@nahisaho/musubix-security 2.0.1 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/enhanced-taint-analyzer.d.ts +120 -0
- package/dist/analysis/enhanced-taint-analyzer.d.ts.map +1 -0
- package/dist/analysis/enhanced-taint-analyzer.js +450 -0
- package/dist/analysis/enhanced-taint-analyzer.js.map +1 -0
- package/dist/analysis/index.d.ts +1 -0
- package/dist/analysis/index.d.ts.map +1 -1
- package/dist/analysis/index.js +1 -0
- package/dist/analysis/index.js.map +1 -1
- package/dist/analysis/interprocedural/call-graph-builder.d.ts +192 -0
- package/dist/analysis/interprocedural/call-graph-builder.d.ts.map +1 -0
- package/dist/analysis/interprocedural/call-graph-builder.js +510 -0
- package/dist/analysis/interprocedural/call-graph-builder.js.map +1 -0
- package/dist/analysis/interprocedural/dfg-adapter.d.ts +166 -0
- package/dist/analysis/interprocedural/dfg-adapter.d.ts.map +1 -0
- package/dist/analysis/interprocedural/dfg-adapter.js +455 -0
- package/dist/analysis/interprocedural/dfg-adapter.js.map +1 -0
- package/dist/analysis/interprocedural/index.d.ts +9 -0
- package/dist/analysis/interprocedural/index.d.ts.map +1 -0
- package/dist/analysis/interprocedural/index.js +9 -0
- package/dist/analysis/interprocedural/index.js.map +1 -0
- package/dist/analysis/interprocedural/taint-propagator.d.ts +250 -0
- package/dist/analysis/interprocedural/taint-propagator.d.ts.map +1 -0
- package/dist/analysis/interprocedural/taint-propagator.js +435 -0
- package/dist/analysis/interprocedural/taint-propagator.js.map +1 -0
- package/dist/analysis/sanitizers/command-sanitizers.d.ts +12 -0
- package/dist/analysis/sanitizers/command-sanitizers.d.ts.map +1 -0
- package/dist/analysis/sanitizers/command-sanitizers.js +123 -0
- package/dist/analysis/sanitizers/command-sanitizers.js.map +1 -0
- package/dist/analysis/sanitizers/html-sanitizers.d.ts +12 -0
- package/dist/analysis/sanitizers/html-sanitizers.d.ts.map +1 -0
- package/dist/analysis/sanitizers/html-sanitizers.js +213 -0
- package/dist/analysis/sanitizers/html-sanitizers.js.map +1 -0
- package/dist/analysis/sanitizers/index.d.ts +35 -0
- package/dist/analysis/sanitizers/index.d.ts.map +1 -0
- package/dist/analysis/sanitizers/index.js +59 -0
- package/dist/analysis/sanitizers/index.js.map +1 -0
- package/dist/analysis/sanitizers/path-sanitizers.d.ts +12 -0
- package/dist/analysis/sanitizers/path-sanitizers.d.ts.map +1 -0
- package/dist/analysis/sanitizers/path-sanitizers.js +163 -0
- package/dist/analysis/sanitizers/path-sanitizers.js.map +1 -0
- package/dist/analysis/sanitizers/sql-sanitizers.d.ts +12 -0
- package/dist/analysis/sanitizers/sql-sanitizers.d.ts.map +1 -0
- package/dist/analysis/sanitizers/sql-sanitizers.js +216 -0
- package/dist/analysis/sanitizers/sql-sanitizers.js.map +1 -0
- package/dist/analysis/sanitizers/types.d.ts +78 -0
- package/dist/analysis/sanitizers/types.d.ts.map +1 -0
- package/dist/analysis/sanitizers/types.js +7 -0
- package/dist/analysis/sanitizers/types.js.map +1 -0
- package/dist/analysis/sanitizers/validation-sanitizers.d.ts +12 -0
- package/dist/analysis/sanitizers/validation-sanitizers.d.ts.map +1 -0
- package/dist/analysis/sanitizers/validation-sanitizers.js +268 -0
- package/dist/analysis/sanitizers/validation-sanitizers.js.map +1 -0
- package/dist/analysis/sinks/code-eval.d.ts +12 -0
- package/dist/analysis/sinks/code-eval.d.ts.map +1 -0
- package/dist/analysis/sinks/code-eval.js +231 -0
- package/dist/analysis/sinks/code-eval.js.map +1 -0
- package/dist/analysis/sinks/command-exec.d.ts +12 -0
- package/dist/analysis/sinks/command-exec.d.ts.map +1 -0
- package/dist/analysis/sinks/command-exec.js +187 -0
- package/dist/analysis/sinks/command-exec.js.map +1 -0
- package/dist/analysis/sinks/file-operations.d.ts +12 -0
- package/dist/analysis/sinks/file-operations.d.ts.map +1 -0
- package/dist/analysis/sinks/file-operations.js +239 -0
- package/dist/analysis/sinks/file-operations.js.map +1 -0
- package/dist/analysis/sinks/html-output.d.ts +12 -0
- package/dist/analysis/sinks/html-output.d.ts.map +1 -0
- package/dist/analysis/sinks/html-output.js +256 -0
- package/dist/analysis/sinks/html-output.js.map +1 -0
- package/dist/analysis/sinks/index.d.ts +30 -0
- package/dist/analysis/sinks/index.d.ts.map +1 -0
- package/dist/analysis/sinks/index.js +46 -0
- package/dist/analysis/sinks/index.js.map +1 -0
- package/dist/analysis/sinks/sql-query.d.ts +12 -0
- package/dist/analysis/sinks/sql-query.d.ts.map +1 -0
- package/dist/analysis/sinks/sql-query.js +209 -0
- package/dist/analysis/sinks/sql-query.js.map +1 -0
- package/dist/analysis/sinks/types.d.ts +97 -0
