@catladder/cli 1.135.0 → 1.136.0

package/dist/apps/catci/commands/security/topics.json

@@ -0,0 +1,112 @@
+[
+    {
+        "description": "No API keys or secrets are stored in repository",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "The app does not provide password login",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "Passwords are not stored",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "Passwords are stored hashed with salt and salt is not stored in the repository",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/hash.md)"
+    },
+    {
+        "description": "Input that ends up in DOM is properly sanitized",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/xss.md)"
+    },
+    {
+        "description": "All user inputs have reasonable validations",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/validation.md)"
+    },
+    {
+        "description": "The app is not using cookies",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
+    },
+    {
+        "description": "The app is using cookies and cookies are properly configured",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
+    },
+    {
+        "description": "The app uses JWT with a secret and the secret is not stored in the repository",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cookies.md)"
+    },
+    {
+        "description": "Authorization and user roles (RBAC) were reviewed thoroughly",
+        "responsibles": 2,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/authorization.md)"
+    },
+    {
+        "description": "CORS headers do not use `*`",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/cors.md)"
+    },
+    {
+        "description": "CSP headers are properly configured (no `unsafe-inline` or `unsafe-eval`)",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/csp.md)"
+    },
+    {
+        "description": "DoS defense mechanism is implemented",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/dos.md)"
+    },
+    {
+        "description": "YAML/XML parsing is not used or used YAML/XML parsers have disabled DTD",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/dos.md)"
+    },
+    {
+        "description": "The app implements CSRF prevention",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/csrf.md)"
+    },
+    {
+        "description": "The app has a rate limitter",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "The app has disabled GraphQL introspection and schema registry",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/graphql.md)"
+    },
+    {
+        "description": "The app has set GraphQL complexity query limits",
+        "responsibles": 1,
+        "more": "[guide](https://git.panter.ch/panter/security-guide/-/blob/main/docs/audit/graphql.md)"
+    },
+    {
+        "description": "`sitemap.xml` does not leak any routes with sensitive data",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "Cloud storage is (private) configured to not leak any sensitive data publicly",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "Security Dashboard checks weekly vulnerable dependencies https://dep.panter.swiss/",
+        "responsibles": 1,
+        "more": ""
+    },
+    {
+        "description": "The app has `.well-known/security.txt` https://securitytxt.org/",
+        "responsibles": 1,
+        "more": ""
+    }
+]

package/dist/apps/cli/commands/project/commandSecurityEvaluate.d.ts

@@ -0,0 +1,3 @@
+import type Vorpal from "vorpal";
+declare const _default: (vorpal: Vorpal) => Promise<void>;
+export default _default;

package/dist/apps/cli/commands/project/commandSecurityEvaluate.js

@@ -0,0 +1,70 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+exports.__esModule = true;
+var evaluateSecurityAudit_1 = require("../../../catci/commands/security/evaluateSecurityAudit");
+var projects_1 = require("../../../../utils/projects");
+exports["default"] = (function (vorpal) { return __awaiter(void 0, void 0, void 0, function () {
+    return __generator(this, function (_a) {
+        vorpal
+            .command("project-security-evaluate", "evaluate project's security audit document")
+            .action(function () {
+            return __awaiter(this, void 0, void 0, function () {
+                var gitRoot, result;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0: return [4 /*yield*/, (0, projects_1.getGitRoot)()];
+                        case 1:
+                            gitRoot = _a.sent();
+                            return [4 /*yield*/, (0, evaluateSecurityAudit_1.evaluateSecurityAudit)({ path: gitRoot })];
+                        case 2:
+                            result = _a.sent();
+                            if (result.isErr()) {
+                                console.error("Could not evaluate security audit document:", result.error);
+                            }
+                            else {
+                                console.log((0, evaluateSecurityAudit_1.makeSecurityAuditOverview)(result.value));
+                            }
+                            return [2 /*return*/];
+                    }
+                });
+            });
+        });
+        return [2 /*return*/];
+    });
+}); });
+//# sourceMappingURL=commandSecurityEvaluate.js.map

package/dist/apps/cli/commands/project/commandSecurityEvaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecurityEvaluate.js","sourceRoot":"","sources":["../../../../../src/apps/cli/commands/project/commandSecurityEvaluate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gGAGgE;AAChE,uDAAwD;AAExD,sBAAe,UAAO,MAAc;;QAClC,MAAM;aACH,OAAO,CACN,2BAA2B,EAC3B,4CAA4C,CAC7C;aACA,MAAM,CAAC;;;;;gCACU,qBAAM,IAAA,qBAAU,GAAE,EAAA;;4BAA5B,OAAO,GAAG,SAAkB;4BACnB,qBAAM,IAAA,6CAAqB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAA;;4BAAvD,MAAM,GAAG,SAA8C;4BAC7D,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE;gCAClB,OAAO,CAAC,KAAK,CACX,6CAA6C,EAC7C,MAAM,CAAC,KAAK,CACb,CAAC;6BACH;iCAAM;gCACL,OAAO,CAAC,GAAG,CAAC,IAAA,iDAAyB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;6BACtD;;;;;SACF,CAAC,CAAC;;;KACN,EAAC"}

