@clear-capabilities/agentic-security-scanner 0.145.0 → 0.147.0

package/src/ir/chrome-probe.mjs

@@ -0,0 +1,150 @@
+// chrome-probe.mjs — Milestone 4, sub-project PNG/SVG/PDF export.
+//
+// Chrome/Chromium binary discovery, mirroring parser-py-cst.js's own
+// already-proven probePythonAvailable() pattern exactly — this
+// codebase's established convention for "optional local tool, detect
+// and degrade gracefully" (see that file's own header comment for the
+// full rationale this file inherits without repeating).
+
+import * as cp from 'node:child_process';
+import * as fs from 'node:fs';
+
+let _capability = null;
+
+// A malformed env var (e.g. AGENTIC_SECURITY_CHROME_PROBE_TIMEOUT_MS=oops)
+// must fall back to the default, never reach spawnSync as NaN — found by
+// the final whole-branch review: `Number('oops')` is NaN, and NaN as a
+// spawnSync `timeout` option throws ERR_OUT_OF_RANGE synchronously.
+// _tryBinary's own try/catch swallows that throw and returns null for
+// EVERY candidate, so probeChromeAvailable would misreport
+// `no-chrome-found` on a machine with a perfectly working Chrome install.
+//
+// Blank/whitespace-only is treated as unset (falls back), not as `0` —
+// found by this fix's own scoped re-review: `Number('')` is `0`, and a
+// naive `n >= 0` guard let an empty-but-exported env var (a blanked
+// .env line, an unset-but-exported CI var) through as a real `timeout:
+// 0`, which spawnSync treats as NO timeout at all — an unbounded hang
+// risk inside this exact capability probe, the failure class
+// parser-py-cst.js's own probePythonAvailable() is already careful
+// about. An explicit `"0"` is still honored (matches this file's
+// pre-fix behavior for that literal value).
+//
+// Must be a safe INTEGER, not merely finite — found by a second scoped
+// re-review, reproduced live: `Number.isFinite(1.5)` is true, so a
+// fractional env var (e.g. "1.5") passed this guard unchanged and then
+// hit spawnSync's own `timeout` option, which throws ERR_OUT_OF_RANGE
+// for any non-integer — the exact class of uncaught throw this whole
+// function exists to prevent, just for a different malformed input
+// than the original NaN case. `-0` is rejected too (Object.is check):
+// it is a safe integer and `-0 >= 0`, so without the explicit check it
+// would silently mean "no timeout", one character away from the "0"
+// this function deliberately allows.
+// Exported test-only — the outcome-based integration tests (a real
+// probe/export succeeding or not) can't distinguish `timeout: 0` from
+// `timeout: <default>` when the underlying command finishes quickly
+// either way, so a direct table of this function's own input/output
+// pairs is the only thing that actually pins the "0"-vs-default
+// boundary — found by a third scoped re-review: the blank-env-var
+// integration test below passed even with the round-2 blank-handling
+// bug fully reintroduced, for exactly this reason.
+export function _validTimeoutMs(raw, fallback) {
+  const s = String(raw ?? '').trim();
+  if (!s) return fallback;
+  const n = Number(s);
+  if (!Number.isSafeInteger(n) || n < 0 || Object.is(n, -0)) return fallback;
+  return n;
+}
+const PROBE_TIMEOUT_MS = _validTimeoutMs(process.env.AGENTIC_SECURITY_CHROME_PROBE_TIMEOUT_MS, 5000);
+
+// Real, common install locations, per platform. Deliberately excludes
+// AGENTIC_SECURITY_CHROME_PATH — that override is handled separately in
+// probeChromeAvailable() as an authoritative, non-fallback choice (see
+// the comment there for why).
+//
+// KNOWN-GOOD ABSOLUTE PATHS ARE TRIED FIRST, PATH-resolvable bare names
+// LAST — found by the final whole-branch review, reproduced live: with
+// bare names tried first, a `chrome` shell script anywhere earlier on