- package/dist/analysis/sinks/types.d.ts.map +1 -0
- package/dist/analysis/sinks/types.js +7 -0
- package/dist/analysis/sinks/types.js.map +1 -0
- package/dist/analysis/sources/database.d.ts +12 -0
- package/dist/analysis/sources/database.d.ts.map +1 -0
- package/dist/analysis/sources/database.js +211 -0
- package/dist/analysis/sources/database.js.map +1 -0
- package/dist/analysis/sources/environment.d.ts +12 -0
- package/dist/analysis/sources/environment.d.ts.map +1 -0
- package/dist/analysis/sources/environment.js +158 -0
- package/dist/analysis/sources/environment.js.map +1 -0
- package/dist/analysis/sources/file-system.d.ts +12 -0
- package/dist/analysis/sources/file-system.d.ts.map +1 -0
- package/dist/analysis/sources/file-system.js +180 -0
- package/dist/analysis/sources/file-system.js.map +1 -0
- package/dist/analysis/sources/http-request.d.ts +12 -0
- package/dist/analysis/sources/http-request.d.ts.map +1 -0
- package/dist/analysis/sources/http-request.js +179 -0
- package/dist/analysis/sources/http-request.js.map +1 -0
- package/dist/analysis/sources/index.d.ts +26 -0
- package/dist/analysis/sources/index.d.ts.map +1 -0
- package/dist/analysis/sources/index.js +40 -0
- package/dist/analysis/sources/index.js.map +1 -0
- package/dist/analysis/sources/types.d.ts +93 -0
- package/dist/analysis/sources/types.d.ts.map +1 -0
- package/dist/analysis/sources/types.js +7 -0
- package/dist/analysis/sources/types.js.map +1 -0
- package/dist/analysis/sources/user-input.d.ts +12 -0
- package/dist/analysis/sources/user-input.d.ts.map +1 -0
- package/dist/analysis/sources/user-input.js +261 -0
- package/dist/analysis/sources/user-input.js.map +1 -0
- package/dist/cve/cpe-matcher.d.ts +183 -0
- package/dist/cve/cpe-matcher.d.ts.map +1 -0
- package/dist/cve/cpe-matcher.js +396 -0
- package/dist/cve/cpe-matcher.js.map +1 -0
- package/dist/cve/cve-cache.d.ts +225 -0
- package/dist/cve/cve-cache.d.ts.map +1 -0
- package/dist/cve/cve-cache.js +452 -0
- package/dist/cve/cve-cache.js.map +1 -0
- package/dist/cve/cve-cache.test.d.ts +6 -0
- package/dist/cve/cve-cache.test.d.ts.map +1 -0
- package/dist/cve/cve-cache.test.js +363 -0
- package/dist/cve/cve-cache.test.js.map +1 -0
- package/dist/cve/dependency-parser.d.ts +204 -0
- package/dist/cve/dependency-parser.d.ts.map +1 -0
- package/dist/cve/dependency-parser.js +338 -0
- package/dist/cve/dependency-parser.js.map +1 -0
- package/dist/cve/index.d.ts +20 -0
- package/dist/cve/index.d.ts.map +1 -0
- package/dist/cve/index.js +13 -0
- package/dist/cve/index.js.map +1 -0
- package/dist/cve/nvd-client.d.ts +137 -0
- package/dist/cve/nvd-client.d.ts.map +1 -0
- package/dist/cve/nvd-client.js +333 -0
- package/dist/cve/nvd-client.js.map +1 -0
- package/dist/cve/rate-limiter.d.ts +194 -0
- package/dist/cve/rate-limiter.d.ts.map +1 -0
- package/dist/cve/rate-limiter.js +276 -0
- package/dist/cve/rate-limiter.js.map +1 -0
- package/dist/cve/report-generator.d.ts +145 -0
- package/dist/cve/report-generator.d.ts.map +1 -0
- package/dist/cve/report-generator.js +377 -0
- package/dist/cve/report-generator.js.map +1 -0
- package/dist/cve/report-generator.test.d.ts +6 -0
- package/dist/cve/report-generator.test.d.ts.map +1 -0
- package/dist/cve/report-generator.test.js +275 -0
- package/dist/cve/report-generator.test.js.map +1 -0
- package/dist/cve/vulnerability-scanner.d.ts +198 -0
- package/dist/cve/vulnerability-scanner.d.ts.map +1 -0
- package/dist/cve/vulnerability-scanner.js +311 -0
- package/dist/cve/vulnerability-scanner.js.map +1 -0
- package/dist/cve/vulnerability-scanner.test.d.ts +6 -0
- package/dist/cve/vulnerability-scanner.test.d.ts.map +1 -0
- package/dist/cve/vulnerability-scanner.test.js +329 -0
- package/dist/cve/vulnerability-scanner.test.js.map +1 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/rules/config/config-parser.d.ts +119 -0
- package/dist/rules/config/config-parser.d.ts.map +1 -0
- package/dist/rules/config/config-parser.js +376 -0
- package/dist/rules/config/config-parser.js.map +1 -0
- package/dist/rules/config/index.d.ts +8 -0
- package/dist/rules/config/index.d.ts.map +1 -0
- package/dist/rules/config/index.js +8 -0
- package/dist/rules/config/index.js.map +1 -0
- package/dist/rules/config/profiles.d.ts +85 -0
- package/dist/rules/config/profiles.d.ts.map +1 -0
- package/dist/rules/config/profiles.js +226 -0
- package/dist/rules/config/profiles.js.map +1 -0
- package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts +9 -0
- package/dist/rules/cwe/cwe-119-buffer-overflow.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-119-buffer-overflow.js +54 -0
- package/dist/rules/cwe/cwe-119-buffer-overflow.js.map +1 -0