package/dist/apps/cli/commands/project/index.js

@@ -64,6 +64,7 @@ var commandTriggerCronjob_1 = __importDefault(require("./commandTriggerCronjob")
 var commandOpenGrafanaPod_1 = __importDefault(require("./commandOpenGrafanaPod"));
 var commandSecretsClearBackups_1 = __importDefault(require("./commandSecretsClearBackups"));
 var commandProjectRestoreDb_1 = __importDefault(require("./cloudSql/commandProjectRestoreDb"));
+var commandSecurityEvaluate_1 = __importDefault(require("./commandSecurityEvaluate"));
 exports["default"] = (function (vorpal) { return __awaiter(void 0, void 0, void 0, function () {
     return __generator(this, function (_a) {
         (0, commandSetup_1["default"])(vorpal);
@@ -90,6 +91,7 @@ exports["default"] = (function (vorpal) { return __awaiter(void 0, void 0, void
         (0, commandGitlabCi_1["default"])(vorpal);
         (0, commandGetMyTotalWorktime_1["default"])(vorpal);
         (0, commandMigrateHelm3_1["default"])(vorpal);
+        (0, commandSecurityEvaluate_1["default"])(vorpal);
         return [2 /*return*/];
     });
 }); });

package/dist/apps/cli/commands/project/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/apps/cli/commands/project/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gFAA0D;AAC1D,gFAA0D;AAE1D,0EAAoD;AACpD,gFAA0D;AAC1D,oEAA8C;AAC9C,0FAAoE;AACpE,sEAAgD;AAChD,sEAAgD;AAChD,gEAA0C;AAC1C,4DAA4D;AAC5D,sEAAgD;AAChD,8EAAwD;AACxD,wEAAkD;AAClD,wFAAkE;AAClE,gFAA0D;AAC1D,oEAA8C;AAC9C,oEAA8C;AAC9C,sEAAgD;AAChD,8EAAwD;AACxD,4EAAsD;AACtD,4EAAsD;AACtD,kFAA4D;AAE5D,kFAA4D;AAC5D,4FAAsE;AACtE,+FAAyE;AAEzE,sBAAe,UAAO,MAAc;;QAClC,IAAA,yBAAY,EAAC,MAAM,CAAC,CAAC;QAErB,IAAA,2BAAc,EAAC,MAAM,CAAC,CAAC;QAEvB,IAAA,6BAAgB,EAAC,MAAM,CAAC,CAAC;QACzB,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QACxB,IAAA,gCAAmB,EAAC,MAAM,CAAC,CAAC;QAC5B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAE7B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAE7B,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QAExB,IAAA,qCAAwB,EAAC,MAAM,CAAC,CAAC;QAEjC,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;QAC3B,IAAA,kCAAqB,EAAC,MAAM,CAAC,CAAC;QAC9B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAC7B,IAAA,oCAAuB,EAAC,MAAM,CAAC,CAAC;QAChC,IAAA,2BAAc,EAAC,MAAM,CAAC,CAAC;QACvB,IAAA,2BAAc,EAAC,MAAM,CAAC,CAAC;QACvB,IAAA,kCAAqB,EAAC,MAAM,CAAC,CAAC;QAC9B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAC7B,IAAA,uCAA0B,EAAC,MAAM,CAAC,CAAC;QACnC,IAAA,8BAAiB,EAAC,MAAM,CAAC,CAAC;QAE1B,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QACxB,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;QAE3B,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QAExB,IAAA,sCAAyB,EAAC,MAAM,CAAC,CAAC;QAClC,IAAA,gCAAmB,EAAC,MAAM,CAAC,CAAC;;;KAC7B,EAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/apps/cli/commands/project/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gFAA0D;AAC1D,gFAA0D;AAE1D,0EAAoD;AACpD,gFAA0D;AAC1D,oEAA8C;AAC9C,0FAAoE;AACpE,sEAAgD;AAChD,sEAAgD;AAChD,gEAA0C;AAC1C,4DAA4D;AAC5D,sEAAgD;AAChD,8EAAwD;AACxD,wEAAkD;AAClD,wFAAkE;AAClE,gFAA0D;AAC1D,oEAA8C;AAC9C,oEAA8C;AAC9C,sEAAgD;AAChD,8EAAwD;AACxD,4EAAsD;AACtD,4EAAsD;AACtD,kFAA4D;AAE5D,kFAA4D;AAC5D,4FAAsE;AACtE,+FAAyE;AACzE,sFAAgE;AAEhE,sBAAe,UAAO,MAAc;;QAClC,IAAA,yBAAY,EAAC,MAAM,CAAC,CAAC;QAErB,IAAA,2BAAc,EAAC,MAAM,CAAC,CAAC;QAEvB,IAAA,6BAAgB,EAAC,MAAM,CAAC,CAAC;QACzB,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QACxB,IAAA,gCAAmB,EAAC,MAAM,CAAC,CAAC;QAC5B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAE7B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAE7B,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QAExB,IAAA,qCAAwB,EAAC,MAAM,CAAC,CAAC;QAEjC,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;QAC3B,IAAA,kCAAqB,EAAC,MAAM,CAAC,CAAC;QAC9B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAC7B,IAAA,oCAAuB,EAAC,MAAM,CAAC,CAAC;QAChC,IAAA,2BAAc,EAAC,MAAM,CAAC,CAAC;QACvB,IAAA,2BAAc,EAAC,MAAM,CAAC,CAAC;QACvB,IAAA,kCAAqB,EAAC,MAAM,CAAC,CAAC;QAC9B,IAAA,iCAAoB,EAAC,MAAM,CAAC,CAAC;QAC7B,IAAA,uCAA0B,EAAC,MAAM,CAAC,CAAC;QACnC,IAAA,8BAAiB,EAAC,MAAM,CAAC,CAAC;QAE1B,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QACxB,IAAA,+BAAkB,EAAC,MAAM,CAAC,CAAC;QAE3B,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;QAExB,IAAA,sCAAyB,EAAC,MAAM,CAAC,CAAC;QAClC,IAAA,gCAAmB,EAAC,MAAM,CAAC,CAAC;QAC5B,IAAA,oCAAuB,EAAC,MAAM,CAAC,CAAC;;;KACjC,EAAC"}