@cplieger/deadset-ts 3.10.0 → 3.12.0

package/dist/src/reporters/sarif.js

@@ -0,0 +1,235 @@
+import { KINDS } from "../kinds.js";
+import { lineHashes, symbolFingerprint } from "./fingerprint.js";
+import { RenderError } from "./reporter.js";
+import { RULE_TEXTS } from "./rules.js";
+import { utf8Bytes } from "./sha256.js";
+const SCHEMA = "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json";
+const VERSION = "2.1.0";
+/** The unit a finding's column counts. */
+const COLUMN_KIND = "utf16CodeUnits";
+const URI_BASE_ID = "%SRCROOT%";
+const ROOT_DESCRIPTION = "The target root, the directory the analyzer was run on.";
+/** The most related locations one result carries; the report stays complete beyond them. */
+const MAX_RELATED = 100;
+const INDENT = 2;
+const LEVEL = { deny: "error", warn: "warning", allow: "note" };
+const PROBLEM = {
+    deny: "error",
+    warn: "warning",
+    allow: "recommendation",
+};
+const PRECISION = {
+    certain: "very-high",
+    probable: "high",
+    possible: "medium",
+};
+/** The text up to and including the first full stop a space follows or that ends the text. */
+function firstSentence(text) {
+    for (let i = 0; i < text.length; i += 1) {
+        if (text[i] === "." && (i + 1 === text.length || text[i + 1] === " ")) {
+            return text.slice(0, i + 1);
+        }
+    }
+    return text;
+}
+/**
+ * One rule per live kind of this analyzer's language, in code order, whether or not a result
+ * names it, so a rule's index is the same in every run and under every configuration.
+ */
+function rules() {
+    return [...RULE_TEXTS].map(([code, text]) => {
+        const kind = KINDS.get(code);
+        if (kind === undefined) {
+            throw new RenderError(`the rule ${code} names no live kind`);
+        }
+        return {
+            id: code,
+            name: kind.name,
+            shortDescription: { text: firstSentence(text.rule) },
+            fullDescription: { text: text.rule },
+            help: {
+                text: text.precondition === undefined ? text.rule : `${text.rule}\n\n${text.precondition}`,
+            },
+            defaultConfiguration: { level: LEVEL[kind.defaultSeverity] },
+            properties: {
+                precision: PRECISION[kind.maxClass],
+                problem: { severity: PROBLEM[kind.defaultSeverity] },
+            },
+        };
+    });
+}
+/** The characters a path segment keeps unencoded beside letters and digits. */
+const SEGMENT_KEPT = "-_.~$&+:=@";
+function isAlphanumeric(byte) {
+    return ((byte >= 0x30 && byte <= 0x39) ||
+        (byte >= 0x41 && byte <= 0x5a) ||
+        (byte >= 0x61 && byte <= 0x7a));
+}
+/** One path segment percent-encoded as RFC 3986 requires of a path segment. */
+function encodeSegment(segment) {
+    return utf8Bytes(segment)
+        .map((byte) => isAlphanumeric(byte) || SEGMENT_KEPT.includes(String.fromCharCode(byte))
+        ? String.fromCharCode(byte)
+        : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`)
+        .join("");
+}
+/**
+ * A target-relative path as a relative reference: each segment encoded, and a colon in the
+ * first segment encoded as well, where it would otherwise read as a scheme.