+// PATH than the real browser is silently preferred and then executed
+// with this process's own render arguments. The `--version` output
+// check (`_tryBinary` below) is a functional smoke test, not a security
+// gate — it cannot distinguish a real Chrome/Chromium binary from any
+// script that echoes a matching string. Preferring the well-known
+// install locations narrows, though does not eliminate, this exposure
+// (a compromised PATH entry named exactly `chrome`/`google-chrome`/etc.
+// is still tried if no absolute-path candidate exists on this machine —
+// this feature already assumes local machine trust, same as every other
+// "optional local tool" this codebase shells out to). The `linux` list
+// below was empty in this fix's first pass — found by the scoped
+// re-review to make the whole reordering a no-op on the platform CI
+// images actually run on, since every Linux candidate was a bare PATH
+// name. Package-manager and snap install locations are now included.
+function _candidatePaths() {
+  const onPath = ['google-chrome-stable', 'google-chrome', 'chromium-browser', 'chromium', 'chrome'];
+  const platformPaths = {
+    darwin: [
+      '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+      '/Applications/Chromium.app/Contents/MacOS/Chromium',
+      `${process.env.HOME || ''}/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`,
+    ],
+    win32: [
+      'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+      'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
+      `${process.env.LOCALAPPDATA || ''}\\Google\\Chrome\\Application\\chrome.exe`,
+    ],
+    linux: [
+      '/usr/bin/google-chrome-stable',
+      '/usr/bin/google-chrome',
+      '/usr/bin/chromium-browser',
+      '/usr/bin/chromium',
+      '/opt/google/chrome/chrome',
+      '/snap/bin/chromium',
+    ],
+  };
+  const platformSpecific = platformPaths[process.platform] || [];
+  return [...platformSpecific, ...onPath];
+}
+
+// Tries one candidate binary. Returns {ok:true, chrome:bin} on a real,
+// working Chrome/Chromium, or null on any failure (missing binary, spawn
+// error, non-zero exit, unrecognized --version output) — never throws.
+function _tryBinary(bin) {
+  if (!bin) return null;
+  // An absolute-path candidate that doesn't exist can't spawn — skip the
+  // spawnSync call entirely rather than let it throw ENOENT.
+  if (bin.includes('/') || bin.includes('\\')) {
+    if (!fs.existsSync(bin)) return null;
+  }
+  let r;
+  try {
+    r = cp.spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS });
+  } catch { return null; }
+  if (r.error || r.status !== 0) return null;
+  const out = (r.stdout || r.stderr || '');
+  if (!/Chrom(e|ium)/i.test(out)) return null;
+  return { ok: true, chrome: bin };
+}
+
+export function resetChromeProbe() { _capability = null; }
+
+export function probeChromeAvailable() {
+  if (_capability) return _capability;
+
+  // An explicit override is authoritative, not just "try this one first
+  // then fall back": an operator (or CI environment) who deliberately
+  // pointed AGENTIC_SECURITY_CHROME_PATH at a binary wants a failure
+  // reported when that binary doesn't work — not a silent switch to
+  // whatever else this process happens to auto-detect on the machine.
+  const fromEnv = process.env.AGENTIC_SECURITY_CHROME_PATH;
+  if (fromEnv) {
+    const hit = _tryBinary(fromEnv);
+    _capability = hit || { ok: false, reason: 'chrome-path-invalid' };
+    return _capability;
+  }
+
+  for (const bin of _candidatePaths()) {
+    const hit = _tryBinary(bin);
+    if (hit) { _capability = hit; return _capability; }
+  }
+  _capability = { ok: false, reason: 'no-chrome-found' };
+  return _capability;
+}

