@fourteensystems/shipguard 0.2.6 → 0.3.0

package/dist/util/outbound-fetch.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-fetch.test.d.ts","sourceRoot":"","sources":["../../src/util/outbound-fetch.test.ts"],"names":[],"mappings":""}

package/dist/util/outbound-fetch.test.js

@@ -0,0 +1,83 @@
+import { describe, it, expect } from "vitest";
+import { detectOutboundFetcher } from "./outbound-fetch.js";
+describe("detectOutboundFetcher", () => {
+    it("detects fetch() with user-influenced URL", () => {
+        const src = `
+export async function GET(request: Request) {
+  const url = new URL(request.url).searchParams.get("target");
+  const response = await fetch(url);
+  return Response.json(await response.json());
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(true);
+        expect(result.hasUserInfluencedUrl).toBe(true);
+        expect(result.isRisky).toBe(true);
+        expect(result.evidence.length).toBeGreaterThanOrEqual(2);
+    });
+    it("detects axios with user-influenced URL", () => {
+        const src = `
+export async function POST(request: Request) {
+  const body = await request.json();
+  const response = await axios.get(body.url);
+  return Response.json(response.data);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.isRisky).toBe(true);
+    });
+    it("does NOT flag fetch with hardcoded URL", () => {
+        const src = `
+export async function GET() {
+  const response = await fetch("https://api.example.com/data");
+  return Response.json(await response.json());
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(true);
+        expect(result.hasUserInfluencedUrl).toBe(false);
+        expect(result.isRisky).toBe(false);
+    });
+    it("does NOT flag when no fetch present", () => {
+        const src = `
+export async function POST(request: Request) {
+  const body = await request.json();
+  await prisma.user.create({ data: body });
+  return Response.json({ ok: true });
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(false);
+        expect(result.isRisky).toBe(false);
+        expect(result.evidence).toHaveLength(0);
+    });
+    it("does NOT match fetchUser() as outbound fetch", () => {
+        const src = `
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const user = await fetchUser(url.searchParams.get("id"));
+  return Response.json(user);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(false);
+    });
+    it("detects got() with user input", () => {
+        const src = `
+import got from "got";
+export async function GET(request: Request) {
+  const target = new URL(request.url).searchParams.get("url");
+  const response = await got(target);
+  return Response.json(response.body);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.isRisky).toBe(true);
+    });
+    it("detects undici.request with user input", () => {
+        const src = `
+import { request as undiciRequest } from "undici";
+export async function POST(req: Request) {
+  const body = await req.json();
+  const { body: responseBody } = await undici.request(body.endpoint);
+  return Response.json(responseBody);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.isRisky).toBe(true);
+    });
+});
+//# sourceMappingURL=outbound-fetch.test.js.map

package/dist/util/outbound-fetch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-fetch.test.js","sourceRoot":"","sources":["../../src/util/outbound-fetch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;;;EAId,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG;;;;;;EAMd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;;;;;EAMd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fourteensystems/shipguard",
-  "version": "0.2.6",
-  "description": "CI guardrail that blocks unprotected mutation routes in Next.js SaaS",
+  "version": "0.3.0",
+  "description": "Static analysis guardrail for Next.js SaaS — flags unprotected routes, missing rate limiting, and SSRF surfaces",
   "type": "module",
   "bin": {
     "shipguard": "./bin/shipguard.mjs"