+ */
+function relativeReference(path) {
+    const segments = path.split("/").map(encodeSegment);
+    segments[0] = (segments[0] ?? "").replaceAll(":", "%3A");
+    return segments.join("/");
+}
+function physicalLocation(at, endLine) {
+    return {
+        artifactLocation: { uri: relativeReference(at.path), uriBaseId: URI_BASE_ID },
+        region: { startLine: at.line, startColumn: at.column, endLine },
+    };
+}
+/** The line fingerprints of the files one rendering reads, each file read and hashed once. */
+function lineHashCache(read) {
+    const held = new Map();
+    return (at) => {
+        let hashes = held.get(at.path);
+        if (hashes === undefined) {
+            let text;
+            try {
+                text = read(at.path);
+            }
+            catch (error) {
+                throw new RenderError(`read ${at.path} for its line fingerprint: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            hashes = lineHashes(text);
+            held.set(at.path, hashes);
+        }
+        const hash = hashes[at.line - 1];
+        if (hash === undefined || at.line < 1) {
+            throw new RenderError(`${at.path} holds ${String(hashes.length)} lines and a record names line ${String(at.line)}`);
+        }
+        return hash;
+    };
+}
+/** Every position a finding names beyond its own, in the mapping's order, the first hundred. */
+function relatedOf(found) {
+    const related = [];
+    for (const one of found.details.implementations ?? []) {
+        related.push({ label: "implementation", at: one.position, endLine: one.position.end_line });
+    }
+    for (const at of found.details.write_positions ?? []) {
+        related.push({ label: "write", at, endLine: at.end_line });
+    }
+    return related.slice(0, MAX_RELATED);
+}
+/** The finding's message, then a link to each related location, since only a linked one shows. */
+function messageWithLinks(message, related) {
+    if (related.length === 0) {
+        return message;
+    }
+    const links = related.map((one, i) => `[${one.label} ${one.at.path}:${String(one.at.line)}:${String(one.at.column)}](${String(i + 1)})`);
+    return `${message} (see ${links.join(", ")})`;
+}
+/** Every member of the finding the mapping places nowhere else, under its schema name. */
+function propertiesOf(found) {
+    return {
+        language: found.language,
+        symbol: found.symbol,
+        reachability_class: found.reachability_class,
+        confidence: found.confidence,
+        ...(found.liveness_relation === undefined
+            ? {}
+            : { liveness_relation: found.liveness_relation }),
+        test_only: found.test_only,
+        generated: found.generated,
+        component: found.component,
+        retained_by: found.retained_by,
+        configurations: found.configurations,
+        consumers_loaded: found.consumers_loaded,
+        fixability: found.fixability,
+        details: found.details,
+    };
+}
+function ruleIndex(index, code) {
+    const at = index.get(code);
+    if (at === undefined) {
+        throw new RenderError(`the run has no rule ${code}, which one of its records names`);
+    }
+    return at;
+}
+function findingResult(found, index, hashOf) {
+    const related = relatedOf(found);
+    return {
+        ruleId: found.code,
+        ruleIndex: ruleIndex(index, found.code),
+        level: LEVEL[found.severity],
+        message: { text: messageWithLinks(found.message, related) },
+        locations: [{ physicalLocation: physicalLocation(found.position, found.position.end_line) }],
+        ...(related.length === 0
+            ? {}
+            : {
+                relatedLocations: related.map((one, i) => ({
+                    id: i + 1,
+                    physicalLocation: physicalLocation(one.at, one.endLine),
+                    message: { text: one.label },
+                })),
+            }),
+        partialFingerprints: {
+            primaryLocationLineHash: hashOf(found.position),
+            "deadsetSymbolRef/v1": symbolFingerprint(found.code, found.symbol.ref),
+        },
+        properties: propertiesOf(found),
+    };
+}
+/** A stale suppression at the failing level, at its own site; it is no finding, so it carries no member bag. */
+function staleResult(stale, index, hashOf) {
+    return {
+        ruleId: stale.code,
+        ruleIndex: ruleIndex(index, stale.code),
+        level: LEVEL.deny,
+        message: { text: stale.message },
+        locations: [{ physicalLocation: physicalLocation(stale.position, stale.position.line) }],
+        partialFingerprints: {
+            primaryLocationLineHash: hashOf(stale.position),
+            "deadsetSymbolRef/v1": symbolFingerprint(stale.code, stale.symbol),
+        },
+    };
+}
+/**
+ * The report as one SARIF 2.1.0 log of one run, mapped as the Contract states. A suppressed
+ * finding has no record in the report and so no result, and the totals the run carries
+ * count it. A file the rendering cannot read, or a line it does not hold, fails the
+ * rendering, because a line fingerprint computed from other bytes opens a second alert.
