@nahisaho/musubix-security 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (363) hide show
  1. package/dist/analysis/enhanced-taint-analyzer.d.ts +120 -0
  2. package/dist/analysis/enhanced-taint-analyzer.d.ts.map +1 -0
  3. package/dist/analysis/enhanced-taint-analyzer.js +450 -0
  4. package/dist/analysis/enhanced-taint-analyzer.js.map +1 -0
  5. package/dist/analysis/index.d.ts +1 -0
  6. package/dist/analysis/index.d.ts.map +1 -1
  7. package/dist/analysis/index.js +1 -0
  8. package/dist/analysis/index.js.map +1 -1
  9. package/dist/analysis/interprocedural/call-graph-builder.d.ts +192 -0
  10. package/dist/analysis/interprocedural/call-graph-builder.d.ts.map +1 -0
  11. package/dist/analysis/interprocedural/call-graph-builder.js +510 -0
  12. package/dist/analysis/interprocedural/call-graph-builder.js.map +1 -0
  13. package/dist/analysis/interprocedural/dfg-adapter.d.ts +166 -0
  14. package/dist/analysis/interprocedural/dfg-adapter.d.ts.map +1 -0
  15. package/dist/analysis/interprocedural/dfg-adapter.js +455 -0
  16. package/dist/analysis/interprocedural/dfg-adapter.js.map +1 -0
  17. package/dist/analysis/interprocedural/index.d.ts +9 -0
  18. package/dist/analysis/interprocedural/index.d.ts.map +1 -0
  19. package/dist/analysis/interprocedural/index.js +9 -0
  20. package/dist/analysis/interprocedural/index.js.map +1 -0
  21. package/dist/analysis/interprocedural/taint-propagator.d.ts +250 -0
  22. package/dist/analysis/interprocedural/taint-propagator.d.ts.map +1 -0
  23. package/dist/analysis/interprocedural/taint-propagator.js +435 -0
  24. package/dist/analysis/interprocedural/taint-propagator.js.map +1 -0
  25. package/dist/analysis/sanitizers/command-sanitizers.d.ts +12 -0
  26. package/dist/analysis/sanitizers/command-sanitizers.d.ts.map +1 -0
  27. package/dist/analysis/sanitizers/command-sanitizers.js +123 -0
  28. package/dist/analysis/sanitizers/command-sanitizers.js.map +1 -0
  29. package/dist/analysis/sanitizers/html-sanitizers.d.ts +12 -0
  30. package/dist/analysis/sanitizers/html-sanitizers.d.ts.map +1 -0
  31. package/dist/analysis/sanitizers/html-sanitizers.js +213 -0
  32. package/dist/analysis/sanitizers/html-sanitizers.js.map +1 -0
  33. package/dist/analysis/sanitizers/index.d.ts +35 -0
  34. package/dist/analysis/sanitizers/index.d.ts.map +1 -0
  35. package/dist/analysis/sanitizers/index.js +59 -0
  36. package/dist/analysis/sanitizers/index.js.map +1 -0
  37. package/dist/analysis/sanitizers/path-sanitizers.d.ts +12 -0
  38. package/dist/analysis/sanitizers/path-sanitizers.d.ts.map +1 -0
  39. package/dist/analysis/sanitizers/path-sanitizers.js +163 -0
  40. package/dist/analysis/sanitizers/path-sanitizers.js.map +1 -0
  41. package/dist/analysis/sanitizers/sql-sanitizers.d.ts +12 -0
  42. package/dist/analysis/sanitizers/sql-sanitizers.d.ts.map +1 -0
  43. package/dist/analysis/sanitizers/sql-sanitizers.js +216 -0
  44. package/dist/analysis/sanitizers/sql-sanitizers.js.map +1 -0
  45. package/dist/analysis/sanitizers/types.d.ts +78 -0
  46. package/dist/analysis/sanitizers/types.d.ts.map +1 -0
  47. package/dist/analysis/sanitizers/types.js +7 -0
  48. package/dist/analysis/sanitizers/types.js.map +1 -0
  49. package/dist/analysis/sanitizers/validation-sanitizers.d.ts +12 -0
  50. package/dist/analysis/sanitizers/validation-sanitizers.d.ts.map +1 -0
  51. package/dist/analysis/sanitizers/validation-sanitizers.js +268 -0
  52. package/dist/analysis/sanitizers/validation-sanitizers.js.map +1 -0
  53. package/dist/analysis/sinks/code-eval.d.ts +12 -0
  54. package/dist/analysis/sinks/code-eval.d.ts.map +1 -0
  55. package/dist/analysis/sinks/code-eval.js +231 -0
  56. package/dist/analysis/sinks/code-eval.js.map +1 -0
  57. package/dist/analysis/sinks/command-exec.d.ts +12 -0
  58. package/dist/analysis/sinks/command-exec.d.ts.map +1 -0
  59. package/dist/analysis/sinks/command-exec.js +187 -0
  60. package/dist/analysis/sinks/command-exec.js.map +1 -0
  61. package/dist/analysis/sinks/file-operations.d.ts +12 -0
  62. package/dist/analysis/sinks/file-operations.d.ts.map +1 -0
  63. package/dist/analysis/sinks/file-operations.js +239 -0
  64. package/dist/analysis/sinks/file-operations.js.map +1 -0
  65. package/dist/analysis/sinks/html-output.d.ts +12 -0
  66. package/dist/analysis/sinks/html-output.d.ts.map +1 -0
  67. package/dist/analysis/sinks/html-output.js +256 -0
  68. package/dist/analysis/sinks/html-output.js.map +1 -0
  69. package/dist/analysis/sinks/index.d.ts +30 -0
  70. package/dist/analysis/sinks/index.d.ts.map +1 -0
  71. package/dist/analysis/sinks/index.js +46 -0
  72. package/dist/analysis/sinks/index.js.map +1 -0
  73. package/dist/analysis/sinks/sql-query.d.ts +12 -0
  74. package/dist/analysis/sinks/sql-query.d.ts.map +1 -0
  75. package/dist/analysis/sinks/sql-query.js +209 -0
  76. package/dist/analysis/sinks/sql-query.js.map +1 -0
  77. package/dist/analysis/sinks/types.d.ts +97 -0
  78. package/dist/analysis/sinks/types.d.ts.map +1 -0
  79. package/dist/analysis/sinks/types.js +7 -0
  80. package/dist/analysis/sinks/types.js.map +1 -0
  81. package/dist/analysis/sources/database.d.ts +12 -0
  82. package/dist/analysis/sources/database.d.ts.map +1 -0
  83. package/dist/analysis/sources/database.js +211 -0
  84. package/dist/analysis/sources/database.js.map +1 -0
  85. package/dist/analysis/sources/environment.d.ts +12 -0
  86. package/dist/analysis/sources/environment.d.ts.map +1 -0
  87. package/dist/analysis/sources/environment.js +158 -0
  88. package/dist/analysis/sources/environment.js.map +1 -0
  89. package/dist/analysis/sources/file-system.d.ts +12 -0
  90. package/dist/analysis/sources/file-system.d.ts.map +1 -0
  91. package/dist/analysis/sources/file-system.js +180 -0
  92. package/dist/analysis/sources/file-system.js.map +1 -0
  93. package/dist/analysis/sources/http-request.d.ts +12 -0
  94. package/dist/analysis/sources/http-request.d.ts.map +1 -0
  95. package/dist/analysis/sources/http-request.js +179 -0
  96. package/dist/analysis/sources/http-request.js.map +1 -0
  97. package/dist/analysis/sources/index.d.ts +26 -0
  98. package/dist/analysis/sources/index.d.ts.map +1 -0
  99. package/dist/analysis/sources/index.js +40 -0
  100. package/dist/analysis/sources/index.js.map +1 -0