package/src/ir/parser-js.js

@@ -47,6 +47,30 @@ import presetTypescript from '@babel/preset-typescript';
 let _nodeIdSeq = 0;
 function nextNodeId() { return 'n' + (++_nodeIdSeq); }
 
+// Round-5 lineage-engine finding, generalized in round 6: resolve a Babel
+// object-property-shaped node's key (`ObjectProperty` from either an
+// `ObjectExpression` or an `ObjectPattern` — both share the same
+// `{computed, key}` shape) to either its real, distinct property name, or
+// the explicit unknown marker '*' when the key is computed and not itself
+// a resolvable literal. A computed key that IS a literal (`{[42]: v}`,
+// `{['literal']: v}` — Babel still marks these `computed: true`) still
+// resolves to that literal's own string form; a computed key that is an
+// arbitrary expression (most commonly an Identifier, e.g. `{[field]: v}`)
+// resolves to '*', NEVER to the key expression's own variable name — using
+// `p.key.name` unconditionally there would attribute the property to the
+// key expression's OWN name as if it were a real, distinct property,
+// colliding e.g. `{ field: a, [field]: b }` onto one shared 'field' key.
+// Originally fixed only for `ObjectExpression` (round 5); round 6 found the
+// identical bug, unfixed, in `lhsPath`'s `ObjectPattern` (destructuring)
+// branch and extracted this shared helper so a third instance of the same
+// bug can't appear in some future object-key-reading code path. See
+// DESIGN_INTRAPROCEDURAL.md §4 and CLAUDE.md's "three hop types" note.
+function resolveObjectKey(p) {
+  return p.computed
+    ? (p.key?.value != null ? String(p.key.value) : '*')
+    : (p.key?.name || (p.key?.value != null ? String(p.key.value) : '*'));
+}
+
 // Compact a Babel AST node into our exprDesc.
 function exprOf(n) {
   if (!n) return { kind: 'unknown' };
@@ -91,10 +115,50 @@ function exprOf(n) {
       return { kind: 'union', branches: [exprOf(n.consequent), exprOf(n.alternate)] };
     case 'ObjectExpression':  return {
       kind: 'object',
-      props: (n.properties || []).filter(p => p.type === 'ObjectProperty' && p.key).map(p => ({
-        key: p.key.name || (p.key.value != null ? String(p.key.value) : '*'),
-        value: exprOf(p.value),
-      })),
+      // Round-5 lineage-engine finding: for a COMPUTED property
+      // (`{[k]: v}`, `p.computed === true`), `p.key` is an arbitrary
+      // expression node, not a name — and an Identifier key expression
+      // (`k`) HAS a `.name` ('k'), same as a real, non-computed property
+      // literally named `k` would. Using `p.key.name` unconditionally
+      // therefore attributed a computed property to the key EXPRESSION's
+      // own variable name as if it were a real, distinct property name,
+      // colliding `{ k: user.ssn, [k]: user.email }` onto one shared 'k'
+      // key. A computed key IS still resolvable when it's itself a literal
+      // (`{[42]: v}`, `{['literal']: v}` — Babel marks these
+      // `computed: true` too, but `p.key.value` gives the real value), so
+      // only an Identifier/expression computed key (no `.value`) falls
+      // back to the literal string '*' — mirroring the EXISTING computed-
+      // MEMBER-access convention (`n.computed` handling just above, and
+      // `lhsPath`'s computed-write handling below) rather than inventing a
+      // new one. See DESIGN_INTRAPROCEDURAL.md §4 and CLAUDE.md's "three
+      // hop types" note.
+      //
+      // A `SpreadElement` (`{...user}`) previously fell out of the
+      // `.filter` entirely — `{...user}` and `{}` were byte-identical in
+      // the emitted IR, a real, pre-existing false negative (the identity
+      // vanishes, not merged, not flattened — found and documented but
+      // not fixed by a final review of an earlier plan). Represented here
+      // as a distinct `{spread: true, value: <expr>}` shape (no `key`
+      // field) rather than a regular `{key, value}` property, so
+      // `scanner/src/lineage/engine.js`'s `resolveExprIdentities` can
+      // merge the spread source's OWN field structure directly into this
+      // object's structure (see that file for the full mechanism) — a
+      // DIFFERENT, more precise handling than a computed-unknown-key
+      // property gets (that case folds into one opaque residual bucket; a
+      // spread's contents are fully known, just not yet assigned a key in
+      // THIS literal, so they can and should stay field-distinguished).
+      // Every consumer of `expr.props` outside this package
+      // (scanner/src/dataflow/engine.js, higher-order.js,
+      // privacy-deep-walker.js — audited before this change) reads only
+      // `p.value`, never `p.key`, so this shape is compatible with all of
+      // them without any change there — and several gain correct taint/
+      // privacy detection through object spread as a direct result, since
+      // the spread's value is no longer silently absent from `props`.
+      props: (n.properties || []).map(p => {
+        if (p.type === 'SpreadElement') return { spread: true, value: exprOf(p.argument) };
+        if (p.type !== 'ObjectProperty' || !p.key) return null;
+        return { key: resolveObjectKey(p), value: exprOf(p.value) };
+      }).filter(Boolean),
     };
     case 'ArrayExpression':   return { kind: 'array', elements: (n.elements || []).map(exprOf) };
     case 'SpreadElement':     return exprOf(n.argument);
@@ -170,10 +234,33 @@ function lhsPath(n) {
     return base + '.' + prop;
   }
   if (n.type === 'ObjectPattern') {
-    // Destructured: return an array of (key, alias) pairs the caller can iterate.
+    // Destructured: return an array of (key, alias) pairs the caller can
+    // iterate. Round 6: uses the same `resolveObjectKey` helper
+    // `ObjectExpression` uses above, so a non-literal computed key
+    // (`const { [field]: value } = user`) resolves to '*' instead of
+    // fabricating a colliding key from the key variable's own name — see
+    // `resolveObjectKey`'s header comment for the full rationale.
+    //
+    // A `RestElement` (`const {a, ...rest} = obj`) has its bound identifier
+    // at `.argument`, not `.value` (only a real `ObjectProperty` has
+    // `.value`) — using `.value` unconditionally here made `lhsPath`
+    // resolve to `null` for every rest binding (`lhsPath(undefined)` hits
+    // the `if (!n) return null;` guard before ever reaching the
+    // `RestElement` case below), so the consumer's `if (!alias) continue;`
+    // guard silently skipped it entirely: a real, pre-existing FR-306
+    // violation where the rest binding vanished with no trace, not merged,
+    // not flattened. `resolveObjectKey(p)` already correctly resolves to
+    // '*' for a RestElement (it has no `.key`/`.computed`), which is
+    // exactly the right marker: the consumer already treats a `'*'`-keyed
+    // destructured binding as a computed-unknown-key selection
+    // (`{kind:'member', object: initExpr, prop: '*'}`), and the lineage
+    // engine's existing wildcard-selection machinery (built for `obj[k]`)
+    // already resolves that correctly — conservatively aggregating the
+    // source's full field set, flagged widened. No engine-level change
+    // needed for this fix.
     return { kind: 'object-pattern', props: (n.properties || []).map(p => ({
-      key: p.key?.name || (p.key?.value != null ? String(p.key.value) : '*'),
-      alias: lhsPath(p.value),
+      key: resolveObjectKey(p),
+      alias: lhsPath(p.type === 'RestElement' ? p.argument : p.value),
     }))};
   }
   if (n.type === 'ArrayPattern') {