+ */
+export function sarif(report, options) {
+    const ruleList = rules();
+    const index = new Map([...RULE_TEXTS.keys()].map((code, at) => [code, at]));
+    const hashOf = lineHashCache(options.readSource);
+    const results = [
+        ...report.findings.map((found) => findingResult(found, index, hashOf)),
+        ...report.stale_suppressions.map((stale) => staleResult(stale, index, hashOf)),
+    ];
+    const languages = [...report.analyzer.languages].sort().join("+");
+    const log = {
+        $schema: SCHEMA,
+        version: VERSION,
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: report.analyzer.name,
+                        version: report.analyzer.version,
+                        semanticVersion: report.analyzer.version,
+                        rules: ruleList,
+                    },
+                },
+                automationDetails: { id: `deadset/${languages}/` },
+                columnKind: COLUMN_KIND,
+                originalUriBaseIds: { [URI_BASE_ID]: { description: { text: ROOT_DESCRIPTION } } },
+                results,
+                properties: { totals: report.totals },
+            },
+        ],
+    };
+    return `${JSON.stringify(log, null, INDENT)}\n`;
+}

package/dist/src/reporters/sha256.js

@@ -0,0 +1,101 @@
+/**
+ * SHA-256 over the UTF-8 encoding of a string, computed synchronously in the module itself:
+ * a rendering is a pure function of the report, and the platform's own digests are either
+ * asynchronous or reached through a platform module the analysis does not import.
+ */
+/** The first 32 bits of the fractional parts of the cube roots of the first 64 primes. */
+const ROUND_CONSTANTS = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** The first 32 bits of the fractional parts of the square roots of the first eight primes. */
+const INITIAL_STATE = [
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+];
+/** The replacement character's encoding, written for a lone surrogate, which has no code point. */
+const REPLACEMENT = [0xef, 0xbf, 0xbd];
+/** The UTF-8 encoding of a string. */
+export function utf8Bytes(text) {
+    const bytes = [];
+    for (const char of text) {
+        const point = char.codePointAt(0) ?? 0;
+        if (point < 0x80) {
+            bytes.push(point);
+        }
+        else if (point < 0x800) {
+            bytes.push(0xc0 | (point >> 6), 0x80 | (point & 0x3f));
+        }
+        else if (point >= 0xd800 && point <= 0xdfff) {
+            bytes.push(...REPLACEMENT);
+        }
+        else if (point < 0x10000) {
+            bytes.push(0xe0 | (point >> 12), 0x80 | ((point >> 6) & 0x3f), 0x80 | (point & 0x3f));
+        }
+        else {
+            bytes.push(0xf0 | (point >> 18), 0x80 | ((point >> 12) & 0x3f), 0x80 | ((point >> 6) & 0x3f), 0x80 | (point & 0x3f));
+        }
+    }
+    return bytes;
+}
+function rotate(value, by) {
+    return (value >>> by) | (value << (32 - by));
+}
+/** The message padded to a whole number of 64-byte blocks, its bit length in the last eight bytes. */
+function padded(bytes) {
+    const length = Math.ceil((bytes.length + 9) / 64) * 64;
+    const block = new Uint8Array(length);
+    block.set(bytes);
+    block[bytes.length] = 0x80;
+    const bits = bytes.length * 8;
+    const view = new DataView(block.buffer);
+    view.setUint32(length - 8, Math.floor(bits / 0x100000000));
+    view.setUint32(length - 4, bits >>> 0);
+    return block;
+}
+/** The SHA-256 digest of a string's UTF-8 encoding, as 64 lowercase hexadecimal digits. */
+export function sha256Hex(text) {
+    const message = padded(utf8Bytes(text));
+    const view = new DataView(message.buffer);
+    const state = [...INITIAL_STATE];
+    const words = new Uint32Array(64);
+    for (let offset = 0; offset < message.length; offset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            words[i] = view.getUint32(offset + i * 4);
+        }
+        for (let i = 16; i < 64; i += 1) {
+            const early = words[i - 15] ?? 0;
+            const late = words[i - 2] ?? 0;
+            const s0 = rotate(early, 7) ^ rotate(early, 18) ^ (early >>> 3);
+            const s1 = rotate(late, 17) ^ rotate(late, 19) ^ (late >>> 10);
+            words[i] = (words[i - 16] ?? 0) + s0 + (words[i - 7] ?? 0) + s1;
+        }
+        let [a, b, c, d, e, f, g, h] = state;
+        for (let i = 0; i < 64; i += 1) {
+            const t1 = (h +
+                (rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25)) +
+                ((e & f) ^ (~e & g)) +
+                (ROUND_CONSTANTS[i] ?? 0) +
+                (words[i] ?? 0)) >>>
+                0;
+            const t2 = ((rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        [a, b, c, d, e, f, g, h].forEach((value, i) => {
+            state[i] = ((state[i] ?? 0) + value) >>> 0;
+        });
+    }
+    return state.map((word) => word.toString(16).padStart(8, "0")).join("");
+}