  101. package/dist/analysis/sources/types.d.ts +93 -0
  102. package/dist/analysis/sources/types.d.ts.map +1 -0
  103. package/dist/analysis/sources/types.js +7 -0
  104. package/dist/analysis/sources/types.js.map +1 -0
  105. package/dist/analysis/sources/user-input.d.ts +12 -0
  106. package/dist/analysis/sources/user-input.d.ts.map +1 -0
  107. package/dist/analysis/sources/user-input.js +261 -0
  108. package/dist/analysis/sources/user-input.js.map +1 -0
  109. package/dist/cve/cpe-matcher.d.ts +183 -0
  110. package/dist/cve/cpe-matcher.d.ts.map +1 -0
  111. package/dist/cve/cpe-matcher.js +396 -0
  112. package/dist/cve/cpe-matcher.js.map +1 -0
  113. package/dist/cve/cve-cache.d.ts +225 -0
  114. package/dist/cve/cve-cache.d.ts.map +1 -0
  115. package/dist/cve/cve-cache.js +452 -0
  116. package/dist/cve/cve-cache.js.map +1 -0
  117. package/dist/cve/cve-cache.test.d.ts +6 -0
  118. package/dist/cve/cve-cache.test.d.ts.map +1 -0
  119. package/dist/cve/cve-cache.test.js +363 -0
  120. package/dist/cve/cve-cache.test.js.map +1 -0
  121. package/dist/cve/dependency-parser.d.ts +204 -0
  122. package/dist/cve/dependency-parser.d.ts.map +1 -0
  123. package/dist/cve/dependency-parser.js +338 -0
  124. package/dist/cve/dependency-parser.js.map +1 -0
  125. package/dist/cve/index.d.ts +20 -0
  126. package/dist/cve/index.d.ts.map +1 -0
  127. package/dist/cve/index.js +13 -0
  128. package/dist/cve/index.js.map +1 -0
  129. package/dist/cve/nvd-client.d.ts +137 -0
  130. package/dist/cve/nvd-client.d.ts.map +1 -0
  131. package/dist/cve/nvd-client.js +333 -0
  132. package/dist/cve/nvd-client.js.map +1 -0
  133. package/dist/cve/rate-limiter.d.ts +194 -0
  134. package/dist/cve/rate-limiter.d.ts.map +1 -0
  135. package/dist/cve/rate-limiter.js +276 -0
  136. package/dist/cve/rate-limiter.js.map +1 -0
  137. package/dist/cve/report-generator.d.ts +145 -0
  138. package/dist/cve/report-generator.d.ts.map +1 -0
  139. package/dist/cve/report-generator.js +377 -0
  140. package/dist/cve/report-generator.js.map +1 -0
  141. package/dist/cve/report-generator.test.d.ts +6 -0
  142. package/dist/cve/report-generator.test.d.ts.map +1 -0
  143. package/dist/cve/report-generator.test.js +275 -0
  144. package/dist/cve/report-generator.test.js.map +1 -0
  145. package/dist/cve/vulnerability-scanner.d.ts +198 -0
  146. package/dist/cve/vulnerability-scanner.d.ts.map +1 -0
  147. package/dist/cve/vulnerability-scanner.js +311 -0
  148. package/dist/cve/vulnerability-scanner.js.map +1 -0
  149. package/dist/cve/vulnerability-scanner.test.d.ts +6 -0
  150. package/dist/cve/vulnerability-scanner.test.d.ts.map +1 -0
  151. package/dist/cve/vulnerability-scanner.test.js +329 -0
  152. package/dist/cve/vulnerability-scanner.test.js.map +1 -0
  153. package/dist/index.d.ts +1 -0
  154. package/dist/index.d.ts.map +1 -1
  155. package/dist/index.js +4 -0
  156. package/dist/index.js.map +1 -1
  157. package/dist/rules/config/config-parser.d.ts +119 -0
  158. package/dist/rules/config/config-parser.d.ts.map +1 -0
  159. package/dist/rules/config/config-parser.js +376 -0
  160. package/dist/rules/config/config-parser.js.map +1 -0
  161. package/dist/rules/config/index.d.ts +8 -0
  162. package/dist/rules/config/index.d.ts.map +1 -0
  163. package/dist/rules/config/index.js +8 -0
  164. package/dist/rules/config/index.js.map +1 -0
  165. package/dist/rules/config/profiles.d.ts +85 -0
  166. package/dist/rules/config/profiles.d.ts.map +1 -0
  167. package/dist/rules/config/profiles.js +226 -0
  168. package/dist/rules/config/profiles.js.map +1 -0
  169. package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts +9 -0
  170. package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts.map +1 -0
  171. package/dist/rules/cwe/cwe-119-buffer-overflow.js +54 -0
  172. package/dist/rules/cwe/cwe-119-buffer-overflow.js.map +1 -0
  173. package/dist/rules/cwe/cwe-125-oob-read.d.ts +20 -0
  174. package/dist/rules/cwe/cwe-125-oob-read.d.ts.map +1 -0
  175. package/dist/rules/cwe/cwe-125-oob-read.js +247 -0
  176. package/dist/rules/cwe/cwe-125-oob-read.js.map +1 -0
  177. package/dist/rules/cwe/cwe-190-integer-overflow.d.ts +9 -0
  178. package/dist/rules/cwe/cwe-190-integer-overflow.d.ts.map +1 -0
  179. package/dist/rules/cwe/cwe-190-integer-overflow.js +55 -0
  180. package/dist/rules/cwe/cwe-190-integer-overflow.js.map +1 -0
  181. package/dist/rules/cwe/cwe-20-input-validation.d.ts +21 -0
  182. package/dist/rules/cwe/cwe-20-input-validation.d.ts.map +1 -0
  183. package/dist/rules/cwe/cwe-20-input-validation.js +342 -0
  184. package/dist/rules/cwe/cwe-20-input-validation.js.map +1 -0
  185. package/dist/rules/cwe/cwe-22-path-traversal.d.ts +20 -0
  186. package/dist/rules/cwe/cwe-22-path-traversal.d.ts.map +1 -0
  187. package/dist/rules/cwe/cwe-22-path-traversal.js +306 -0
  188. package/dist/rules/cwe/cwe-22-path-traversal.js.map +1 -0
  189. package/dist/rules/cwe/cwe-269-improper-privilege.d.ts +9 -0
  190. package/dist/rules/cwe/cwe-269-improper-privilege.d.ts.map +1 -0
  191. package/dist/rules/cwe/cwe-269-improper-privilege.js +58 -0
  192. package/dist/rules/cwe/cwe-269-improper-privilege.js.map +1 -0
  193. package/dist/rules/cwe/cwe-276-default-permissions.d.ts +9 -0
  194. package/dist/rules/cwe/cwe-276-default-permissions.d.ts.map +1 -0
  195. package/dist/rules/cwe/cwe-276-default-permissions.js +54 -0
  196. package/dist/rules/cwe/cwe-276-default-permissions.js.map +1 -0
  197. package/dist/rules/cwe/cwe-287-improper-auth.d.ts +9 -0
  198. package/dist/rules/cwe/cwe-287-improper-auth.d.ts.map +1 -0
  199. package/dist/rules/cwe/cwe-287-improper-auth.js +57 -0
  200. package/dist/rules/cwe/cwe-287-improper-auth.js.map +1 -0
  201. package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts +9 -0
  202. package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts.map +1 -0
  203. package/dist/rules/cwe/cwe-306-missing-auth-critical.js +53 -0
  204. package/dist/rules/cwe/cwe-306-missing-auth-critical.js.map +1 -0
  205. package/dist/rules/cwe/cwe-352-csrf.d.ts +9 -0
  206. package/dist/rules/cwe/cwe-352-csrf.d.ts.map +1 -0
  207. package/dist/rules/cwe/cwe-352-csrf.js +51 -0
  208. package/dist/rules/cwe/cwe-352-csrf.js.map +1 -0
