
+
Options,
|
|
225
194
|
impactDomain: 'Maintainability',
|
|
226
195
|
references: {
|
|
227
196
|
'CWE-1047': new url_1.URL('https://cwe.mitre.org/data/definitions/1047.html'),
|
|
@@ -229,6 +198,5 @@ exports.default = {
|
|
|
229
198
|
enumerateScope: false,
|
|
230
199
|
description: (0, parseRuleDescription_1.default)('circularDependency'),
|
|
231
200
|
url: 'https://appland.com/docs/analysis/rules-reference.html#circular-dependency',
|
|
232
|
-
build
|
|
201
|
+
build,
|
|
233
202
|
};
|
|
234
|
-
//# sourceMappingURL=circularDependency.js.map
|
|
@@ -1,85 +1,52 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
-
var __values = (this && this.__values) || function(o) {
|
|
3
|
-
var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
|
|
4
|
-
if (m) return m.call(o);
|
|
5
|
-
if (o && typeof o.length === "number") return {
|
|
6
|
-
next: function () {
|
|
7
|
-
if (o && i >= o.length) o = void 0;
|
|
8
|
-
return { value: o && o[i++], done: !o };
|
|
9
|
-
}
|
|
10
|
-
};
|
|
11
|
-
throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
|
|
12
|
-
};
|
|
13
2
|
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
14
3
|
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
15
4
|
};
|
|
16
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
6
|
+
const models_1 = require("@appland/models");
|
|
7
|
+
const url_1 = require("url");
|
|
8
|
+
const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
|
|
9
|
+
const precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
|
|
10
|
+
const sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
|
|
22
11
|
function allArgumentsSanitized(rootEvent, event) {
|
|
23
12
|
return (event.parameters || [])
|
|
24
|
-
.filter(
|
|
25
|
-
.every(
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
var candidate = _c.value;
|
|
30
|
-
if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, DeserializeSanitize)) {
|
|
31
|
-
return true;
|
|
32
|
-
}
|
|
13
|
+
.filter((parameter) => parameter.object_id)
|
|
14
|
+
.every((parameter) => {
|
|
15
|
+
for (const candidate of (0, precedingEvents_1.default)(rootEvent, event)) {
|
|
16
|
+
if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, DeserializeSanitize)) {
|
|
17
|
+
return true;
|
|
33
18
|
}
|
|
34
19
|
}
|
|
35
|
-
catch (e_1_1) { e_1 = { error: e_1_1 }; }
|
|
36
|
-
finally {
|
|
37
|
-
try {
|
|
38
|
-
if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
|
|
39
|
-
}
|
|
40
|
-
finally { if (e_1) throw e_1.error; }
|
|
41
|
-
}
|
|
42
20
|
return false;
|
|
43
21
|
});
|
|
44
22
|
}
|
|
45
23
|
function build() {
|
|
46
24
|
function matcher(rootEvent) {
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
message: "".concat(event.event, " deserializes untrusted data"),
|
|
62
|
-
},
|
|
63
|
-
];
|
|
64
|
-
}
|
|
25
|
+
for (const event of new models_1.EventNavigator(rootEvent).descendants()) {
|
|
26
|
+
// events: //*[@authorization && truthy?(returnValue) && not(preceding::*[@authentication]) && not(descendant::*[@authentication])]
|
|
27
|
+
if (event.event.labels.has(DeserializeUnsafe) &&
|
|
28
|
+
!event.event.ancestors().find((ancestor) => ancestor.labels.has(DeserializeSafe))) {
|
|
29
|
+
if (allArgumentsSanitized(rootEvent, event.event)) {
|
|
30
|
+
return;
|
|
31
|
+
}
|
|
32
|
+
else {
|
|
33
|
+
return [
|
|
34
|
+
{
|
|
35
|
+
event: event.event,
|
|
36
|
+
message: `${event.event} deserializes untrusted data`,
|
|
37
|
+
},
|
|
38
|
+
];
|
|
65
39
|
}
|
|
66
40
|
}
|
|
67
41
|
}
|
|
68
|
-
catch (e_2_1) { e_2 = { error: e_2_1 }; }
|
|
69
|
-
finally {
|
|
70
|
-
try {
|
|
71
|
-
if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
|
|
72
|
-
}
|
|
73
|
-
finally { if (e_2) throw e_2.error; }
