@lateos/npm-scan 0.17.1 → 0.18.1

package/backend/detectors/cve-2026-48710-badhost/manifest.js

@@ -1,305 +1,305 @@
-import { directDependencyFinding, directDependencyUnpinnedFinding } from './findings.js';
-
-function parseReqTxtLine(line) {
-  const trimmed = line.trim();
-  if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('-')) return null;
-  const idx = trimmed.indexOf('#');
-  const spec = idx >= 0 ? trimmed.slice(0, idx).trim() : trimmed;
-  if (!spec || !spec.startsWith('starlette')) return null;
-
-  const eqIdx = spec.indexOf('==');
-  const geIdx = spec.indexOf('>=');
-  const tildeIdx = spec.indexOf('~=');
-  const ltIdx = spec.indexOf('<');
-
-  if (eqIdx >= 0) {
-    const ver = spec.slice(eqIdx + 2).trim();
-    return { name: 'starlette', version: ver, specifier: `==${ver}` };
-  }
-  if (geIdx >= 0) {
-    const rest = spec.slice(geIdx + 2).trim();
-    const parts = rest.split(',');
-    const lower = parts[0]?.trim();
-    const upper = parts[1]?.trim();
-    let specStr = `>=${lower}`;
-    if (upper && upper.startsWith('<')) specStr += `,${upper}`;
-    return { name: 'starlette', version: lower, specifier: specStr };
-  }
-  if (tildeIdx >= 0) {
-    const ver = spec.slice(tildeIdx + 2).trim();
-    return { name: 'starlette', version: ver, specifier: `~=${ver}` };
-  }
-  if (ltIdx >= 0) {
-    const ver = spec.slice(ltIdx + 1).trim();
-    const name = 'starlette';
-    return { name, version: ver, specifier: `<${ver}` };
-  }
-
-  const rest = spec.slice('starlette'.length).trim();
-  if (!rest) return { name: 'starlette', version: null, specifier: null };
-
-  if (!rest.includes('=') && !rest.includes('<') && !rest.includes('>') && !rest.includes('~') && !rest.includes('!')) {
-    return { name: 'starlette', version: rest, specifier: rest };
-  }
-
-  return null;
-}
-
-export function parseRequirementsTxt(content) {
-  const lines = content.split('\n');
-  for (const line of lines) {
-    const result = parseReqTxtLine(line);
-    if (result) return result;
-  }
-  return null;
-}
-
-function parsePEP440(versionStr) {
-  if (!versionStr) return null;
-  const clean = versionStr.trim().replace(/^v/, '');
-  const parts = clean.split('.');
-  return {
-    major: parseInt(parts[0], 10) || 0,
-    minor: parseInt(parts[1], 10) || 0,
-    patch: parseInt(parts[2], 10) || 0,
-  };
-}
-
-function compareVersions(a, b) {
-  if (!a) return 1;
-  if (!b) return -1;
-  if (a.major !== b.major) return a.major - b.major;
-  if (a.minor !== b.minor) return a.minor - b.minor;
-  return a.patch - b.patch;
-}
-
-const STARLETTE_SAFE = parsePEP440('1.0.1');
-
-function isVulnerable(version) {
-  if (!version) return true;
-  const parsed = parsePEP440(version);
-  if (!parsed) return true;
-  return compareVersions(parsed, STARLETTE_SAFE) < 0;
-}
-
-function findStarletteInTOML(obj) {
-  if (!obj || typeof obj !== 'object') return null;
-
-  const sectionPaths = ['dependencies', 'project.dependencies', 'tool.poetry.dependencies'];
-  for (const path of sectionPaths) {
-    const parts = path.split('.');
-    let ptr = obj;
-    let found = true;
-    for (const p of parts) {
-      if (!ptr || typeof ptr !== 'object') { found = false; break; }
-      ptr = ptr[p];
-    }
-    if (!found || !ptr || typeof ptr !== 'object') continue;
-    for (const [key, val] of Object.entries(ptr)) {
-      if (key === 'starlette' || key === '"starlette"') {
-        const version = typeof val === 'string' ? val : (val?.version || null);
-        const specifier = typeof val === 'string' ? val : null;
-        return { name: 'starlette', version, specifier };
-      }
-    }
-  }
-  return null;
-}
-
-function parseTomlSimple(content) {
-  const result = {};
-  let currentSection = result;
-
-  for (const line of content.split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const sectionMatch = trimmed.match(/^\[([^\]]+)\]$/);
-    if (sectionMatch) {
-      const parts = sectionMatch[1].split('.');
-      let ptr = result;
-      for (const p of parts) {
-        const key = p.replace(/^"(.*)"$/, '$1').trim();