  209. package/dist/rules/cwe/cwe-362-race-condition.d.ts +9 -0
  210. package/dist/rules/cwe/cwe-362-race-condition.d.ts.map +1 -0
  211. package/dist/rules/cwe/cwe-362-race-condition.js +55 -0
  212. package/dist/rules/cwe/cwe-362-race-condition.js.map +1 -0
  213. package/dist/rules/cwe/cwe-416-use-after-free.d.ts +23 -0
  214. package/dist/rules/cwe/cwe-416-use-after-free.d.ts.map +1 -0
  215. package/dist/rules/cwe/cwe-416-use-after-free.js +402 -0
  216. package/dist/rules/cwe/cwe-416-use-after-free.js.map +1 -0
  217. package/dist/rules/cwe/cwe-434-file-upload.d.ts +9 -0
  218. package/dist/rules/cwe/cwe-434-file-upload.d.ts.map +1 -0
  219. package/dist/rules/cwe/cwe-434-file-upload.js +55 -0
  220. package/dist/rules/cwe/cwe-434-file-upload.js.map +1 -0
  221. package/dist/rules/cwe/cwe-476-null-deref.d.ts +9 -0
  222. package/dist/rules/cwe/cwe-476-null-deref.d.ts.map +1 -0
  223. package/dist/rules/cwe/cwe-476-null-deref.js +55 -0
  224. package/dist/rules/cwe/cwe-476-null-deref.js.map +1 -0
  225. package/dist/rules/cwe/cwe-502-deserialization.d.ts +9 -0
  226. package/dist/rules/cwe/cwe-502-deserialization.d.ts.map +1 -0
  227. package/dist/rules/cwe/cwe-502-deserialization.js +57 -0
  228. package/dist/rules/cwe/cwe-502-deserialization.js.map +1 -0
  229. package/dist/rules/cwe/cwe-77-command-injection.d.ts +9 -0
  230. package/dist/rules/cwe/cwe-77-command-injection.d.ts.map +1 -0
  231. package/dist/rules/cwe/cwe-77-command-injection.js +55 -0
  232. package/dist/rules/cwe/cwe-77-command-injection.js.map +1 -0
  233. package/dist/rules/cwe/cwe-78-command-injection.d.ts +20 -0
  234. package/dist/rules/cwe/cwe-78-command-injection.d.ts.map +1 -0
  235. package/dist/rules/cwe/cwe-78-command-injection.js +259 -0
  236. package/dist/rules/cwe/cwe-78-command-injection.js.map +1 -0
  237. package/dist/rules/cwe/cwe-787-oob-write.d.ts +21 -0
  238. package/dist/rules/cwe/cwe-787-oob-write.d.ts.map +1 -0
  239. package/dist/rules/cwe/cwe-787-oob-write.js +321 -0
  240. package/dist/rules/cwe/cwe-787-oob-write.js.map +1 -0
  241. package/dist/rules/cwe/cwe-79-xss.d.ts +22 -0
  242. package/dist/rules/cwe/cwe-79-xss.d.ts.map +1 -0
  243. package/dist/rules/cwe/cwe-79-xss.js +386 -0
  244. package/dist/rules/cwe/cwe-79-xss.js.map +1 -0
  245. package/dist/rules/cwe/cwe-798-hardcoded-credentials.d.ts +9 -0
  246. package/dist/rules/cwe/cwe-798-hardcoded-credentials.d.ts.map +1 -0
  247. package/dist/rules/cwe/cwe-798-hardcoded-credentials.js +58 -0
  248. package/dist/rules/cwe/cwe-798-hardcoded-credentials.js.map +1 -0
  249. package/dist/rules/cwe/cwe-862-missing-auth.d.ts +9 -0
  250. package/dist/rules/cwe/cwe-862-missing-auth.d.ts.map +1 -0
  251. package/dist/rules/cwe/cwe-862-missing-auth.js +55 -0
  252. package/dist/rules/cwe/cwe-862-missing-auth.js.map +1 -0
  253. package/dist/rules/cwe/cwe-863-incorrect-auth.d.ts +9 -0
  254. package/dist/rules/cwe/cwe-863-incorrect-auth.d.ts.map +1 -0
  255. package/dist/rules/cwe/cwe-863-incorrect-auth.js +58 -0
  256. package/dist/rules/cwe/cwe-863-incorrect-auth.js.map +1 -0
  257. package/dist/rules/cwe/cwe-89-sql-injection.d.ts +21 -0
  258. package/dist/rules/cwe/cwe-89-sql-injection.d.ts.map +1 -0
  259. package/dist/rules/cwe/cwe-89-sql-injection.js +456 -0
  260. package/dist/rules/cwe/cwe-89-sql-injection.js.map +1 -0
  261. package/dist/rules/cwe/cwe-918-ssrf.d.ts +9 -0
  262. package/dist/rules/cwe/cwe-918-ssrf.d.ts.map +1 -0
  263. package/dist/rules/cwe/cwe-918-ssrf.js +59 -0
  264. package/dist/rules/cwe/cwe-918-ssrf.js.map +1 -0
  265. package/dist/rules/cwe/cwe-94-code-injection.d.ts +9 -0
  266. package/dist/rules/cwe/cwe-94-code-injection.d.ts.map +1 -0
  267. package/dist/rules/cwe/cwe-94-code-injection.js +59 -0
  268. package/dist/rules/cwe/cwe-94-code-injection.js.map +1 -0
  269. package/dist/rules/cwe/index.d.ts +43 -0
  270. package/dist/rules/cwe/index.d.ts.map +1 -0
  271. package/dist/rules/cwe/index.js +99 -0
  272. package/dist/rules/cwe/index.js.map +1 -0
  273. package/dist/rules/engine/index.d.ts +10 -0
  274. package/dist/rules/engine/index.d.ts.map +1 -0
  275. package/dist/rules/engine/index.js +9 -0
  276. package/dist/rules/engine/index.js.map +1 -0
  277. package/dist/rules/engine/rule-context.d.ts +99 -0
  278. package/dist/rules/engine/rule-context.d.ts.map +1 -0
  279. package/dist/rules/engine/rule-context.js +175 -0
  280. package/dist/rules/engine/rule-context.js.map +1 -0
  281. package/dist/rules/engine/rule-engine.d.ts +132 -0
  282. package/dist/rules/engine/rule-engine.d.ts.map +1 -0
  283. package/dist/rules/engine/rule-engine.js +379 -0
  284. package/dist/rules/engine/rule-engine.js.map +1 -0
  285. package/dist/rules/engine/rule-registry.d.ts +133 -0
  286. package/dist/rules/engine/rule-registry.d.ts.map +1 -0
  287. package/dist/rules/engine/rule-registry.js +281 -0
  288. package/dist/rules/engine/rule-registry.js.map +1 -0
  289. package/dist/rules/index.d.ts +14 -0
  290. package/dist/rules/index.d.ts.map +1 -0
  291. package/dist/rules/index.js +16 -0
  292. package/dist/rules/index.js.map +1 -0
  293. package/dist/rules/owasp/a01-broken-access-control.d.ts +19 -0
  294. package/dist/rules/owasp/a01-broken-access-control.d.ts.map +1 -0
  295. package/dist/rules/owasp/a01-broken-access-control.js +295 -0
  296. package/dist/rules/owasp/a01-broken-access-control.js.map +1 -0
  297. package/dist/rules/owasp/a02-cryptographic-failures.d.ts +19 -0
  298. package/dist/rules/owasp/a02-cryptographic-failures.d.ts.map +1 -0
  299. package/dist/rules/owasp/a02-cryptographic-failures.js +327 -0
  300. package/dist/rules/owasp/a02-cryptographic-failures.js.map +1 -0
  301. package/dist/rules/owasp/a03-injection.d.ts +21 -0
  302. package/dist/rules/owasp/a03-injection.d.ts.map +1 -0
  303. package/dist/rules/owasp/a03-injection.js +342 -0
  304. package/dist/rules/owasp/a03-injection.js.map +1 -0
  305. package/dist/rules/owasp/a04-insecure-design.d.ts +19 -0
  306. package/dist/rules/owasp/a04-insecure-design.d.ts.map +1 -0
  307. package/dist/rules/owasp/a04-insecure-design.js +403 -0
  308. package/dist/rules/owasp/a04-insecure-design.js.map +1 -0
  309. package/dist/rules/owasp/a05-security-misconfiguration.d.ts +19 -0
  310. package/dist/rules/owasp/a05-security-misconfiguration.d.ts.map +1 -0