|
|
74
|
-
}
|
|
75
42
|
}
|
|
76
43
|
return {
|
|
77
|
-
matcher
|
|
44
|
+
matcher,
|
|
78
45
|
};
|
|
79
46
|
}
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
47
|
+
const DeserializeUnsafe = 'deserialize.unsafe';
|
|
48
|
+
const DeserializeSafe = 'deserialize.safe';
|
|
49
|
+
const DeserializeSanitize = 'deserialize.sanitize';
|
|
83
50
|
exports.default = {
|
|
84
51
|
id: 'deserialization-of-untrusted-data',
|
|
85
52
|
title: 'Deserialization of untrusted data',
|
|
@@ -92,6 +59,5 @@ exports.default = {
|
|
|
92
59
|
},
|
|
93
60
|
description: (0, parseRuleDescription_1.default)('deserializationOfUntrustedData'),
|
|
94
61
|
url: 'https://appland.com/docs/analysis/rules-reference.html#deserialization-of-untrusted-data',
|
|
95
|
-
build
|
|
62
|
+
build,
|
|
96
63
|
};
|
|
97
|
-
//# sourceMappingURL=deserializationOfUntrustedData.js.map
|
|
@@ -1,84 +1,51 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
-
var __values = (this && this.__values) || function(o) {
|
|
3
|
-
var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
|
|
4
|
-
if (m) return m.call(o);
|
|
5
|
-
if (o && typeof o.length === "number") return {
|
|
6
|
-
next: function () {
|
|
7
|
-
if (o && i >= o.length) o = void 0;
|
|
8
|
-
return { value: o && o[i++], done: !o };
|
|
9
|
-
}
|
|
10
|
-
};
|
|
11
|
-
throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
|
|
12
|
-
};
|
|
13
2
|
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
14
3
|
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
15
4
|
};
|
|
16
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
6
|
+
const models_1 = require("@appland/models");
|
|
7
|
+
const url_1 = require("url");
|
|
8
|
+
const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
|
|
9
|
+
const precedingEvents_1 = __importDefault(require("./lib/precedingEvents"));
|
|
10
|
+
const sanitizesData_1 = __importDefault(require("./lib/sanitizesData"));
|
|
22
11
|
function allArgumentsSanitized(rootEvent, event) {
|
|
23
12
|
return (event.parameters || [])
|
|
24
|
-
.filter(
|
|
25
|
-
.every(
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
var candidate = _c.value;
|
|
30
|
-
if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, ExecSanitize)) {
|
|
31
|
-
return true;
|
|
32
|
-
}
|
|
13
|
+
.filter((parameter) => parameter.object_id)
|
|
14
|
+
.every((parameter) => {
|
|
15
|
+
for (const candidate of (0, precedingEvents_1.default)(rootEvent, event)) {
|
|
16
|
+
if ((0, sanitizesData_1.default)(candidate.event, parameter.object_id, ExecSanitize)) {
|
|
17
|
+
return true;
|
|
33
18
|
}
|
|
34
19
|
}
|
|
35
|
-
catch (e_1_1) { e_1 = { error: e_1_1 }; }
|
|
36
|
-
finally {
|
|
37
|
-
try {
|
|
38
|
-
if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
|
|
39
|
-
}
|
|
40
|
-
finally { if (e_1) throw e_1.error; }
|
|
41
|
-
}
|
|
42
20
|
return false;
|
|
43
21
|
});
|
|
44
22
|
}
|
|
45
23
|
function build() {
|
|
46
24
|
function matcher(rootEvent) {
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
message: "".concat(event.event, " executes an untrusted command string"),
|
|
61
|
-
},
|
|
62
|
-
];
|
|
63
|
-
}
|
|
25
|
+
for (const event of new models_1.EventNavigator(rootEvent).descendants()) {
|
|
26
|
+
if (event.event.labels.has(Exec) &&
|
|
27
|
+
!event.event.ancestors().find((ancestor) => ancestor.labels.has(ExecSafe))) {
|
|
28
|
+
if (allArgumentsSanitized(rootEvent, event.event)) {
|
|
29
|
+
return;
|
|
30
|
+
}
|
|
31
|
+
else {
|
|
32
|
+
return [
|
|
33
|
+
{
|
|
34
|
+
event: event.event,
|
|
35
|
+
message: `${event.event} executes an untrusted command string`,
|
|
36
|
+
},
|
|
37
|
+
];
|
|
64
38
|
}
|
|
65
39
|
}
|
|
66
40
|
}
|
|
67
|
-