-        if (!ptr[key]) ptr[key] = {};
-        ptr = ptr[key];
-      }
-      currentSection = ptr;
-      continue;
-    }
-    const kvMatch = trimmed.match(/^([^=]+)=\s*(.+)$/);
-    if (!kvMatch) continue;
-    const key = kvMatch[1].trim().replace(/^"(.*)"$/, '$1');
-    let val = kvMatch[2].trim();
-    if (val.startsWith('"') && val.endsWith('"')) {
-      val = val.slice(1, -1);
-    } else if (val.startsWith("'") && val.endsWith("'")) {
-      val = val.slice(1, -1);
-    } else if (val.startsWith('^') || val.startsWith('~') || val.startsWith('>') || val.startsWith('<') || val.startsWith('=') || val.startsWith('!')) {
-      val = val.replace(/"/g, '');
-    }
-    currentSection[key] = val;
-  }
-
-  return result;
-}
-
-export function parsePyprojectToml(content) {
-  let obj;
-  try {
-    obj = JSON.parse(content);
-  } catch {
-    obj = parseTomlSimple(content);
-  }
-  return findStarletteInTOML(obj);
-}
-
-function parsePoetryLockEntry(content) {
-  const lines = content.split('\n');
-  let inStarlette = false;
-  let version = null;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith('[[package]]')) {
-      inStarlette = false;
-    }
-    if (trimmed.startsWith('name = "starlette"') || trimmed.startsWith("name = 'starlette'")) {
-      inStarlette = true;
-    }
-    if (inStarlette && trimmed.startsWith('version = ')) {
-      const match = trimmed.match(/version\s*=\s*["'](.+?)["']/);
-      if (match) version = match[1];
-    }
-    if (inStarlette && trimmed.startsWith('[[package]]') && trimmed !== '[[package]]') {
-      break;
-    }
-  }
-  if (version) {
-    return { name: 'starlette', version, specifier: `==${version}` };
-  }
-  return null;
-}
-
-export function parsePoetryLock(content) {
-  return parsePoetryLockEntry(content);
-}
-
-function parsePipfileEntry(content) {
-  try {
-    const obj = JSON.parse(content);
-    const packages = obj?.packages || {};
-    for (const [key, val] of Object.entries(packages)) {
-      if (key === 'starlette' || key === '"starlette"') {
-        const version = typeof val === 'string' ? val : null;
-        return { name: 'starlette', version, specifier: version || null };
-      }
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-export function parsePipfile(content) {
-  return parsePipfileEntry(content);
-}
-
-function parseSetupPyContent(content) {
-  const match = content.match(/install_requires\s*=\s*\[([^\]]+)\]/s);
-  if (!match) return null;
-  const block = match[1];
-  const lines = block.split(',').map(l => l.trim().replace(/["']/g, ''));
-  for (const line of lines) {
-    const clean = line.trim();
-    if (!clean) continue;
-    if (clean.startsWith('starlette')) {
-      const eqIdx = clean.indexOf('==');
-      const geIdx = clean.indexOf('>=');
-      const tildeIdx = clean.indexOf('~=');
-      const ltIdx = clean.indexOf('<');
-      let version = null;
-      let specifier = null;
-      if (eqIdx >= 0) { version = clean.slice(eqIdx + 2).trim(); specifier = `==${version}`; }
-      else if (geIdx >= 0) { version = clean.slice(geIdx + 2).split(',')[0].trim(); specifier = `>=${version}`; }
-      else if (tildeIdx >= 0) { version = clean.slice(tildeIdx + 2).trim(); specifier = `~=${version}`; }
-      else if (ltIdx >= 0) { version = clean.slice(ltIdx + 1).trim(); specifier = `<${version}`; }
-      else if (clean === 'starlette') { return { name: 'starlette', version: null, specifier: null }; }
-      return { name: 'starlette', version, specifier };
-    }
-  }
-  return null;
-}
-
-export function parseSetupPy(content) {
-  return parseSetupPyContent(content);
-}
-
-function parseSetupCfgContent(content) {
-  const lines = content.split('\n');
-  let inInstallRequires = false;
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith('install_requires')) {
-      inInstallRequires = true;
-      continue;
-    }
-    if (inInstallRequires) {
-      if (trimmed.startsWith('[')) break;
-      if (trimmed.startsWith('starlette')) {
-        const eqIdx = trimmed.indexOf('==');
