@etalon/core 1.0.0

package/dist/chunk-C6WLBWUY.js

@@ -0,0 +1,230 @@
+// src/audit/plugin-loader.ts
+import { readFileSync, readdirSync, existsSync } from "fs";
+import { join, extname } from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/audit/gdpr-articles.ts
+var GDPR_BASE = "https://gdpr-info.eu/art-";
+function art(article, title) {
+  const num = article.replace(/\(.*/, "");
+  return { article, title, url: `${GDPR_BASE}${num}-gdpr/` };
+}
+var GDPR_RULE_MAP = {
+  // ── Tracker detection ──────────────────────────────────
+  "tracker-dependency": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("7", "Conditions for Consent")
+  ],
+  "tracker-import": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("7", "Conditions for Consent")
+  ],
+  "tracker-api-call": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("5(1)(a)", "Lawfulness, Fairness, Transparency")
+  ],
+  "tracker-http-call": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("5(1)(a)", "Lawfulness, Fairness, Transparency")
+  ],
+  "tracker-env-var": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent")
+  ],
+  "hardcoded-tracker": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("25", "Data Protection by Design and by Default")
+  ],
+  "inline-tracker": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("7", "Conditions for Consent")
+  ],
+  "tracker-middleware": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("25", "Data Protection by Design and by Default")
+  ],
+  "unconditional-tracker": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("7(1)", "Demonstrable Consent")
+  ],
+  "analytics-proxy": [
+    art("5(1)(a)", "Lawfulness, Fairness, Transparency"),
+    art("25", "Data Protection by Design and by Default")
+  ],
+  // ── Server-side & CNAME ────────────────────────────────
+  "server-side-tracking": [
+    art("5(1)(a)", "Lawfulness, Fairness, Transparency"),
+    art("25", "Data Protection by Design and by Default"),
+    art("6(1)(a)", "Lawfulness \u2014 Consent")
+  ],
+  "cname-cloaking": [
+    art("5(1)(a)", "Lawfulness, Fairness, Transparency"),
+    art("7(1)", "Demonstrable Consent"),
+    art("12", "Transparent Information and Communication"),
+    art("25", "Data Protection by Design and by Default")
+  ],
+  // ── PII & Data ─────────────────────────────────────────
+  "pii-column": [
+    art("5(1)(c)", "Data Minimisation"),
+    art("5(1)(e)", "Storage Limitation"),
+    art("32", "Security of Processing")
+  ],
+  "pii-field-type": [
+    art("5(1)(c)", "Data Minimisation"),
+    art("25", "Data Protection by Design and by Default")
+  ],
+  "storage-pii": [
+    art("5(1)(f)", "Integrity and Confidentiality"),
+    art("32", "Security of Processing")
+  ],
+  "logging-pii": [
+    art("5(1)(f)", "Integrity and Confidentiality"),
+    art("5(1)(e)", "Storage Limitation")
+  ],
+  "no-retention-policy": [
+    art("5(1)(e)", "Storage Limitation"),
+    art("13(2)(a)", "Right to Information \u2014 Retention Period")
+  ],
+  // ── Cookies ────────────────────────────────────────────
+  "cookie-no-consent": [
+    art("6(1)(a)", "Lawfulness \u2014 Consent"),
+    art("7", "Conditions for Consent")
+  ],
+  "cookie-insecure": [
+    art("5(1)(f)", "Integrity and Confidentiality"),
+    art("32", "Security of Processing")
+  ],
+  "cookie-samesite": [
+    art("5(1)(f)", "Integrity and Confidentiality"),
+    art("32", "Security of Processing")
+  ],
+  // ── Security / Config ──────────────────────────────────
+  "missing-csp": [
+    art("32", "Security of Processing")
+  ],
+  "csp-unsafe-inline": [
+    art("32", "Security of Processing")
+  ],
+  "csp-unsafe-eval": [
+    art("32", "Security of Processing")
+  ],
+  "cors-wildcard": [
+    art("32", "Security of Processing")
+  ],
+  "cors-credentials-wildcard": [
+    art("32", "Security of Processing"),
+    art("5(1)(f)", "Integrity and Confidentiality")
+  ],
+  "missing-security-headers": [
+    art("32", "Security of Processing")
+  ],
+  "no-ssl": [
+    art("32", "Security of Processing"),
+    art("5(1)(f)", "Integrity and Confidentiality")
+  ],
+  "debug-mode": [
+    art("32", "Security of Processing"),
+    art("5(1)(f)", "Integrity and Confidentiality")
+  ]
+};
+function enrichWithGdpr(findings) {
+  return findings.map((f) => {
+    const articles = GDPR_RULE_MAP[f.rule];
+    if (articles && articles.length > 0) {
+      return { ...f, gdprArticles: articles };
+    }
+    return f;
+  });
+}
+
+// src/audit/plugin-loader.ts
+function loadCustomRules(directory) {
+  const rulesDir = join(directory, ".etalon", "rules");
+  if (!existsSync(rulesDir)) return [];
+  const rules = [];
+  const files = readdirSync(rulesDir).filter((f) => {
+    const ext = extname(f);
+    return ext === ".yaml" || ext === ".yml";
+  });
+  for (const file of files) {
+    try {
+      const content = readFileSync(join(rulesDir, file), "utf-8");
+      const parsed = parseYaml(content);
+      if (!parsed.name || !parsed.severity || !parsed.patterns) {
+        continue;
+      }
+      rules.push(parsed);
+    } catch {
+    }
+  }
+  return rules;
+}
+function scanWithCustomRules(files, directory, rules) {
+  if (rules.length === 0) return [];
+  const findings = [];
+  let findingId = 0;
+  for (const file of files) {
+    const fullPath = join(directory, file);
+    let content;
+    try {
+      content = readFileSync(fullPath, "utf-8");
+    } catch {
+      continue;
+    }
+    const lines = content.split("\n");
+    for (const rule of rules) {
+      for (const pattern of rule.patterns) {
+        if (pattern.languages && pattern.languages.length > 0) {
+          const ext = extname(file).substring(1);
+          const langMap = {
+            javascript: ["js", "jsx", "mjs", "cjs"],
+            typescript: ["ts", "tsx", "mts", "cts"],
+            python: ["py"],
+            rust: ["rs"],
+            go: ["go"],
+            java: ["java"],
+            ruby: ["rb"]
+          };
+          const matches = pattern.languages.some((lang) => {
+            const exts = langMap[lang] ?? [lang];
+            return exts.includes(ext);
+          });
+          if (!matches) continue;
+        }
+        const regex = new RegExp(pattern.regex, "g");
+        for (let i = 0; i < lines.length; i++) {
+          if (regex.test(lines[i])) {
+            const gdprArticles = rule.gdpr_articles?.map((art2) => {
+              const existing = Object.values(GDPR_RULE_MAP).flat().find((r) => r.article === art2);
+              return existing ?? {
+                article: art2,
+                title: `GDPR Article ${art2}`,
+                url: `https://gdpr-info.eu/art-${art2.replace(/\(.*/, "")}-gdpr/`
+              };
+            });
+            findings.push({
+              id: `custom-${findingId++}`,
+              category: "code",
+              severity: rule.severity,
+              title: rule.description,
+              message: pattern.message,
+              file,
+              line: i + 1,
+              rule: `custom/${rule.name}`,
+              fix: rule.fix,
+              gdprArticles
+            });
+          }
+          regex.lastIndex = 0;
+        }
+      }
+    }
+  }
+  return findings;
+}
+
+export {
+  GDPR_RULE_MAP,
+  enrichWithGdpr,
+  loadCustomRules,
+  scanWithCustomRules
+};