  311. package/dist/rules/owasp/a05-security-misconfiguration.js +371 -0
  312. package/dist/rules/owasp/a05-security-misconfiguration.js.map +1 -0
  313. package/dist/rules/owasp/a06-vulnerable-components.d.ts +18 -0
  314. package/dist/rules/owasp/a06-vulnerable-components.d.ts.map +1 -0
  315. package/dist/rules/owasp/a06-vulnerable-components.js +243 -0
  316. package/dist/rules/owasp/a06-vulnerable-components.js.map +1 -0
  317. package/dist/rules/owasp/a07-auth-failures.d.ts +19 -0
  318. package/dist/rules/owasp/a07-auth-failures.d.ts.map +1 -0
  319. package/dist/rules/owasp/a07-auth-failures.js +300 -0
  320. package/dist/rules/owasp/a07-auth-failures.js.map +1 -0
  321. package/dist/rules/owasp/a08-integrity-failures.d.ts +18 -0
  322. package/dist/rules/owasp/a08-integrity-failures.d.ts.map +1 -0
  323. package/dist/rules/owasp/a08-integrity-failures.js +306 -0
  324. package/dist/rules/owasp/a08-integrity-failures.js.map +1 -0
  325. package/dist/rules/owasp/a09-logging-failures.d.ts +18 -0
  326. package/dist/rules/owasp/a09-logging-failures.d.ts.map +1 -0
  327. package/dist/rules/owasp/a09-logging-failures.js +339 -0
  328. package/dist/rules/owasp/a09-logging-failures.js.map +1 -0
  329. package/dist/rules/owasp/a10-ssrf.d.ts +18 -0
  330. package/dist/rules/owasp/a10-ssrf.d.ts.map +1 -0
  331. package/dist/rules/owasp/a10-ssrf.js +349 -0
  332. package/dist/rules/owasp/a10-ssrf.js.map +1 -0
  333. package/dist/rules/owasp/index.d.ts +20 -0
  334. package/dist/rules/owasp/index.d.ts.map +1 -0
  335. package/dist/rules/owasp/index.js +53 -0
  336. package/dist/rules/owasp/index.js.map +1 -0
  337. package/dist/rules/types.d.ts +277 -0
  338. package/dist/rules/types.d.ts.map +1 -0
  339. package/dist/rules/types.js +34 -0
  340. package/dist/rules/types.js.map +1 -0
  341. package/dist/tests/integration/epic-integration.test.d.ts +7 -0
  342. package/dist/tests/integration/epic-integration.test.d.ts.map +1 -0
  343. package/dist/tests/integration/epic-integration.test.js +390 -0
  344. package/dist/tests/integration/epic-integration.test.js.map +1 -0
  345. package/dist/tests/rules/cwe/cwe-top25-1-13.test.d.ts +2 -0
  346. package/dist/tests/rules/cwe/cwe-top25-1-13.test.d.ts.map +1 -0
  347. package/dist/tests/rules/cwe/cwe-top25-1-13.test.js +154 -0
  348. package/dist/tests/rules/cwe/cwe-top25-1-13.test.js.map +1 -0
  349. package/dist/tests/rules/cwe/cwe-top25-14-25.test.d.ts +2 -0
  350. package/dist/tests/rules/cwe/cwe-top25-14-25.test.d.ts.map +1 -0
  351. package/dist/tests/rules/cwe/cwe-top25-14-25.test.js +121 -0
  352. package/dist/tests/rules/cwe/cwe-top25-14-25.test.js.map +1 -0
  353. package/dist/types/cve.d.ts +278 -0
  354. package/dist/types/cve.d.ts.map +1 -0
  355. package/dist/types/cve.js +7 -0
  356. package/dist/types/cve.js.map +1 -0
  357. package/dist/types/index.d.ts +2 -0
  358. package/dist/types/index.d.ts.map +1 -1
  359. package/dist/types/rule.d.ts +245 -0
  360. package/dist/types/rule.d.ts.map +1 -0
  361. package/dist/types/rule.js +7 -0
  362. package/dist/types/rule.js.map +1 -0
  363. package/package.json +4 -4
@@ -0,0 +1,377 @@
1
+ /**
2
+ * @fileoverview CVE Report Generator
3
+ * @module @nahisaho/musubix-security/cve/report-generator
4
+ * @description Generates vulnerability reports in Markdown, JSON, and SARIF formats
5
+ * @requirements REQ-SEC-CVE-003 - CVE report generation with multiple formats
6
+ * @design DES-SEC-CVE-003 - Report generator with SARIF 2.1.0 support
7
+ * @task TSK-CVE-008 - レポート生成
8
+ */
9
+ /**
10
+ * Severity level mapping
11
+ */
12
+ const SEVERITY_ORDER = {
13
+ CRITICAL: 0,
14
+ HIGH: 1,
15
+ MEDIUM: 2,
16
+ LOW: 3,
17
+ NONE: 4,
18
+ UNKNOWN: 5,
19
+ };
20
+ /**
21
+ * Get SARIF level from CVSS severity
22
+ */
23
+ function getSARIFLevel(severity) {
24
+ switch (severity?.toUpperCase()) {
25
+ case 'CRITICAL':
26
+ case 'HIGH':
27
+ return 'error';
28
+ case 'MEDIUM':
29
+ return 'warning';
30
+ case 'LOW':
31
+ return 'note';
32
+ default:
33
+ return 'none';
34
+ }
35
+ }
36
+ /**
37
+ * Get emoji for severity level
38
+ */
39
+ function getSeverityEmoji(severity) {
40
+ switch (severity?.toUpperCase()) {
41
+ case 'CRITICAL':
42
+ return '🔴';
43
+ case 'HIGH':
44
+ return '🟠';
45
+ case 'MEDIUM':
46
+ return '🟡';
47
+ case 'LOW':
48
+ return '🟢';
49
+ default:
50
+ return '⚪';
51
+ }
52
+ }
53
+ /**
54
+ * CVE Report Generator
55
+ */
56
+ export class ReportGenerator {
57
+ options;
58
+ constructor(options = {}) {
59
+ this.options = {
60
+ title: options.title ?? 'Vulnerability Scan Report',
61
+ includeDetails: options.includeDetails ?? true,
62
+ includeRemediation: options.includeRemediation ?? true,
63
+ minSeverity: options.minSeverity ?? 'NONE',
64
+ groupBySeverity: options.groupBySeverity ?? true,
65
+ includeMetadata: options.includeMetadata ?? true,
66
+ projectUrl: options.projectUrl ?? '',
67
+ };
68
+ }
69
+ /**
70
+ * Generate report in specified format
71
+ */
72
+ generate(result, format) {
73
+ const filteredResult = this.filterBySeverity(result);
74
+ switch (format) {
75
+ case 'markdown':
76
+ return this.generateMarkdown(filteredResult);
77
+ case 'json':
78
+ return this.generateJSON(filteredResult);
79
+ case 'sarif':
80
+ return this.generateSARIF(filteredResult);
81
+ default:
82
+ throw new Error(`Unsupported format: ${format}`);
83
+ }
84
+ }
85
+ /**
86
+ * Filter vulnerabilities by minimum severity
87
+ */
88
+ filterBySeverity(result) {
89
+ const minLevel = SEVERITY_ORDER[this.options.minSeverity] ?? 4;
90
+ const filtered = result.vulnerabilities.filter(vuln => {
91
+ const level = SEVERITY_ORDER[vuln.severity?.toUpperCase() ?? 'UNKNOWN'] ?? 5;
92
+ return level <= minLevel;
93
+ });
94
+ // Recalculate summary
95
+ const summary = {
96
+ total: filtered.length,
97
+ critical: 0,
98
+ high: 0,
99
+ medium: 0,
100
+ low: 0,
101
+ none: 0,
102
+ };
103
+ for (const vuln of filtered) {
104
+ const sev = vuln.severity?.toLowerCase();
105
+ if (sev && sev in summary && sev !== 'total') {
106
+ summary[sev]++;
107
+ }
108
+ }
109
+ return {
110
+ ...result,
111
+ vulnerabilities: filtered,
112
+ summary,
113
+ };
114
+ }
115
+ /**
116
+ * Generate Markdown report
117
+ */
118
+ generateMarkdown(result) {
119