-        const geIdx = trimmed.indexOf('>=');
-        const tildeIdx = trimmed.indexOf('~=');
-        const ltIdx = trimmed.indexOf('<');
-        let version = null;
-        let specifier = null;
-        if (eqIdx >= 0) { version = trimmed.slice(eqIdx + 2).trim(); specifier = `==${version}`; }
-        else if (geIdx >= 0) { version = trimmed.slice(geIdx + 2).split(',')[0].trim(); specifier = `>=${version}`; }
-        else if (tildeIdx >= 0) { version = trimmed.slice(tildeIdx + 2).trim(); specifier = `~=${version}`; }
-        else if (ltIdx >= 0) { version = trimmed.slice(ltIdx + 1).trim(); specifier = `<${version}`; }
-        else if (trimmed === 'starlette') { return { name: 'starlette', version: null, specifier: null }; }
-        if (trimmed.startsWith('starlette')) {
-          return { name: 'starlette', version, specifier };
-        }
-      }
-    }
-  }
-  return null;
-}
-
-export function parseSetupCfg(content) {
-  return parseSetupCfgContent(content);
-}
-
-export function scanFiles(allFiles) {
-  const findings = [];
-
-  for (const file of (allFiles || [])) {
-    const content = typeof file.content === 'string' ? file.content : '';
-    if (!content) continue;
-    const path = file.path || '';
-
-    let result = null;
-
-    if (path === 'requirements.txt' || path.match(/^requirements\/.*\.txt$/)) {
-      result = parseRequirementsTxt(content);
-    } else if (path === 'pyproject.toml') {
-      result = parsePyprojectToml(content);
-    } else if (path === 'poetry.lock') {
-      result = parsePoetryLock(content);
-    } else if (path === 'Pipfile' || path === 'Pipfile.lock') {
-      result = parsePipfile(content);
-    } else if (path === 'setup.py') {
-      result = parseSetupPy(content);
-    } else if (path === 'setup.cfg') {
-      result = parseSetupCfg(content);
-    }
-
-    if (!result) continue;
-
-    if (result.version === null && result.specifier === null) {
-      findings.push(directDependencyUnpinnedFinding());
-    } else if (isVulnerable(result.version)) {
-      findings.push(directDependencyFinding(result.version, result.specifier || 'unknown'));
-    }
-  }
-
-  return findings;
-}
+import { directDependencyFinding, directDependencyUnpinnedFinding } from './findings.js';
+
+function parseReqTxtLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('-')) return null;
+  const idx = trimmed.indexOf('#');
+  const spec = idx >= 0 ? trimmed.slice(0, idx).trim() : trimmed;
+  if (!spec || !spec.startsWith('starlette')) return null;
+
+  const eqIdx = spec.indexOf('==');
+  const geIdx = spec.indexOf('>=');
+  const tildeIdx = spec.indexOf('~=');
+  const ltIdx = spec.indexOf('<');
+
+  if (eqIdx >= 0) {
+    const ver = spec.slice(eqIdx + 2).trim();
+    return { name: 'starlette', version: ver, specifier: `==${ver}` };
+  }
+  if (geIdx >= 0) {
+    const rest = spec.slice(geIdx + 2).trim();
+    const parts = rest.split(',');
+    const lower = parts[0]?.trim();
+    const upper = parts[1]?.trim();
+    let specStr = `>=${lower}`;
+    if (upper && upper.startsWith('<')) specStr += `,${upper}`;
+    return { name: 'starlette', version: lower, specifier: specStr };
+  }
+  if (tildeIdx >= 0) {
+    const ver = spec.slice(tildeIdx + 2).trim();
+    return { name: 'starlette', version: ver, specifier: `~=${ver}` };
+  }
+  if (ltIdx >= 0) {
+    const ver = spec.slice(ltIdx + 1).trim();
+    const name = 'starlette';
+    return { name, version: ver, specifier: `<${ver}` };
+  }
+
+  const rest = spec.slice('starlette'.length).trim();
+  if (!rest) return { name: 'starlette', version: null, specifier: null };
+
+  if (!rest.includes('=') && !rest.includes('<') && !rest.includes('>') && !rest.includes('~') && !rest.includes('!')) {
+    return { name: 'starlette', version: rest, specifier: rest };
+  }
+
+  return null;
+}
+
+export function parseRequirementsTxt(content) {
+  const lines = content.split('\n');
+  for (const line of lines) {
+    const result = parseReqTxtLine(line);
+    if (result) return result;
+  }
+  return null;
+}
+
+function parsePEP440(versionStr) {