- package/dist/rules/cwe/cwe-125-oob-read.d.ts +20 -0
- package/dist/rules/cwe/cwe-125-oob-read.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-125-oob-read.js +247 -0
- package/dist/rules/cwe/cwe-125-oob-read.js.map +1 -0
- package/dist/rules/cwe/cwe-190-integer-overflow.d.ts +9 -0
- package/dist/rules/cwe/cwe-190-integer-overflow.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-190-integer-overflow.js +55 -0
- package/dist/rules/cwe/cwe-190-integer-overflow.js.map +1 -0
- package/dist/rules/cwe/cwe-20-input-validation.d.ts +21 -0
- package/dist/rules/cwe/cwe-20-input-validation.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-20-input-validation.js +342 -0
- package/dist/rules/cwe/cwe-20-input-validation.js.map +1 -0
- package/dist/rules/cwe/cwe-22-path-traversal.d.ts +20 -0
- package/dist/rules/cwe/cwe-22-path-traversal.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-22-path-traversal.js +306 -0
- package/dist/rules/cwe/cwe-22-path-traversal.js.map +1 -0
- package/dist/rules/cwe/cwe-269-improper-privilege.d.ts +9 -0
- package/dist/rules/cwe/cwe-269-improper-privilege.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-269-improper-privilege.js +58 -0
- package/dist/rules/cwe/cwe-269-improper-privilege.js.map +1 -0
- package/dist/rules/cwe/cwe-276-default-permissions.d.ts +9 -0
- package/dist/rules/cwe/cwe-276-default-permissions.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-276-default-permissions.js +54 -0
- package/dist/rules/cwe/cwe-276-default-permissions.js.map +1 -0
- package/dist/rules/cwe/cwe-287-improper-auth.d.ts +9 -0
- package/dist/rules/cwe/cwe-287-improper-auth.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-287-improper-auth.js +57 -0
- package/dist/rules/cwe/cwe-287-improper-auth.js.map +1 -0
- package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts +9 -0
- package/dist/rules/cwe/cwe-306-missing-auth-critical.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-306-missing-auth-critical.js +53 -0
- package/dist/rules/cwe/cwe-306-missing-auth-critical.js.map +1 -0
- package/dist/rules/cwe/cwe-352-csrf.d.ts +9 -0
- package/dist/rules/cwe/cwe-352-csrf.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-352-csrf.js +51 -0
- package/dist/rules/cwe/cwe-352-csrf.js.map +1 -0
- package/dist/rules/cwe/cwe-362-race-condition.d.ts +9 -0
- package/dist/rules/cwe/cwe-362-race-condition.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-362-race-condition.js +55 -0
- package/dist/rules/cwe/cwe-362-race-condition.js.map +1 -0
- package/dist/rules/cwe/cwe-416-use-after-free.d.ts +23 -0
- package/dist/rules/cwe/cwe-416-use-after-free.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-416-use-after-free.js +402 -0
- package/dist/rules/cwe/cwe-416-use-after-free.js.map +1 -0
- package/dist/rules/cwe/cwe-434-file-upload.d.ts +9 -0
- package/dist/rules/cwe/cwe-434-file-upload.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-434-file-upload.js +55 -0
- package/dist/rules/cwe/cwe-434-file-upload.js.map +1 -0
- package/dist/rules/cwe/cwe-476-null-deref.d.ts +9 -0
- package/dist/rules/cwe/cwe-476-null-deref.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-476-null-deref.js +55 -0
- package/dist/rules/cwe/cwe-476-null-deref.js.map +1 -0
- package/dist/rules/cwe/cwe-502-deserialization.d.ts +9 -0
- package/dist/rules/cwe/cwe-502-deserialization.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-502-deserialization.js +57 -0
- package/dist/rules/cwe/cwe-502-deserialization.js.map +1 -0
- package/dist/rules/cwe/cwe-77-command-injection.d.ts +9 -0
- package/dist/rules/cwe/cwe-77-command-injection.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-77-command-injection.js +55 -0
- package/dist/rules/cwe/cwe-77-command-injection.js.map +1 -0
- package/dist/rules/cwe/cwe-78-command-injection.d.ts +20 -0
- package/dist/rules/cwe/cwe-78-command-injection.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-78-command-injection.js +259 -0
- package/dist/rules/cwe/cwe-78-command-injection.js.map +1 -0
- package/dist/rules/cwe/cwe-787-oob-write.d.ts +21 -0
- package/dist/rules/cwe/cwe-787-oob-write.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-787-oob-write.js +321 -0
- package/dist/rules/cwe/cwe-787-oob-write.js.map +1 -0
- package/dist/rules/cwe/cwe-79-xss.d.ts +22 -0
- package/dist/rules/cwe/cwe-79-xss.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-79-xss.js +386 -0
- package/dist/rules/cwe/cwe-79-xss.js.map +1 -0
- package/dist/rules/cwe/cwe-798-hardcoded-credentials.d.ts +9 -0
- package/dist/rules/cwe/cwe-798-hardcoded-credentials.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-798-hardcoded-credentials.js +58 -0