+ const lines = [];
120
+ // Title
121
+ lines.push(`# ${this.options.title}`);
122
+ lines.push('');
123
+ // Metadata
124
+ if (this.options.includeMetadata) {
125
+ lines.push('## 📊 Scan Summary');
126
+ lines.push('');
127
+ lines.push(`| Metric | Value |`);
128
+ lines.push(`|--------|-------|`);
129
+ lines.push(`| Project | ${result.projectName ?? 'Unknown'} |`);
130
+ lines.push(`| Scan Time | ${result.scanTimestamp} |`);
131
+ lines.push(`| Duration | ${result.durationMs}ms |`);
132
+ lines.push(`| Packages Scanned | ${result.totalPackages} |`);
133
+ lines.push(`| Total Vulnerabilities | ${result.summary.total} |`);
134
+ lines.push('');
135
+ }
136
+ // Severity breakdown
137
+ lines.push('## 🎯 Severity Breakdown');
138
+ lines.push('');
139
+ lines.push(`| Severity | Count |`);
140
+ lines.push(`|----------|-------|`);
141
+ lines.push(`| 🔴 Critical | ${result.summary.critical} |`);
142
+ lines.push(`| 🟠 High | ${result.summary.high} |`);
143
+ lines.push(`| 🟡 Medium | ${result.summary.medium} |`);
144
+ lines.push(`| 🟢 Low | ${result.summary.low} |`);
145
+ lines.push('');
146
+ // Vulnerabilities
147
+ if (result.vulnerabilities.length === 0) {
148
+ lines.push('## ✅ No Vulnerabilities Found');
149
+ lines.push('');
150
+ lines.push('Great news! No vulnerabilities were detected in the scanned packages.');
151
+ return lines.join('\n');
152
+ }
153
+ lines.push('## 🔒 Detected Vulnerabilities');
154
+ lines.push('');
155
+ if (this.options.groupBySeverity) {
156
+ const grouped = this.groupBySeverity(result.vulnerabilities);
157
+ for (const [severity, vulns] of grouped) {
158
+ if (vulns.length === 0)
159
+ continue;
160
+ lines.push(`### ${getSeverityEmoji(severity)} ${severity} (${vulns.length})`);
161
+ lines.push('');
162
+ for (const vuln of vulns) {
163
+ lines.push(...this.formatVulnerabilityMarkdown(vuln));
164
+ }
165
+ }
166
+ }
167
+ else {
168
+ for (const vuln of result.vulnerabilities) {
169
+ lines.push(...this.formatVulnerabilityMarkdown(vuln));
170
+ }
171
+ }
172
+ return lines.join('\n');
173
+ }
174
+ /**
175
+ * Format a single vulnerability as Markdown
176
+ */
177
+ formatVulnerabilityMarkdown(vuln) {
178
+ const lines = [];
179
+ lines.push(`#### ${vuln.cveId}`);
180
+ lines.push('');
181
+ lines.push(`**Package:** \`${vuln.packageName}@${vuln.installedVersion}\``);
182
+ if (vuln.cvssScore !== undefined) {
183
+ lines.push(`**CVSS Score:** ${vuln.cvssScore.toFixed(1)} (${vuln.severity})`);
184
+ }
185
+ if (this.options.includeDetails) {
186
+ lines.push('');
187
+ lines.push(`**Description:** ${vuln.description ?? 'No description available'}`);
188
+ if (vuln.cwes && vuln.cwes.length > 0) {
189
+ lines.push(`**CWEs:** ${vuln.cwes.join(', ')}`);
190
+ }
191
+ if (vuln.references && vuln.references.length > 0) {
192
+ lines.push('');
193
+ lines.push('**References:**');
194
+ for (const ref of vuln.references.slice(0, 3)) {
195
+ lines.push(`- [Link](${ref})`);
196
+ }
197
+ }
198
+ }
199
+ if (this.options.includeRemediation && vuln.fixedVersion) {
200
+ lines.push('');
201
+ lines.push(`**✅ Fix Available:** Upgrade to \`${vuln.packageName}@${vuln.fixedVersion}\` or later`);
202
+ }
203
+ lines.push('');
204
+ lines.push('---');
205
+ lines.push('');
206
+ return lines;
207
+ }
208
+ /**
209
+ * Group vulnerabilities by severity
210
+ */
211
+ groupBySeverity(vulns) {
212
+ const groups = new Map([
213
+ ['CRITICAL', []],
214
+ ['HIGH', []],
215
+ ['MEDIUM', []],
216
+ ['LOW', []],
217
+ ]);
218
+ for (const vuln of vulns) {
219
+ const severity = vuln.severity?.toUpperCase() ?? 'UNKNOWN';
220
+ const group = groups.get(severity) ?? [];
221
+ group.push(vuln);
222
+ if (!groups.has(severity)) {
223
+ groups.set(severity, group);
224
+ }
225
+ }
226
+ return groups;
227
+ }
228
+ /**
229
+ * Generate JSON report
230
+ */
231
+ generateJSON(result) {
232
+ const report = {
233
+ meta: {
234
+ title: this.options.title,
235
+ generated: new Date().toISOString(),
236
+ generator: 'MUSUBIX Security Scanner',
237
+ version: '2.0.0',
238
+ },
239
+ scan: {
240
+ project: result.projectName,
241
+ timestamp: result.scanTimestamp,
242
+ durationMs: result.durationMs,
243
+ totalPackages: result.totalPackages,
244
+ },
245
+ summary: result.summary,
246
+ vulnerabilities: result.vulnerabilities.map(vuln => ({
247
+ id: vuln.cveId,
248
+ package: {
249
+ name: vuln.packageName,
250
+ version: vuln.installedVersion,
251
+ fixedVersion: vuln.fixedVersion,
252
+ },
253
+ severity: vuln.severity,
254
+ cvssScore: vuln.cvssScore,
255
+ description: vuln.description,
256
+ cwes: vuln.cwes,
257
+ references: vuln.references,
258
+ })),
259
+ };
260
+ return JSON.stringify(report, null, 2);
261
+ }
262
+ /**
263
+ * Generate SARIF 2.1.0 report
264
+ */
265
+ generateSARIF(result) {
266
+ const rules = [];
267
+ const results = [];
268
+ const ruleIdSet = new Set();
269
+ for (const vuln of result.vulnerabilities) {
270
+ // Add rule if not already added
271
+ if (!ruleIdSet.has(vuln.cveId)) {
272
+ ruleIdSet.add(vuln.cveId);
273
+ rules.push({
274
+ id: vuln.cveId,
275
+ name: `Vulnerability in ${vuln.packageName}`,
276
+ shortDescription: { text: vuln.description ?? `CVE ${vuln.cveId}` },
277
+ fullDescription: { text: vuln.description ?? `Security vulnerability ${vuln.cveId}` },
278
+ helpUri: `https://nvd.nist.gov/vuln/detail/${vuln.cveId}`,
279
+ defaultConfiguration: {
280
+ level: getSARIFLevel(vuln.severity),
281
+ },
282
+ properties: {
283
+ precision: 'high',
284
+ 'security-severity': (vuln.cvssScore ?? 0).toString(),
285
+ tags: [
286
+ 'security',
287
+ 'vulnerability',
288
+ vuln.severity?.toLowerCase() ?? 'unknown',
289
+ ...(vuln.cwes ?? []),
290
+ ],
291
+ },
292
+ });
293
+ }
294
+ // Add result
295
+ results.push({
296
+ ruleId: vuln.cveId,
297
+ level: getSARIFLevel(vuln.severity),
298
+ message: {
299
+ text: `Vulnerable package ${vuln.packageName}@${vuln.installedVersion}: ${vuln.description ?? vuln.cveId}`,
300
+ },
301
+ locations: [
302
+ {
303
+ physicalLocation: {
304
+ artifactLocation: {
305
+ uri: 'package.json',
306
+ uriBaseId: '%SRCROOT%',
307
+ },
308
+ },
309
+ },
310
+ ],
311
+ properties: {
312
+ packageName: vuln.packageName,
313
+ packageVersion: vuln.installedVersion,
314
+ fixedVersion: vuln.fixedVersion,
315
