@birdapi/velinstyle 1.2.1 → 1.3.0

package/core/security/rules/consumer/index.js

@@ -0,0 +1,174 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+export function registerConsumerRules() {
+  registerSecurityRule({
+    id: 'consumer.velinstyle-installed',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'audit', 'scan'],
+    title: 'VelinStyle installed',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (pkg.name === '@birdapi/velinstyle') return [];
+      const dep = pkg.dependencies?.['@birdapi/velinstyle'] || pkg.devDependencies?.['@birdapi/velinstyle'];
+      const vendor =
+        fileExists(join(ctx.root, 'vendor', 'velinstyle.min.css'))
+        || fileExists(join(ctx.root, 'vendor', 'velinstyle', 'velinstyle.min.css'));
+      if (dep || vendor) return [];
+      return [{
+        ruleId: 'consumer.velinstyle-installed',
+        category: 'consumer',
+        severity: 'warning',
+        message: '@birdapi/velinstyle not found in package.json or vendor/',
+        fix: 'npm i @birdapi/velinstyle or copy dist to vendor/',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.version-floor',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'audit'],
+    title: 'Minimum recommended version',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (pkg.name === '@birdapi/velinstyle') return [];
+      const raw = pkg.dependencies?.['@birdapi/velinstyle'] || pkg.devDependencies?.['@birdapi/velinstyle'];
+      if (!raw) return [];
+      const m = String(raw).match(/(\d+)\.(\d+)\.(\d+)/);
+      if (!m) return [];
+      const [maj, min, pat] = m.slice(1).map(Number);
+      const tooOld = maj < 1 || (maj === 1 && min < 2) || (maj === 1 && min === 2 && pat < 2);
+      if (!tooOld) return [];
+      return [{
+        ruleId: 'consumer.version-floor',
+        category: 'consumer',
+        severity: 'warning',
+        message: `VelinStyle ${raw} is below recommended 1.2.2+`,
+        code: 'outdated',
+        fix: 'Upgrade to @birdapi/velinstyle@^1.2.2',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.noopener',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'scan', 'audit'],
+    title: 'target=_blank noopener',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.html?$/i.test(n), 80);
+      const findings = [];
+      for (const abs of files) {
+        const t = readText(abs) || '';
+        const re = /target=["']_blank["'](?![^>]*rel=["'][^"']*noopener)/gi;
+        if (re.test(t)) {
+          findings.push({
+            ruleId: 'consumer.noopener',
+            category: 'consumer',
+            severity: 'warning',
+            message: 'target="_blank" without rel="noopener noreferrer"',
+            path: rel(ctx.root, abs),
+            fix: 'Add rel="noopener noreferrer"',
+          });
+        }
+      }
+      return findings.slice(0, 20);
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.inline-script',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'scan', 'audit'],
+    title: 'Inline scripts',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.html?$/i.test(n), 80);
+      const findings = [];
+      for (const abs of files) {
+        const t = readText(abs) || '';
+        if (/<script(?![^>]*\bsrc=)[^>]*>\s*[^<\s]/i.test(t)) {
+          findings.push({
+            ruleId: 'consumer.inline-script',
+            category: 'consumer',
+            severity: 'warning',
+            message: 'Inline <script> increases XSS surface',
+            path: rel(ctx.root, abs),
+            fix: 'Move to external module',
+          });
+        }
+      }
+      return findings.slice(0, 15);
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.csp-meta',
+    category: 'consumer',
+    severity: 'info',
+    modes: ['consumer', 'scan', 'audit'],
+    title: 'CSP meta',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.html?$/i.test(n), 40);
+      if (!files.length) return [];
+      const any = files.some((abs) => /Content-Security-Policy/i.test(readText(abs) || ''));
+      if (any) return [];
+      return [{
+        ruleId: 'consumer.csp-meta',
+        category: 'consumer',
+        severity: 'info',
+        message: 'No CSP meta found in scanned HTML',
+        fix: 'Add Content-Security-Policy header or meta',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.app-debug',
+    category: 'consumer',
+    severity: 'warning',
+    modes: ['consumer', 'audit', 'scan'],
+    title: 'Debug flags',
+    run(ctx) {
+      const findings = [];
+      for (const name of ['.env', '.env.example', 'config/app.php', 'velinstyle.config.js']) {
+        const t = readText(join(ctx.root, name));
+        if (t && /APP_DEBUG\s*=\s*true|debug\s*:\s*true/i.test(t)) {
+          findings.push({
+            ruleId: 'consumer.app-debug',
+            category: 'consumer',
+            severity: 'warning',
+            message: `Debug flag enabled in ${name}`,
+            path: name,
+            fix: 'Disable debug in production',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'consumer.source-maps',
+    category: 'consumer',
+    severity: 'info',
+    modes: ['consumer', 'audit'],
+    title: 'Public source maps',
+    run(ctx) {
+      const maps = walkFiles(join(ctx.root, 'dist'), (n) => n.endsWith('.map'), 30);
+      if (!maps.length) return [];
+      return [{
+        ruleId: 'consumer.source-maps',
+        category: 'consumer',
+        severity: 'info',
+        message: `${maps.length} source map(s) under dist/ — ensure intentional for production`,
+        path: 'dist/',
+      }];
+    },
+  });
+}