- package/dist/rules/cwe/cwe-798-hardcoded-credentials.js.map +1 -0
- package/dist/rules/cwe/cwe-862-missing-auth.d.ts +9 -0
- package/dist/rules/cwe/cwe-862-missing-auth.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-862-missing-auth.js +55 -0
- package/dist/rules/cwe/cwe-862-missing-auth.js.map +1 -0
- package/dist/rules/cwe/cwe-863-incorrect-auth.d.ts +9 -0
- package/dist/rules/cwe/cwe-863-incorrect-auth.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-863-incorrect-auth.js +58 -0
- package/dist/rules/cwe/cwe-863-incorrect-auth.js.map +1 -0
- package/dist/rules/cwe/cwe-89-sql-injection.d.ts +21 -0
- package/dist/rules/cwe/cwe-89-sql-injection.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-89-sql-injection.js +456 -0
- package/dist/rules/cwe/cwe-89-sql-injection.js.map +1 -0
- package/dist/rules/cwe/cwe-918-ssrf.d.ts +9 -0
- package/dist/rules/cwe/cwe-918-ssrf.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-918-ssrf.js +59 -0
- package/dist/rules/cwe/cwe-918-ssrf.js.map +1 -0
- package/dist/rules/cwe/cwe-94-code-injection.d.ts +9 -0
- package/dist/rules/cwe/cwe-94-code-injection.d.ts.map +1 -0
- package/dist/rules/cwe/cwe-94-code-injection.js +59 -0
- package/dist/rules/cwe/cwe-94-code-injection.js.map +1 -0
- package/dist/rules/cwe/index.d.ts +43 -0
- package/dist/rules/cwe/index.d.ts.map +1 -0
- package/dist/rules/cwe/index.js +99 -0
- package/dist/rules/cwe/index.js.map +1 -0
- package/dist/rules/engine/index.d.ts +10 -0
- package/dist/rules/engine/index.d.ts.map +1 -0
- package/dist/rules/engine/index.js +9 -0
- package/dist/rules/engine/index.js.map +1 -0
- package/dist/rules/engine/rule-context.d.ts +99 -0
- package/dist/rules/engine/rule-context.d.ts.map +1 -0
- package/dist/rules/engine/rule-context.js +175 -0
- package/dist/rules/engine/rule-context.js.map +1 -0
- package/dist/rules/engine/rule-engine.d.ts +132 -0
- package/dist/rules/engine/rule-engine.d.ts.map +1 -0
- package/dist/rules/engine/rule-engine.js +379 -0
- package/dist/rules/engine/rule-engine.js.map +1 -0
- package/dist/rules/engine/rule-registry.d.ts +133 -0
- package/dist/rules/engine/rule-registry.d.ts.map +1 -0
- package/dist/rules/engine/rule-registry.js +281 -0
- package/dist/rules/engine/rule-registry.js.map +1 -0
- package/dist/rules/index.d.ts +14 -0
- package/dist/rules/index.d.ts.map +1 -0
- package/dist/rules/index.js +16 -0
- package/dist/rules/index.js.map +1 -0
- package/dist/rules/owasp/a01-broken-access-control.d.ts +19 -0
- package/dist/rules/owasp/a01-broken-access-control.d.ts.map +1 -0
- package/dist/rules/owasp/a01-broken-access-control.js +295 -0
- package/dist/rules/owasp/a01-broken-access-control.js.map +1 -0
- package/dist/rules/owasp/a02-cryptographic-failures.d.ts +19 -0
- package/dist/rules/owasp/a02-cryptographic-failures.d.ts.map +1 -0
- package/dist/rules/owasp/a02-cryptographic-failures.js +327 -0
- package/dist/rules/owasp/a02-cryptographic-failures.js.map +1 -0
- package/dist/rules/owasp/a03-injection.d.ts +21 -0
- package/dist/rules/owasp/a03-injection.d.ts.map +1 -0
- package/dist/rules/owasp/a03-injection.js +342 -0
- package/dist/rules/owasp/a03-injection.js.map +1 -0
- package/dist/rules/owasp/a04-insecure-design.d.ts +19 -0
- package/dist/rules/owasp/a04-insecure-design.d.ts.map +1 -0
- package/dist/rules/owasp/a04-insecure-design.js +403 -0
- package/dist/rules/owasp/a04-insecure-design.js.map +1 -0
- package/dist/rules/owasp/a05-security-misconfiguration.d.ts +19 -0
- package/dist/rules/owasp/a05-security-misconfiguration.d.ts.map +1 -0
- package/dist/rules/owasp/a05-security-misconfiguration.js +371 -0
- package/dist/rules/owasp/a05-security-misconfiguration.js.map +1 -0
- package/dist/rules/owasp/a06-vulnerable-components.d.ts +18 -0
- package/dist/rules/owasp/a06-vulnerable-components.d.ts.map +1 -0
- package/dist/rules/owasp/a06-vulnerable-components.js +243 -0
- package/dist/rules/owasp/a06-vulnerable-components.js.map +1 -0
- package/dist/rules/owasp/a07-auth-failures.d.ts +19 -0
- package/dist/rules/owasp/a07-auth-failures.d.ts.map +1 -0
- package/dist/rules/owasp/a07-auth-failures.js +300 -0
- package/dist/rules/owasp/a07-auth-failures.js.map +1 -0
- package/dist/rules/owasp/a08-integrity-failures.d.ts +18 -0
- package/dist/rules/owasp/a08-integrity-failures.d.ts.map +1 -0
- package/dist/rules/owasp/a08-integrity-failures.js +306 -0
- package/dist/rules/owasp/a08-integrity-failures.js.map +1 -0
- package/dist/rules/owasp/a09-logging-failures.d.ts +18 -0
- package/dist/rules/owasp/a09-logging-failures.d.ts.map +1 -0