catch (e_2_1) { e_2 = { error: e_2_1 }; }
|
|
68
|
-
finally {
|
|
69
|
-
try {
|
|
70
|
-
if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
|
|
71
|
-
}
|
|
72
|
-
finally { if (e_2) throw e_2.error; }
|
|
73
|
-
}
|
|
74
41
|
}
|
|
75
42
|
return {
|
|
76
|
-
matcher
|
|
43
|
+
matcher,
|
|
77
44
|
};
|
|
78
45
|
}
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
46
|
+
const Exec = 'system.exec';
|
|
47
|
+
const ExecSafe = 'system.exec.safe';
|
|
48
|
+
const ExecSanitize = 'system.exec.sanitize';
|
|
82
49
|
exports.default = {
|
|
83
50
|
id: 'exec-of-untrusted-command',
|
|
84
51
|
title: 'Execution of untrusted system command',
|
|
@@ -90,6 +57,5 @@ exports.default = {
|
|
|
90
57
|
},
|
|
91
58
|
description: (0, parseRuleDescription_1.default)('execOfUntrustedCommand'),
|
|
92
59
|
url: 'https://appland.com/docs/analysis/rules-reference.html#exec-of-untrusted-command',
|
|
93
|
-
build
|
|
60
|
+
build,
|
|
94
61
|
};
|
|
95
|
-
//# sourceMappingURL=execOfUntrustedCommand.js.map
|
|
@@ -2,9 +2,8 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
function rule() {
|
|
4
4
|
return {
|
|
5
|
-
matcher:
|
|
6
|
-
where:
|
|
5
|
+
matcher: (e) => e.httpServerResponse.status === 500,
|
|
6
|
+
where: (e) => !!e.httpServerResponse,
|
|
7
7
|
};
|
|
8
8
|
}
|
|
9
9
|
exports.default = rule;
|
|
10
|
-
//# sourceMappingURL=rule.js.map
|
|
@@ -3,40 +3,39 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
|
3
3
|
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
4
|
};
|
|
5
5
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
6
|
+
const matchPattern_1 = require("./lib/matchPattern");
|
|
7
|
+
const url_1 = require("url");
|
|
8
|
+
const parseRuleDescription_1 = __importDefault(require("./lib/parseRuleDescription"));
|
|
9
|
+
class Options {
|
|
10
|
+
constructor() {
|
|
11
11
|
this.callerPackages = [];
|
|
12
12
|
this.calleePackage = {};
|
|
13
13
|
}
|
|
14
|
-
|
|
15
|
-
}());
|
|
14
|
+
}
|
|
16
15
|
function build(options) {
|
|
17
|
-
|
|
18
|
-
|
|
16
|
+
const callerPatterns = (0, matchPattern_1.buildFilters)(options.callerPackages || []);
|
|
17
|
+
const calleePattern = (0, matchPattern_1.buildFilter)(options.calleePackage);
|
|
19
18
|
function where(e) {
|
|
20
19
|
return !!e.parent && !!e.parent.codeObject.packageOf && calleePattern(e.codeObject.packageOf);
|
|
21
20
|
}
|
|
22
21
|
function matcher(e) {
|
|
23
|
-
|
|
24
|
-
.map(
|
|
22
|
+
const packageNamesStr = options.callerPackages
|
|
23
|
+
.map((config) => config.equal || config.include || config.match)
|
|
25
24
|
.map(String)
|
|
26
25
|
.join(' or ');
|
|
27
|
-
|
|
26
|
+
const parentPackage = e.parent.codeObject.packageOf;
|
|
28
27
|
if (!(e.codeObject.packageOf === parentPackage ||
|
|
29
|
-
callerPatterns.some(
|
|
28
|
+
callerPatterns.some((pattern) => pattern(parentPackage)))) {
|
|
30
29
|
return [
|
|
31
30
|
{
|
|
32
31
|
event: e,
|
|
33
|
-
message:
|
|
32
|
+
message: `Code object ${e.codeObject.id} was invoked from ${parentPackage}, not from ${packageNamesStr}`,
|
|
34
33
|
relatedEvents: [e.parent],
|
|
35
34
|
},
|
|
36
35
|
];
|
|
37
36
|
}
|
|
38
37
|
}
|
|
39
|
-
return { where
|
|
38
|
+
return { where, matcher };
|
|
40
39
|
}
|
|
41
40
|
exports.default = {
|
|
42
41
|
id: 'illegal-package-dependency',
|
|
@@ -51,7 +50,6 @@ exports.default = {
|
|
|
51
50
|
},
|
|
52
51
|
description: (0, parseRuleDescription_1.default)('illegalPackageDependency'),
|
|
53
52
|
url: 'https://appland.com/docs/analysis/rules-reference.html#illegal-package-dependency',
|
|
54
|
-
Options
|
|
55
|
-
build
|
|
53
|
+
Options,
|
|
54
|
+
build,
|
|
56
55
|
};
|
|
57
|
-
//# sourceMappingURL=illegalPackageDependency.js.map
|