+  if (!versionStr) return null;
+  const clean = versionStr.trim().replace(/^v/, '');
+  const parts = clean.split('.');
+  return {
+    major: parseInt(parts[0], 10) || 0,
+    minor: parseInt(parts[1], 10) || 0,
+    patch: parseInt(parts[2], 10) || 0,
+  };
+}
+
+function compareVersions(a, b) {
+  if (!a) return 1;
+  if (!b) return -1;
+  if (a.major !== b.major) return a.major - b.major;
+  if (a.minor !== b.minor) return a.minor - b.minor;
+  return a.patch - b.patch;
+}
+
+const STARLETTE_SAFE = parsePEP440('1.0.1');
+
+function isVulnerable(version) {
+  if (!version) return true;
+  const parsed = parsePEP440(version);
+  if (!parsed) return true;
+  return compareVersions(parsed, STARLETTE_SAFE) < 0;
+}
+
+function findStarletteInTOML(obj) {
+  if (!obj || typeof obj !== 'object') return null;
+
+  const sectionPaths = ['dependencies', 'project.dependencies', 'tool.poetry.dependencies'];
+  for (const path of sectionPaths) {
+    const parts = path.split('.');
+    let ptr = obj;
+    let found = true;
+    for (const p of parts) {
+      if (!ptr || typeof ptr !== 'object') { found = false; break; }
+      ptr = ptr[p];
+    }
+    if (!found || !ptr || typeof ptr !== 'object') continue;
+    for (const [key, val] of Object.entries(ptr)) {
+      if (key === 'starlette' || key === '"starlette"') {
+        const version = typeof val === 'string' ? val : (val?.version || null);
+        const specifier = typeof val === 'string' ? val : null;
+        return { name: 'starlette', version, specifier };
+      }
+    }
+  }
+  return null;
+}
+
+function parseTomlSimple(content) {
+  const result = {};
+  let currentSection = result;
+
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const sectionMatch = trimmed.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      const parts = sectionMatch[1].split('.');
+      let ptr = result;
+      for (const p of parts) {
+        const key = p.replace(/^"(.*)"$/, '$1').trim();
+        if (!ptr[key]) ptr[key] = {};
+        ptr = ptr[key];
+      }
+      currentSection = ptr;
+      continue;
+    }
+    const kvMatch = trimmed.match(/^([^=]+)=\s*(.+)$/);
+    if (!kvMatch) continue;
+    const key = kvMatch[1].trim().replace(/^"(.*)"$/, '$1');
+    let val = kvMatch[2].trim();
+    if (val.startsWith('"') && val.endsWith('"')) {
+      val = val.slice(1, -1);
+    } else if (val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    } else if (val.startsWith('^') || val.startsWith('~') || val.startsWith('>') || val.startsWith('<') || val.startsWith('=') || val.startsWith('!')) {
+      val = val.replace(/"/g, '');
+    }
+    currentSection[key] = val;
+  }
+
+  return result;
+}
+
+export function parsePyprojectToml(content) {
+  let obj;
+  try {
+    obj = JSON.parse(content);
+  } catch {
+    obj = parseTomlSimple(content);
+  }
+  return findStarletteInTOML(obj);
+}
+
+function parsePoetryLockEntry(content) {
+  const lines = content.split('\n');
+  let inStarlette = false;
+  let version = null;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith('[[package]]')) {
+      inStarlette = false;
+    }
+    if (trimmed.startsWith('name = "starlette"') || trimmed.startsWith("name = 'starlette'")) {
+      inStarlette = true;
+    }
+    if (inStarlette && trimmed.startsWith('version = ')) {
+      const match = trimmed.match(/version\s*=\s*["'](.+?)["']/);
+      if (match) version = match[1];
+    }
+    if (inStarlette && trimmed.startsWith('[[package]]') && trimmed !== '[[package]]') {
+      break;
+    }
+  }
+  if (version) {
+    return { name: 'starlette', version, specifier: `==${version}` };
+  }
+  return null;
+}
+
+export function parsePoetryLock(content) {
+  return parsePoetryLockEntry(content);
+}
+
+function parsePipfileEntry(content) {
+  try {
+    const obj = JSON.parse(content);
+    const packages = obj?.packages || {};
+    for (const [key, val] of Object.entries(packages)) {
+      if (key === 'starlette' || key === '"starlette"') {
+        const version = typeof val === 'string' ? val : null;