- package/dist/rules/owasp/a09-logging-failures.js +339 -0
- package/dist/rules/owasp/a09-logging-failures.js.map +1 -0
- package/dist/rules/owasp/a10-ssrf.d.ts +18 -0
- package/dist/rules/owasp/a10-ssrf.d.ts.map +1 -0
- package/dist/rules/owasp/a10-ssrf.js +349 -0
- package/dist/rules/owasp/a10-ssrf.js.map +1 -0
- package/dist/rules/owasp/index.d.ts +20 -0
- package/dist/rules/owasp/index.d.ts.map +1 -0
- package/dist/rules/owasp/index.js +53 -0
- package/dist/rules/owasp/index.js.map +1 -0
- package/dist/rules/types.d.ts +277 -0
- package/dist/rules/types.d.ts.map +1 -0
- package/dist/rules/types.js +34 -0
- package/dist/rules/types.js.map +1 -0
- package/dist/tests/integration/epic-integration.test.d.ts +7 -0
- package/dist/tests/integration/epic-integration.test.d.ts.map +1 -0
- package/dist/tests/integration/epic-integration.test.js +390 -0
- package/dist/tests/integration/epic-integration.test.js.map +1 -0
- package/dist/tests/rules/cwe/cwe-top25-1-13.test.d.ts +2 -0
- package/dist/tests/rules/cwe/cwe-top25-1-13.test.d.ts.map +1 -0
- package/dist/tests/rules/cwe/cwe-top25-1-13.test.js +154 -0
- package/dist/tests/rules/cwe/cwe-top25-1-13.test.js.map +1 -0
- package/dist/tests/rules/cwe/cwe-top25-14-25.test.d.ts +2 -0
- package/dist/tests/rules/cwe/cwe-top25-14-25.test.d.ts.map +1 -0
- package/dist/tests/rules/cwe/cwe-top25-14-25.test.js +121 -0
- package/dist/tests/rules/cwe/cwe-top25-14-25.test.js.map +1 -0
- package/dist/types/cve.d.ts +278 -0
- package/dist/types/cve.d.ts.map +1 -0
- package/dist/types/cve.js +7 -0
- package/dist/types/cve.js.map +1 -0
- package/dist/types/index.d.ts +2 -0
- package/dist/types/index.d.ts.map +1 -1
- package/dist/types/rule.d.ts +245 -0
- package/dist/types/rule.d.ts.map +1 -0
- package/dist/types/rule.js +7 -0
- package/dist/types/rule.js.map +1 -0
- package/package.json +1 -1
|
@@ -0,0 +1,377 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @fileoverview CVE Report Generator
|
|
3
|
+
* @module @nahisaho/musubix-security/cve/report-generator
|
|
4
|
+
* @description Generates vulnerability reports in Markdown, JSON, and SARIF formats
|
|
5
|
+
* @requirements REQ-SEC-CVE-003 - CVE report generation with multiple formats
|
|
6
|
+
* @design DES-SEC-CVE-003 - Report generator with SARIF 2.1.0 support
|
|
7
|
+
* @task TSK-CVE-008 - レポート生成
|
|
8
|
+
*/
|
|
9
|
+
/**
|
|
10
|
+
* Severity level mapping
|
|
11
|
+
*/
|
|
12
|
+
const SEVERITY_ORDER = {
|
|
13
|
+
CRITICAL: 0,
|
|
14
|
+
HIGH: 1,
|
|
15
|
+
MEDIUM: 2,
|
|
16
|
+
LOW: 3,
|
|
17
|
+
NONE: 4,
|
|
18
|
+
UNKNOWN: 5,
|
|
19
|
+
};
|
|
20
|
+
/**
|
|
21
|
+
* Get SARIF level from CVSS severity
|
|
22
|
+
*/
|
|
23
|
+
function getSARIFLevel(severity) {
|
|
24
|
+
switch (severity?.toUpperCase()) {
|
|
25
|
+
case 'CRITICAL':
|
|
26
|
+
case 'HIGH':
|
|
27
|
+
return 'error';
|
|
28
|
+
case 'MEDIUM':
|
|
29
|
+
return 'warning';
|
|
30
|
+
case 'LOW':
|
|
31
|
+
return 'note';
|
|
32
|
+
default:
|
|
33
|
+
return 'none';
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Get emoji for severity level
|
|
38
|
+
*/
|
|
39
|
+
function getSeverityEmoji(severity) {
|
|
40
|
+
switch (severity?.toUpperCase()) {
|
|
41
|
+
case 'CRITICAL':
|
|
42
|
+
return '🔴';
|
|
43
|
+
case 'HIGH':
|
|
44
|
+
return '🟠';
|
|
45
|
+
case 'MEDIUM':
|
|
46
|
+
return '🟡';
|
|
47
|
+
case 'LOW':
|
|
48
|
+
return '🟢';
|
|
49
|
+
default:
|
|
50
|
+
return '⚪';
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* CVE Report Generator
|
|
55
|
+
*/
|
|
56
|
+
export class ReportGenerator {
|
|
57
|
+
options;
|
|
58
|
+
constructor(options = {}) {
|
|
59
|
+
this.options = {
|
|
60
|
+
title: options.title ?? 'Vulnerability Scan Report',
|
|
61
|
+
includeDetails: options.includeDetails ?? true,
|
|
62
|
+
includeRemediation: options.includeRemediation ?? true,
|
|
63
|
+
minSeverity: options.minSeverity ?? 'NONE',
|
|
64
|
+
groupBySeverity: options.groupBySeverity ?? true,
|
|
65
|
+
includeMetadata: options.includeMetadata ?? true,
|
|
66
|
+
projectUrl: options.projectUrl ?? '',
|
|
67
|
+
};
|
|
68
|
+
}
|
|
69
|
+
/**
|
|
70
|
+
* Generate report in specified format
|
|
71
|
+
*/
|
|
72
|
+
generate(result, format) {
|
|
73
|
+
const filteredResult = this.filterBySeverity(result);
|
|
74
|
+
switch (format) {
|
|
75
|
+
case 'markdown':
|
|
76
|
+
return this.generateMarkdown(filteredResult);
|
|
77
|
+
case 'json':
|
|
78
|
+
return this.generateJSON(filteredResult);
|
|
79
|
+
case 'sarif':
|
|
80
|
+
return this.generateSARIF(filteredResult);
|
|
81
|
+
default:
|
|
82
|
+
throw new Error(`Unsupported format: ${format}`);
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