+ cvssScore: vuln.cvssScore,
316
+ cwes: vuln.cwes,
317
+ },
318
+ });
319
+ }
320
+ const sarif = {
321
+ $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
322
+ version: '2.1.0',
323
+ runs: [
324
+ {
325
+ tool: {
326
+ driver: {
327
+ name: 'MUSUBIX Security Scanner',
328
+ version: '2.0.0',
329
+ informationUri: 'https://github.com/nahisaho/musubix',
330
+ rules,
331
+ },
332
+ },
333
+ results,
334
+ invocations: [
335
+ {
336
+ executionSuccessful: true,
337
+ endTimeUtc: result.scanTimestamp,
338
+ },
339
+ ],
340
+ },
341
+ ],
342
+ };
343
+ return JSON.stringify(sarif, null, 2);
344
+ }
345
+ }
346
+ /**
347
+ * Quick report generation function
348
+ */
349
+ export function generateReport(result, format, options) {
350
+ const generator = new ReportGenerator(options);
351
+ return generator.generate(result, format);
352
+ }
353
+ /**
354
+ * Generate and save report to file
355
+ */
356
+ export async function generateReportToFile(result, filePath, format, options) {
357
+ const { writeFile } = await import('node:fs/promises');
358
+ const report = generateReport(result, format, options);
359
+ await writeFile(filePath, report, 'utf-8');
360
+ }
361
+ /**
362
+ * Determine format from file extension
363
+ */
364
+ export function getFormatFromExtension(filePath) {
365
+ const ext = filePath.toLowerCase().split('.').pop();
366
+ switch (ext) {
367
+ case 'md':
368
+ case 'markdown':
369
+ return 'markdown';
370
+ case 'sarif':
371
+ return 'sarif';
372
+ case 'json':
373
+ default:
374
+ return 'json';
375
+ }
376
+ }
377
+ //# sourceMappingURL=report-generator.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"report-generator.js","sourceRoot":"","sources":["../../src/cve/report-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2FH;;GAEG;AACH,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;GAEG;AACH,SAAS,aAAa,CAAC,QAAiB;IACtC,QAAQ,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,QAAiB;IACzC,QAAQ,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,CAA0B;IAElD,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,OAAO,GAAG;YACb,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,2BAA2B;YACnD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACtD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;YAC1C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,MAAkB,EAAE,MAAoB;QAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAErD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC/C,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;YAC3C,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;YAC5C;gBACE,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,MAAkB;QACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YACpD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7E,OAAO,KAAK,IAAI,QAAQ,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAA0B,CAAC;YACjE,IAAI,GAAG,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,MAAM;YACT,eAAe,EAAE,QAAQ;YACzB,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,MAAkB;QACzC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,QAAQ;QACR,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,WAAW;QACX,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,UAAU,MAAM,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,qBAAqB;QACrB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,kBAAkB;QAClB,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YACpF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAE7D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEjC,KAAK,CAAC,IAAI,CAAC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,2BAA2B,CAAC,IAA2B;QAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAE5E,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAEjF,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC9C,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,aAAa,CAAC,CAAC;QACtG,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,KAA8B;QAE9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAkC;YACtD,CAAC,UAAU,EAAE,EAAE,CAAC;YAChB,CAAC,MAAM,EAAE,EAAE,CAAC;YACZ,CAAC,QAAQ,EAAE,EAAE,CAAC;YACd,CAAC,KAAK,EAAE,EAAE,CAAC;SACZ,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAkB;QACrC,MAAM,MAAM,GAAG;YACb,IAAI,EAAE;gBACJ,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,0BAA0B;gBACrC,OAAO,EAAE,OAAO;aACjB;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,MAAM,CAAC,WAAW;gBAC3B,SAAS,EAAE,MAAM,CAAC,aAAa;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC;YACD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnD,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,IAAI,CAAC,WAAW;oBACtB,OAAO,EAAE,IAAI,CAAC,gBAAgB;oBAC9B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;SACJ,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAkB;QACtC,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC1C,gCAAgC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,IAAI,EAAE,oBAAoB,IAAI,CAAC,WAAW,EAAE;oBAC5C,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE;oBACnE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B,IAAI,CAAC,KAAK,EAAE,EAAE;oBACrF,OAAO,EAAE,oCAAoC,IAAI,CAAC,KAAK,EAAE;oBACzD,oBAAoB,EAAE;wBACpB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACpC;oBACD,UAAU,EAAE;wBACV,SAAS,EAAE,MAAM;wBACjB,mBAAmB,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;wBACrD,IAAI,EAAE;4BACJ,UAAU;4BACV,eAAe;4BACf,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS;4BACzC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;yBACrB;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,aAAa;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACnC,OAAO,EAAE;oBACP,IAAI,EAAE,sBAAsB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE;iBAC3G;gBACD,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE;gCAChB,GAAG,EAAE,cAAc;gCACnB,SAAS,EAAE,WAAW;6BACvB;yBACF;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,cAAc,EAAE,IAAI,CAAC,gBAAgB;oBACrC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAgB;YACzB,OAAO,EAAE,gGAAgG;YACzG,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,0BAA0B;4BAChC,OAAO,EAAE,OAAO;4BAChB,cAAc,EAAE,qCAAqC;4BACrD,KAAK;yBACN;qBACF;oBACD,OAAO;oBACP,WAAW,EAAE;wBACX;4BACE,mBAAmB,EAAE,IAAI;4BACzB,UAAU,EAAE,MAAM,CAAC,aAAa;yBACjC;qBACF;iBACF;aACF;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAkB,EAClB,MAAoB,EACpB,OAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,QAAgB,EAChB,MAAoB,EACpB,OAAuB;IAEvB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACpD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,IAAI,CAAC;QACV,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC"}