package/core/security/rules/deps/index.js

@@ -0,0 +1,182 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+const KNOWN_POPULAR = [
+  'react', 'vue', 'lodash', 'express', 'webpack', 'typescript', 'eslint', 'vite',
+  'next', 'axios', 'jquery', 'moment', 'chalk', 'commander',
+];
+
+function levenshtein(a, b) {
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      dp[i][j] = Math.min(
+        dp[i - 1][j] + 1,
+        dp[i][j - 1] + 1,
+        dp[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1),
+      );
+    }
+  }
+  return dp[m][n];
+}
+
+export function registerDepsRules() {
+  registerSecurityRule({
+    id: 'deps.lockfile',
+    category: 'deps',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit', 'publish'],
+    title: 'Lockfile present',
+    run(ctx) {
+      const ok =
+        fileExists(join(ctx.root, 'package-lock.json'))
+        || fileExists(join(ctx.root, 'pnpm-lock.yaml'))
+        || fileExists(join(ctx.root, 'yarn.lock'));
+      if (ok) return [];
+      return [{
+        ruleId: 'deps.lockfile',
+        category: 'deps',
+        severity: 'warning',
+        message: 'No lockfile found (package-lock / pnpm-lock / yarn.lock)',
+        code: 'no-lockfile',
+        fix: 'Commit a lockfile for reproducible installs',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.lifecycle-hooks',
+    category: 'malware',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit', 'publish', 'malware'],
+    title: 'Risky lifecycle scripts',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (!pkg?.scripts) return [];
+      const findings = [];
+      for (const hook of ['preinstall', 'install', 'postinstall', 'prepublish']) {
+        const s = pkg.scripts[hook];
+        if (!s) continue;
+        if (/curl\s|wget\s|Invoke-WebRequest|fetch\(['"]https?:/i.test(s)) {
+          findings.push({
+            ruleId: 'deps.lifecycle-hooks',
+            category: 'malware',
+            severity: 'error',
+            message: `Lifecycle script "${hook}" downloads remote content`,
+            path: 'package.json',
+            code: 'critical',
+            fix: 'Remove network installs from lifecycle hooks',
+          });
+        } else if (/node\s|npx\s|bash\s|sh\s/i.test(s)) {
+          findings.push({
+            ruleId: 'deps.lifecycle-hooks',
+            category: 'malware',
+            severity: 'info',
+            message: `Lifecycle script "${hook}" runs shell/node — review carefully`,
+            path: 'package.json',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.engines',
+    category: 'deps',
+    severity: 'info',
+    modes: ['repo', 'consumer', 'deps', 'audit'],
+    title: 'Node engines field',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (pkg?.engines?.node) return [];
+      return [{
+        ruleId: 'deps.engines',
+        category: 'deps',
+        severity: 'info',
+        message: 'package.json missing engines.node',
+        path: 'package.json',
+        fix: 'Declare supported Node versions',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.license-field',
+    category: 'deps',
+    severity: 'warning',
+    modes: ['repo', 'deps', 'audit', 'publish'],
+    title: 'License field',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (pkg?.license) return [];
+      return [{
+        ruleId: 'deps.license-field',
+        category: 'deps',
+        severity: 'warning',
+        message: 'package.json missing license field',
+        path: 'package.json',
+        code: 'deprecated',
+        fix: 'Set license (e.g. MIT)',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.typosquat',
+    category: 'malware',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit', 'malware'],
+    title: 'Typosquat heuristic',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      const names = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+      const findings = [];
+      for (const name of names) {
+        const base = name.includes('/') ? name.split('/').pop() : name;
+        for (const pop of KNOWN_POPULAR) {
+          const d = levenshtein(base.toLowerCase(), pop);
+          if (d === 1 && base.toLowerCase() !== pop) {
+            findings.push({
+              ruleId: 'deps.typosquat',
+              category: 'malware',
+              severity: 'warning',
+              message: `Package "${name}" is 1 edit from popular "${pop}" — verify intentional`,
+              path: 'package.json',
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'deps.deprecated-request',
+    category: 'deps',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'deps', 'audit'],
+    title: 'Known deprecated packages',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      const names = Object.keys({ ...pkg?.dependencies, ...pkg?.devDependencies });
+      const deprecated = ['request', 'node-uuid', 'crypto', 'gulp-util'];
+      return names
+        .filter((n) => deprecated.includes(n))
+        .map((n) => ({
+          ruleId: 'deps.deprecated-request',
+          category: 'deps',
+          severity: 'warning',
+          message: `Dependency "${n}" is widely considered deprecated`,
+          path: 'package.json',
+          code: 'deprecated',
+          fix: 'Replace with maintained alternative',
+        }));
+    },
+  });
+}