/**
|
|
86
|
+
* Filter vulnerabilities by minimum severity
|
|
87
|
+
*/
|
|
88
|
+
filterBySeverity(result) {
|
|
89
|
+
const minLevel = SEVERITY_ORDER[this.options.minSeverity] ?? 4;
|
|
90
|
+
const filtered = result.vulnerabilities.filter(vuln => {
|
|
91
|
+
const level = SEVERITY_ORDER[vuln.severity?.toUpperCase() ?? 'UNKNOWN'] ?? 5;
|
|
92
|
+
return level <= minLevel;
|
|
93
|
+
});
|
|
94
|
+
// Recalculate summary
|
|
95
|
+
const summary = {
|
|
96
|
+
total: filtered.length,
|
|
97
|
+
critical: 0,
|
|
98
|
+
high: 0,
|
|
99
|
+
medium: 0,
|
|
100
|
+
low: 0,
|
|
101
|
+
none: 0,
|
|
102
|
+
};
|
|
103
|
+
for (const vuln of filtered) {
|
|
104
|
+
const sev = vuln.severity?.toLowerCase();
|
|
105
|
+
if (sev && sev in summary && sev !== 'total') {
|
|
106
|
+
summary[sev]++;
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
return {
|
|
110
|
+
...result,
|
|
111
|
+
vulnerabilities: filtered,
|
|
112
|
+
summary,
|
|
113
|
+
};
|
|
114
|
+
}
|
|
115
|
+
/**
|
|
116
|
+
* Generate Markdown report
|
|
117
|
+
*/
|
|
118
|
+
generateMarkdown(result) {
|
|
119
|
+
const lines = [];
|
|
120
|
+
// Title
|
|
121
|
+
lines.push(`# ${this.options.title}`);
|
|
122
|
+
lines.push('');
|
|
123
|
+
// Metadata
|
|
124
|
+
if (this.options.includeMetadata) {
|
|
125
|
+
lines.push('## 📊 Scan Summary');
|
|
126
|
+
lines.push('');
|
|
127
|
+
lines.push(`| Metric | Value |`);
|
|
128
|
+
lines.push(`|--------|-------|`);
|
|
129
|
+
lines.push(`| Project | ${result.projectName ?? 'Unknown'} |`);
|
|
130
|
+
lines.push(`| Scan Time | ${result.scanTimestamp} |`);
|
|
131
|
+
lines.push(`| Duration | ${result.durationMs}ms |`);
|
|
132
|
+
lines.push(`| Packages Scanned | ${result.totalPackages} |`);
|
|
133
|
+
lines.push(`| Total Vulnerabilities | ${result.summary.total} |`);
|
|
134
|
+
lines.push('');
|
|
135
|
+
}
|
|
136
|
+
// Severity breakdown
|
|
137
|
+
lines.push('## 🎯 Severity Breakdown');
|
|
138
|
+
lines.push('');
|
|
139
|
+
lines.push(`| Severity | Count |`);
|
|
140
|
+
lines.push(`|----------|-------|`);
|
|
141
|
+
lines.push(`| 🔴 Critical | ${result.summary.critical} |`);
|
|
142
|
+
lines.push(`| 🟠 High | ${result.summary.high} |`);
|
|
143
|
+
lines.push(`| 🟡 Medium | ${result.summary.medium} |`);
|
|
144
|
+
lines.push(`| 🟢 Low | ${result.summary.low} |`);
|
|
145
|
+
lines.push('');
|
|
146
|
+
// Vulnerabilities
|
|
147
|
+
if (result.vulnerabilities.length === 0) {
|
|
148
|
+
lines.push('## ✅ No Vulnerabilities Found');
|
|
149
|
+
lines.push('');
|
|
150
|
+
lines.push('Great news! No vulnerabilities were detected in the scanned packages.');
|
|
151
|
+
return lines.join('\n');
|
|
152
|
+
}
|
|
153
|
+
lines.push('## 🔒 Detected Vulnerabilities');
|
|
154
|
+
lines.push('');
|
|
155
|
+
if (this.options.groupBySeverity) {
|
|
156
|
+
const grouped = this.groupBySeverity(result.vulnerabilities);
|
|
157
|
+
for (const [severity, vulns] of grouped) {
|
|
158
|
+
if (vulns.length === 0)
|
|
159
|
+
continue;
|
|
160
|
+
lines.push(`### ${getSeverityEmoji(severity)} ${severity} (${vulns.length})`);
|
|
161
|
+
lines.push('');
|
|
162
|
+
for (const vuln of vulns) {
|
|
163
|
+
lines.push(...this.formatVulnerabilityMarkdown(vuln));
|
|
164
|
+
}
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
else {
|
|
168
|
+
for (const vuln of result.vulnerabilities) {
|
|
169
|
+
lines.push(...this.formatVulnerabilityMarkdown(vuln));
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
return lines.join('\n');
|
|
173
|
+
}
|
|
174
|
+
/**
|
|
175
|
+
* Format a single vulnerability as Markdown
|
|
176
|
+
*/
|
|
177
|
+
formatVulnerabilityMarkdown(vuln) {
|
|
178
|
+
const lines = [];
|
|
179
|
+
lines.push(`#### ${vuln.cveId}`);
|
|
180
|
+
lines.push('');
|
|
181
|
+
lines.push(`**Package:** \`${vuln.packageName}@${vuln.installedVersion}\``);
|
|
182
|
+
if (vuln.cvssScore !== undefined) {
|
|
183
|
+
lines.push(`**CVSS Score:** ${vuln.cvssScore.toFixed(1)} (${vuln.severity})`);
|
|
184
|
+
}
|
|
185
|
+
if (this.options.includeDetails) {
|
|
186
|
+
lines.push('');
|
|
187
|
+
lines.push(`**Description:** ${vuln.description ?? 'No description available'}`);
|
|
188
|
+
if (vuln.cwes && vuln.cwes.length > 0) {
|
|
189
|
+
lines.push(`**CWEs:** ${vuln.cwes.join(', ')}`);
|
|
190
|
+
}
|
|
191
|
+
if (vuln.references && vuln.references.length > 0) {
|
|
192
|
+
lines.push('');
|
|
193
|
+
lines.push('**References:**');
|
|
194
|
+
for (const ref of vuln.references.slice(0, 3)) {
|
|
195
|
+
lines.push(`- [Link](${ref})`);
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
}
|
|
199
|
+