+        return { name: 'starlette', version, specifier: version || null };
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+export function parsePipfile(content) {
+  return parsePipfileEntry(content);
+}
+
+function parseSetupPyContent(content) {
+  const match = content.match(/install_requires\s*=\s*\[([^\]]+)\]/s);
+  if (!match) return null;
+  const block = match[1];
+  const lines = block.split(',').map(l => l.trim().replace(/["']/g, ''));
+  for (const line of lines) {
+    const clean = line.trim();
+    if (!clean) continue;
+    if (clean.startsWith('starlette')) {
+      const eqIdx = clean.indexOf('==');
+      const geIdx = clean.indexOf('>=');
+      const tildeIdx = clean.indexOf('~=');
+      const ltIdx = clean.indexOf('<');
+      let version = null;
+      let specifier = null;
+      if (eqIdx >= 0) { version = clean.slice(eqIdx + 2).trim(); specifier = `==${version}`; }
+      else if (geIdx >= 0) { version = clean.slice(geIdx + 2).split(',')[0].trim(); specifier = `>=${version}`; }
+      else if (tildeIdx >= 0) { version = clean.slice(tildeIdx + 2).trim(); specifier = `~=${version}`; }
+      else if (ltIdx >= 0) { version = clean.slice(ltIdx + 1).trim(); specifier = `<${version}`; }
+      else if (clean === 'starlette') { return { name: 'starlette', version: null, specifier: null }; }
+      return { name: 'starlette', version, specifier };
+    }
+  }
+  return null;
+}
+
+export function parseSetupPy(content) {
+  return parseSetupPyContent(content);
+}
+
+function parseSetupCfgContent(content) {
+  const lines = content.split('\n');
+  let inInstallRequires = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith('install_requires')) {
+      inInstallRequires = true;
+      continue;
+    }
+    if (inInstallRequires) {
+      if (trimmed.startsWith('[')) break;
+      if (trimmed.startsWith('starlette')) {
+        const eqIdx = trimmed.indexOf('==');
+        const geIdx = trimmed.indexOf('>=');
+        const tildeIdx = trimmed.indexOf('~=');
+        const ltIdx = trimmed.indexOf('<');
+        let version = null;
+        let specifier = null;
+        if (eqIdx >= 0) { version = trimmed.slice(eqIdx + 2).trim(); specifier = `==${version}`; }
+        else if (geIdx >= 0) { version = trimmed.slice(geIdx + 2).split(',')[0].trim(); specifier = `>=${version}`; }
+        else if (tildeIdx >= 0) { version = trimmed.slice(tildeIdx + 2).trim(); specifier = `~=${version}`; }
+        else if (ltIdx >= 0) { version = trimmed.slice(ltIdx + 1).trim(); specifier = `<${version}`; }
+        else if (trimmed === 'starlette') { return { name: 'starlette', version: null, specifier: null }; }
+        if (trimmed.startsWith('starlette')) {
+          return { name: 'starlette', version, specifier };
+        }
+      }
+    }
+  }
+  return null;
+}
+
+export function parseSetupCfg(content) {
+  return parseSetupCfgContent(content);
+}
+
+export function scanFiles(allFiles) {
+  const findings = [];
+
+  for (const file of (allFiles || [])) {
+    const content = typeof file.content === 'string' ? file.content : '';
+    if (!content) continue;
+    const path = file.path || '';
+
+    let result = null;
+
+    if (path === 'requirements.txt' || path.match(/^requirements\/.*\.txt$/)) {
+      result = parseRequirementsTxt(content);
+    } else if (path === 'pyproject.toml') {
+      result = parsePyprojectToml(content);
+    } else if (path === 'poetry.lock') {
+      result = parsePoetryLock(content);
+    } else if (path === 'Pipfile' || path === 'Pipfile.lock') {
+      result = parsePipfile(content);
+    } else if (path === 'setup.py') {
+      result = parseSetupPy(content);
+    } else if (path === 'setup.cfg') {
+      result = parseSetupCfg(content);
+    }
+
+    if (!result) continue;
+
+    if (result.version === null && result.specifier === null) {
+      findings.push(directDependencyUnpinnedFinding());
+    } else if (isVulnerable(result.version)) {
+      findings.push(directDependencyFinding(result.version, result.specifier || 'unknown'));
+    }
+  }
+
+  return findings;
+}