package/core/security/rules/index.js

@@ -0,0 +1,24 @@
+import { registerSecretsRules } from './secrets/index.js';
+import { registerDepsRules } from './deps/index.js';
+import { registerCiRules } from './ci/index.js';
+import { registerPublishRules } from './publish/index.js';
+import { registerRepoRules } from './repo/index.js';
+import { registerConsumerRules } from './consumer/index.js';
+
+let loaded = false;
+
+/** Idempotent: register all built-in Security Engine rules. */
+export function loadBuiltinSecurityRules() {
+  if (loaded) return;
+  registerSecretsRules();
+  registerDepsRules();
+  registerCiRules();
+  registerPublishRules();
+  registerRepoRules();
+  registerConsumerRules();
+  loaded = true;
+}
+
+export function resetBuiltinSecurityRulesFlag() {
+  loaded = false;
+}

package/core/security/rules/publish/index.js

@@ -0,0 +1,230 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText } from '../../checks/fs.js';
+import { join } from 'path';
+import { execSync } from 'child_process';
+
+export function registerPublishRules() {
+  registerSecurityRule({
+    id: 'publish.readme',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'README',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'README.md'))) return [];
+      return [{
+        ruleId: 'publish.readme',
+        category: 'publish',
+        severity: 'error',
+        message: 'README.md missing',
+        path: 'README.md',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.changelog',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'CHANGELOG',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'CHANGELOG.md'))) return [];
+      return [{
+        ruleId: 'publish.changelog',
+        category: 'publish',
+        severity: 'error',
+        message: 'CHANGELOG.md missing',
+        path: 'CHANGELOG.md',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.security-md',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'SECURITY.md',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'SECURITY.md'))) return [];
+      return [{
+        ruleId: 'publish.security-md',
+        category: 'publish',
+        severity: 'error',
+        message: 'SECURITY.md missing',
+        path: 'SECURITY.md',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.license',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'LICENSE',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (fileExists(join(ctx.root, 'LICENSE')) || fileExists(join(ctx.root, 'LICENSE.md')) || pkg.license) {
+        return [];
+      }
+      return [{
+        ruleId: 'publish.license',
+        category: 'publish',
+        severity: 'error',
+        message: 'LICENSE file / package.json license missing',
+        path: 'LICENSE',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.release-notes',
+    category: 'publish',
+    severity: 'warning',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Release notes',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      const v = pkg.version;
+      if (!v) return [];
+      const notes = fileExists(join(ctx.root, `RELEASE_NOTES_${v}.md`));
+      const cl = readText(join(ctx.root, 'CHANGELOG.md')) || '';
+      if (notes || cl.includes(`[${v}]`)) return [];
+      return [{
+        ruleId: 'publish.release-notes',
+        category: 'publish',
+        severity: 'warning',
+        message: `No RELEASE_NOTES_${v}.md and no CHANGELOG entry for [${v}]`,
+        fix: 'Add release notes before publish',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.version-tag',
+    category: 'publish',
+    severity: 'warning',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Git tag matches version',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      const v = pkg.version;