if (this.options.includeRemediation && vuln.fixedVersion) {
|
|
200
|
+
lines.push('');
|
|
201
|
+
lines.push(`**✅ Fix Available:** Upgrade to \`${vuln.packageName}@${vuln.fixedVersion}\` or later`);
|
|
202
|
+
}
|
|
203
|
+
lines.push('');
|
|
204
|
+
lines.push('---');
|
|
205
|
+
lines.push('');
|
|
206
|
+
return lines;
|
|
207
|
+
}
|
|
208
|
+
/**
|
|
209
|
+
* Group vulnerabilities by severity
|
|
210
|
+
*/
|
|
211
|
+
groupBySeverity(vulns) {
|
|
212
|
+
const groups = new Map([
|
|
213
|
+
['CRITICAL', []],
|
|
214
|
+
['HIGH', []],
|
|
215
|
+
['MEDIUM', []],
|
|
216
|
+
['LOW', []],
|
|
217
|
+
]);
|
|
218
|
+
for (const vuln of vulns) {
|
|
219
|
+
const severity = vuln.severity?.toUpperCase() ?? 'UNKNOWN';
|
|
220
|
+
const group = groups.get(severity) ?? [];
|
|
221
|
+
group.push(vuln);
|
|
222
|
+
if (!groups.has(severity)) {
|
|
223
|
+
groups.set(severity, group);
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
return groups;
|
|
227
|
+
}
|
|
228
|
+
/**
|
|
229
|
+
* Generate JSON report
|
|
230
|
+
*/
|
|
231
|
+
generateJSON(result) {
|
|
232
|
+
const report = {
|
|
233
|
+
meta: {
|
|
234
|
+
title: this.options.title,
|
|
235
|
+
generated: new Date().toISOString(),
|
|
236
|
+
generator: 'MUSUBIX Security Scanner',
|
|
237
|
+
version: '2.0.0',
|
|
238
|
+
},
|
|
239
|
+
scan: {
|
|
240
|
+
project: result.projectName,
|
|
241
|
+
timestamp: result.scanTimestamp,
|
|
242
|
+
durationMs: result.durationMs,
|
|
243
|
+
totalPackages: result.totalPackages,
|
|
244
|
+
},
|
|
245
|
+
summary: result.summary,
|
|
246
|
+
vulnerabilities: result.vulnerabilities.map(vuln => ({
|
|
247
|
+
id: vuln.cveId,
|
|
248
|
+
package: {
|
|
249
|
+
name: vuln.packageName,
|
|
250
|
+
version: vuln.installedVersion,
|
|
251
|
+
fixedVersion: vuln.fixedVersion,
|
|
252
|
+
},
|
|
253
|
+
severity: vuln.severity,
|
|
254
|
+
cvssScore: vuln.cvssScore,
|
|
255
|
+
description: vuln.description,
|
|
256
|
+
cwes: vuln.cwes,
|
|
257
|
+
references: vuln.references,
|
|
258
|
+
})),
|
|
259
|
+
};
|
|
260
|
+
return JSON.stringify(report, null, 2);
|
|
261
|
+
}
|
|
262
|
+
/**
|
|
263
|
+
* Generate SARIF 2.1.0 report
|
|
264
|
+
*/
|
|
265
|
+
generateSARIF(result) {
|
|
266
|
+
const rules = [];
|
|
267
|
+
const results = [];
|
|
268
|
+
const ruleIdSet = new Set();
|
|
269
|
+
for (const vuln of result.vulnerabilities) {
|
|
270
|
+
// Add rule if not already added
|
|
271
|
+
if (!ruleIdSet.has(vuln.cveId)) {
|
|
272
|
+
ruleIdSet.add(vuln.cveId);
|
|
273
|
+
rules.push({
|
|
274
|
+
id: vuln.cveId,
|
|
275
|
+
name: `Vulnerability in ${vuln.packageName}`,
|
|
276
|
+
shortDescription: { text: vuln.description ?? `CVE ${vuln.cveId}` },
|
|
277
|
+
fullDescription: { text: vuln.description ?? `Security vulnerability ${vuln.cveId}` },
|
|
278
|
+
helpUri: `https://nvd.nist.gov/vuln/detail/${vuln.cveId}`,
|
|
279
|
+
defaultConfiguration: {
|
|
280
|
+
level: getSARIFLevel(vuln.severity),
|
|
281
|
+
},
|
|
282
|
+
properties: {
|
|
283
|
+
precision: 'high',
|
|
284
|
+
'security-severity': (vuln.cvssScore ?? 0).toString(),
|
|
285
|
+
tags: [
|
|
286
|
+
'security',
|
|
287
|
+
'vulnerability',
|
|
288
|
+
vuln.severity?.toLowerCase() ?? 'unknown',
|
|
289
|
+
...(vuln.cwes ?? []),
|
|
290
|
+
],
|
|
291
|
+
},
|
|
292
|
+
});
|
|
293
|
+
}
|
|
294
|
+
// Add result
|
|
295
|
+
results.push({
|
|
296
|
+
ruleId: vuln.cveId,
|
|
297
|
+
level: getSARIFLevel(vuln.severity),
|
|
298
|
+
message: {
|
|
299
|
+
text: `Vulnerable package ${vuln.packageName}@${vuln.installedVersion}: ${vuln.description ?? vuln.cveId}`,
|
|
300
|
+
},
|
|
301
|
+
locations: [
|
|
302
|
+
{
|
|
303
|
+
physicalLocation: {
|
|
304
|
+
artifactLocation: {
|
|
305
|
+
uri: 'package.json',
|
|
306
|
+
uriBaseId: '%SRCROOT%',
|
|
307
|
+
},
|
|
308
|
+
},
|
|
309
|
+
},
|
|
310
|
+
],
|
|
311
|
+
properties: {
|
|
312
|
+
packageName: vuln.packageName,
|
|
313
|
+
packageVersion: vuln.installedVersion,
|
|
314
|
+
fixedVersion: vuln.fixedVersion,
|
|
315
|
+
cvssScore: vuln.cvssScore,
|
|
316
|
+
cwes: vuln.cwes,
|
|
317
|
+
},
|
|
318
|
+
});
|
|
319
|
+
}
|
|
320
|
+
const sarif = {
|
|
321
|
+
$schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
|
|
322
|
+
version: '2.1.0',
|
|
323
|
+
runs: [
|
|
324
|
+
{
|
|
325
|
+
tool: {
|
|
326
|
+
driver: {
|
|
327
|
+
name: 'MUSUBIX Security Scanner',
|
|
328
|
+
version: '2.0.0',
|
|
329
|
+
informationUri: 'https://github.com/nahisaho/musubix',
|
|
330
|
+
rules,
|
|
331
|
+
},
|
|
332
|
+
},
|
|
333
|
+
results,
|
|
334
|
+
invocations: [
|
|
335
|
+
{
|
|
336
|
+
executionSuccessful: true,
|
|
337
|
+
endTimeUtc: result.scanTimestamp,