@@ -0,0 +1,6 @@
1
+ /**
2
+ * @fileoverview Report Generator Unit Tests
3
+ * @module @nahisaho/musubix-security/cve/report-generator.test
4
+ */
5
+ export {};
6
+ //# sourceMappingURL=report-generator.test.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"report-generator.test.d.ts","sourceRoot":"","sources":["../../src/cve/report-generator.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}
@@ -0,0 +1,275 @@
1
+ /**
2
+ * @fileoverview Report Generator Unit Tests
3
+ * @module @nahisaho/musubix-security/cve/report-generator.test
4
+ */
5
+ import { describe, it, expect, beforeEach, afterEach } from 'vitest';
6
+ import * as fs from 'node:fs';
7
+ import * as path from 'node:path';
8
+ import * as os from 'node:os';
9
+ import { ReportGenerator, generateReport, generateReportToFile, getFormatFromExtension, } from './report-generator.js';
10
+ /**
11
+ * Create a mock scan result
12
+ */
13
+ function createMockScanResult(vulns = []) {
14
+ const vulnerabilities = vulns.map((v, i) => ({
15
+ cveId: v.cveId ?? `CVE-2024-${String(i + 1).padStart(5, '0')}`,
16
+ packageName: v.packageName ?? 'test-package',
17
+ installedVersion: v.installedVersion ?? '1.0.0',
18
+ description: v.description ?? `Test vulnerability ${i + 1}`,
19
+ cvssScore: v.cvssScore ?? 7.5,
20
+ severity: v.severity ?? 'HIGH',
21
+ cvssVector: v.cvssVector ?? 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
22
+ cwes: v.cwes ?? ['CWE-79'],
23
+ references: v.references ?? ['https://example.com/ref'],
24
+ isDirect: v.isDirect ?? true,
25
+ dependencyType: v.dependencyType ?? 'dependencies',
26
+ confidence: v.confidence ?? 0.95,
27
+ fixedVersion: v.fixedVersion,
28
+ affectedVersions: v.affectedVersions,
29
+ }));
30
+ // Calculate summary
31
+ const summary = {
32
+ total: vulnerabilities.length,
33
+ critical: vulnerabilities.filter(v => v.severity === 'CRITICAL').length,
34
+ high: vulnerabilities.filter(v => v.severity === 'HIGH').length,
35
+ medium: vulnerabilities.filter(v => v.severity === 'MEDIUM').length,
36
+ low: vulnerabilities.filter(v => v.severity === 'LOW').length,
37
+ none: vulnerabilities.filter(v => v.severity === 'NONE').length,
38
+ };
39
+ return {
40
+ projectName: 'test-project',
41
+ projectVersion: '1.0.0',
42
+ scanTimestamp: new Date().toISOString(),
43
+ totalPackages: 10,
44
+ directDependencies: 5,
45
+ transitiveDependencies: 5,
46
+ vulnerabilities,
47
+ summary,
48
+ durationMs: 1000,
49
+ errors: [],
50
+ warnings: [],
51
+ };
52
+ }
53
+ describe('ReportGenerator', () => {
54
+ describe('constructor', () => {
55
+ it('should create generator with default options', () => {
56
+ const generator = new ReportGenerator();
57
+ expect(generator).toBeInstanceOf(ReportGenerator);
58
+ });
59
+ it('should accept custom options', () => {
60
+ const generator = new ReportGenerator({
61
+ title: 'Custom Report',
62
+ includeDetails: false,
63
+ minSeverity: 'HIGH',
64
+ });
65
+ expect(generator).toBeInstanceOf(ReportGenerator);
66
+ });
67
+ });
68
+ describe('Markdown generation', () => {
69
+ it('should generate markdown report with no vulnerabilities', () => {
70
+ const generator = new ReportGenerator();
71
+ const result = createMockScanResult([]);
72
+ const report = generator.generate(result, 'markdown');
73
+ expect(report).toContain('# Vulnerability Scan Report');
74
+ expect(report).toContain('No Vulnerabilities Found');
75
+ });
76
+ it('should generate markdown report with vulnerabilities', () => {
77
+ const generator = new ReportGenerator();
78
+ const result = createMockScanResult([
79
+ { cveId: 'CVE-2024-12345', severity: 'HIGH', cvssScore: 8.0 },
80
+ { cveId: 'CVE-2024-12346', severity: 'CRITICAL', cvssScore: 9.5 },
81
+ ]);
82
+ const report = generator.generate(result, 'markdown');
83
+ expect(report).toContain('CVE-2024-12345');
84
+ expect(report).toContain('CVE-2024-12346');
85
+ expect(report).toContain('HIGH');
86
+ expect(report).toContain('CRITICAL');
87
+ });
88
+ it('should group vulnerabilities by severity', () => {
89
+ const generator = new ReportGenerator({ groupBySeverity: true });
90
+ const result = createMockScanResult([
91
+ { cveId: 'CVE-2024-0001', severity: 'CRITICAL' },
92
+ { cveId: 'CVE-2024-0002', severity: 'HIGH' },
93
+ { cveId: 'CVE-2024-0003', severity: 'MEDIUM' },
94
+ ]);
95
+ const report = generator.generate(result, 'markdown');
96
+ expect(report).toContain('### 🔴 CRITICAL');
97
+ expect(report).toContain('### 🟠 HIGH');
98
+ expect(report).toContain('### 🟡 MEDIUM');
99
+ });
100
+ it('should include metadata when configured', () => {
101
+ const generator = new ReportGenerator({ includeMetadata: true });
102
+ const result = createMockScanResult([]);
103
+ const report = generator.generate(result, 'markdown');
104
+ expect(report).toContain('Scan Summary');
105
+ expect(report).toContain('test-project');
106
+ });
107
+ it('should include remediation suggestions', () => {
108
+ const generator = new ReportGenerator({ includeRemediation: true });
109
+ const result = createMockScanResult([
110
+ { cveId: 'CVE-2024-12345', fixedVersion: '2.0.0' },
111
+ ]);
112
+ const report = generator.generate(result, 'markdown');
113
+ expect(report).toContain('Fix Available');
114
+ expect(report).toContain('2.0.0');
115
+ });
116
+ it('should include CWEs and references', () => {
117
+ const generator = new ReportGenerator({ includeDetails: true });
118
+ const result = createMockScanResult([
119
+ {
120
+ cveId: 'CVE-2024-12345',
121
+ cwes: ['CWE-79', 'CWE-89'],
122
+ references: ['https://example.com/advisory'],
123
+ },
124
+ ]);
125
+ const report = generator.generate(result, 'markdown');
126
+ expect(report).toContain('CWE-79');
127
+ expect(report).toContain('CWE-89');
128
+ expect(report).toContain('References');
129
+ });
130
+ });
131
+ describe('JSON generation', () => {
132
+ it('should generate valid JSON', () => {
133
+ const generator = new ReportGenerator();
134
+ const result = createMockScanResult([]);
135
+ const report = generator.generate(result, 'json');