+      if (!v) return [];
+      try {
+        const tag = execSync(`git tag -l "v${v}"`, { cwd: ctx.root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (tag) return [];
+        return [{
+          ruleId: 'publish.version-tag',
+          category: 'publish',
+          severity: 'warning',
+          message: `Git tag v${v} not found yet`,
+          fix: `Create annotated tag v${v} before npm publish from CI`,
+        }];
+      } catch {
+        return [];
+      }
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.clean-tree',
+    category: 'publish',
+    severity: 'warning',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Working tree clean',
+    run(ctx) {
+      try {
+        const dirty = execSync('git status --porcelain', { cwd: ctx.root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (!dirty) return [];
+        return [{
+          ruleId: 'publish.clean-tree',
+          category: 'publish',
+          severity: 'warning',
+          message: 'Working tree has uncommitted changes',
+          fix: 'Commit or stash before release',
+        }];
+      } catch {
+        return [];
+      }
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.private-flag',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Not private',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (pkg.private === true) {
+        return [{
+          ruleId: 'publish.private-flag',
+          category: 'publish',
+          severity: 'error',
+          message: 'package.json has "private": true — npm publish will fail',
+          path: 'package.json',
+        }];
+      }
+      return [];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.pack-dry-run',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'npm pack dry-run',
+    run(ctx) {
+      if (!fileExists(join(ctx.root, 'package.json'))) {
+        return [{
+          ruleId: 'publish.pack-dry-run',
+          category: 'publish',
+          severity: 'warning',
+          message: 'package.json missing — cannot run npm pack --dry-run',
+          path: 'package.json',
+        }];
+      }
+      try {
+        execSync('npm pack --dry-run', {
+          cwd: ctx.root,
+          encoding: 'utf-8',
+          timeout: 30_000,
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        return [];
+      } catch (err) {
+        const status = err?.status;
+        const stderr = String(err?.stderr || err?.message || '').trim().slice(0, 400);
+        if (err?.code === 'ENOENT') {
+          return [{
+            ruleId: 'publish.pack-dry-run',
+            category: 'publish',
+            severity: 'warning',
+            message: 'npm not available — skipped pack dry-run',
+            fix: 'Install npm or run pack dry-run on a machine with Node/npm',
+          }];
+        }
+        if (err?.killed || err?.signal === 'SIGTERM' || /ETIMEDOUT|timed out/i.test(String(err?.message))) {
+          return [{
+            ruleId: 'publish.pack-dry-run',
+            category: 'publish',
+            severity: 'warning',
+            message: 'npm pack --dry-run timed out',
+            fix: 'Retry with network available or inspect package files locally',
+          }];
+        }
+        return [{
+          ruleId: 'publish.pack-dry-run',
+          category: 'publish',
+          severity: status ? 'error' : 'warning',
+          message: `npm pack --dry-run failed${status != null ? ` (exit ${status})` : ''}${stderr ? `: ${stderr}` : ''}`,
+          fix: 'Fix pack errors (files, package.json) before publish',
+        }];
+      }
+    },
+  });
+}