136
+ expect(() => JSON.parse(report)).not.toThrow();
137
+ });
138
+ it('should include meta information', () => {
139
+ const generator = new ReportGenerator({ title: 'Custom Report' });
140
+ const result = createMockScanResult([]);
141
+ const report = generator.generate(result, 'json');
142
+ const parsed = JSON.parse(report);
143
+ expect(parsed.meta.title).toBe('Custom Report');
144
+ expect(parsed.meta.generator).toBe('MUSUBIX Security Scanner');
145
+ });
146
+ it('should include vulnerability details', () => {
147
+ const generator = new ReportGenerator();
148
+ const result = createMockScanResult([
149
+ { cveId: 'CVE-2024-12345', packageName: 'lodash', installedVersion: '4.17.20' },
150
+ ]);
151
+ const report = generator.generate(result, 'json');
152
+ const parsed = JSON.parse(report);
153
+ expect(parsed.vulnerabilities).toHaveLength(1);
154
+ expect(parsed.vulnerabilities[0].id).toBe('CVE-2024-12345');
155
+ expect(parsed.vulnerabilities[0].package.name).toBe('lodash');
156
+ expect(parsed.vulnerabilities[0].package.version).toBe('4.17.20');
157
+ });
158
+ });
159
+ describe('SARIF generation', () => {
160
+ it('should generate valid SARIF 2.1.0', () => {
161
+ const generator = new ReportGenerator();
162
+ const result = createMockScanResult([]);
163
+ const report = generator.generate(result, 'sarif');
164
+ const sarif = JSON.parse(report);
165
+ expect(sarif.$schema).toContain('sarif-schema-2.1.0');
166
+ expect(sarif.version).toBe('2.1.0');
167
+ });
168
+ it('should include tool information', () => {
169
+ const generator = new ReportGenerator();
170
+ const result = createMockScanResult([]);
171
+ const report = generator.generate(result, 'sarif');
172
+ const sarif = JSON.parse(report);
173
+ expect(sarif.runs[0].tool.driver.name).toBe('MUSUBIX Security Scanner');
174
+ });
175
+ it('should create rules for vulnerabilities', () => {
176
+ const generator = new ReportGenerator();
177
+ const result = createMockScanResult([
178
+ { cveId: 'CVE-2024-12345', severity: 'HIGH', cvssScore: 8.0 },
179
+ ]);
180
+ const report = generator.generate(result, 'sarif');
181
+ const sarif = JSON.parse(report);
182
+ expect(sarif.runs[0].tool.driver.rules).toHaveLength(1);
183
+ expect(sarif.runs[0].tool.driver.rules[0].id).toBe('CVE-2024-12345');
184
+ });
185
+ it('should create results for vulnerabilities', () => {
186
+ const generator = new ReportGenerator();
187
+ const result = createMockScanResult([
188
+ { cveId: 'CVE-2024-12345', packageName: 'express' },
189
+ ]);
190
+ const report = generator.generate(result, 'sarif');
191
+ const sarif = JSON.parse(report);
192
+ expect(sarif.runs[0].results).toHaveLength(1);
193
+ expect(sarif.runs[0].results[0].ruleId).toBe('CVE-2024-12345');
194
+ expect(sarif.runs[0].results[0].properties.packageName).toBe('express');
195
+ });
196
+ it('should map severity to SARIF level', () => {
197
+ const generator = new ReportGenerator();
198
+ const result = createMockScanResult([
199
+ { cveId: 'CVE-2024-0001', severity: 'CRITICAL' },
200
+ { cveId: 'CVE-2024-0002', severity: 'MEDIUM' },
201
+ { cveId: 'CVE-2024-0003', severity: 'LOW' },
202
+ ]);
203
+ const report = generator.generate(result, 'sarif');
204
+ const sarif = JSON.parse(report);
205
+ const levels = sarif.runs[0].results.map((r) => r.level);
206
+ expect(levels).toContain('error'); // CRITICAL
207
+ expect(levels).toContain('warning'); // MEDIUM
208
+ expect(levels).toContain('note'); // LOW
209
+ });
210
+ });
211
+ describe('severity filtering', () => {
212
+ it('should filter by minimum severity', () => {
213
+ const generator = new ReportGenerator({ minSeverity: 'HIGH' });
214
+ const result = createMockScanResult([
215
+ { cveId: 'CVE-2024-0001', severity: 'CRITICAL' },
216
+ { cveId: 'CVE-2024-0002', severity: 'HIGH' },
217
+ { cveId: 'CVE-2024-0003', severity: 'MEDIUM' },
218
+ { cveId: 'CVE-2024-0004', severity: 'LOW' },
219
+ ]);
220
+ const report = generator.generate(result, 'json');
221
+ const parsed = JSON.parse(report);
222
+ // Should only include CRITICAL and HIGH
223
+ expect(parsed.vulnerabilities).toHaveLength(2);
224
+ expect(parsed.vulnerabilities.some((v) => v.severity === 'MEDIUM')).toBe(false);
225
+ expect(parsed.vulnerabilities.some((v) => v.severity === 'LOW')).toBe(false);
226
+ });
227
+ });
228
+ });
229
+ describe('generateReport', () => {
230
+ it('should generate report with quick function', () => {
231
+ const result = createMockScanResult([]);
232
+ const report = generateReport(result, 'markdown');
233
+ expect(report).toContain('Vulnerability Scan Report');
234
+ });
235
+ it('should accept options', () => {
236
+ const result = createMockScanResult([]);
237
+ const report = generateReport(result, 'markdown', {
238
+ title: 'Custom Title',
239
+ });
240
+ expect(report).toContain('Custom Title');
241
+ });
242
+ });
243
+ describe('generateReportToFile', () => {
244
+ let tempDir;
245
+ beforeEach(() => {
246
+ tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'report-gen-test-'));
247
+ });
248
+ afterEach(() => {
249
+ fs.rmSync(tempDir, { recursive: true, force: true });
250
+ });
251
+ it('should write report to file', async () => {
252
+ const result = createMockScanResult([]);
253
+ const filePath = path.join(tempDir, 'report.md');
254
+ await generateReportToFile(result, filePath, 'markdown');
255
+ expect(fs.existsSync(filePath)).toBe(true);
256
+ const content = fs.readFileSync(filePath, 'utf-8');
257
+ expect(content).toContain('Vulnerability Scan Report');
258
+ });
259
+ });
260
+ describe('getFormatFromExtension', () => {
261
+ it('should detect markdown format', () => {
262
+ expect(getFormatFromExtension('report.md')).toBe('markdown');
263
+ expect(getFormatFromExtension('report.markdown')).toBe('markdown');
264
+ });
265
+ it('should detect SARIF format', () => {
266
+ expect(getFormatFromExtension('report.sarif')).toBe('sarif');
267
+ });
268
+ it('should detect JSON format', () => {
269
+ expect(getFormatFromExtension('report.json')).toBe('json');
270
+ });
271
+ it('should default to JSON for unknown extensions', () => {
272
+ expect(getFormatFromExtension('report.txt')).toBe('json');
273
+ });
274
+ });
275
+ //# sourceMappingURL=report-generator.test.js.map