|
|
338
|
+
},
|
|
339
|
+
],
|
|
340
|
+
},
|
|
341
|
+
],
|
|
342
|
+
};
|
|
343
|
+
return JSON.stringify(sarif, null, 2);
|
|
344
|
+
}
|
|
345
|
+
}
|
|
346
|
+
/**
|
|
347
|
+
* Quick report generation function
|
|
348
|
+
*/
|
|
349
|
+
export function generateReport(result, format, options) {
|
|
350
|
+
const generator = new ReportGenerator(options);
|
|
351
|
+
return generator.generate(result, format);
|
|
352
|
+
}
|
|
353
|
+
/**
|
|
354
|
+
* Generate and save report to file
|
|
355
|
+
*/
|
|
356
|
+
export async function generateReportToFile(result, filePath, format, options) {
|
|
357
|
+
const { writeFile } = await import('node:fs/promises');
|
|
358
|
+
const report = generateReport(result, format, options);
|
|
359
|
+
await writeFile(filePath, report, 'utf-8');
|
|
360
|
+
}
|
|
361
|
+
/**
|
|
362
|
+
* Determine format from file extension
|
|
363
|
+
*/
|
|
364
|
+
export function getFormatFromExtension(filePath) {
|
|
365
|
+
const ext = filePath.toLowerCase().split('.').pop();
|
|
366
|
+
switch (ext) {
|
|
367
|
+
case 'md':
|
|
368
|
+
case 'markdown':
|
|
369
|
+
return 'markdown';
|
|
370
|
+
case 'sarif':
|
|
371
|
+
return 'sarif';
|
|
372
|
+
case 'json':
|
|
373
|
+
default:
|
|
374
|
+
return 'json';
|
|
375
|
+
}
|
|
376
|
+
}
|
|
377
|
+
//# sourceMappingURL=report-generator.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"report-generator.js","sourceRoot":"","sources":["../../src/cve/report-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA2FH;;GAEG;AACH,MAAM,cAAc,GAA2B;IAC7C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;IACP,OAAO,EAAE,CAAC;CACX,CAAC;AAEF;;GAEG;AACH,SAAS,aAAa,CAAC,QAAiB;IACtC,QAAQ,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,QAAiB;IACzC,QAAQ,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QAChC,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,KAAK;YACR,OAAO,IAAI,CAAC;QACd;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,CAA0B;IAElD,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,OAAO,GAAG;YACb,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,2BAA2B;YACnD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;YAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACtD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM;YAC1C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;YAChD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;SACrC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,MAAkB,EAAE,MAAoB;QAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAErD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC/C,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;YAC3C,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;YAC5C;gBACE,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,MAAkB;QACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE/D,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YACpD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7E,OAAO,KAAK,IAAI,QAAQ,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,OAAO,GAAG;YACd,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAA0B,CAAC;YACjE,IAAI,GAAG,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,MAAM;YACT,eAAe,EAAE,QAAQ;YACzB,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,MAAkB;QACzC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,QAAQ;QACR,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,WAAW;QACX,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,IAAI,SAAS,IAAI,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,UAAU,MAAM,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;YAC7D,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,qBAAqB;QACrB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,kBAAkB;QAClB,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YACpF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAE7D,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEjC,KAAK,CAAC,IAAI,CAAC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,2BAA2B,CAAC,IAA2B;QAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAE5E,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAEjF,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC9C,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,aAAa,CAAC,CAAC;QACtG,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,KAA8B;QAE9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAkC;YACtD,CAAC,UAAU,EAAE,EAAE,CAAC;YAChB,CAAC,MAAM,EAAE,EAAE,CAAC;YACZ,CAAC,QAAQ,EAAE,EAAE,CAAC;YACd,CAAC,KAAK,EAAE,EAAE,CAAC;SACZ,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAkB;QACrC,MAAM,MAAM,GAAG;YACb,IAAI,EAAE;gBACJ,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,0BAA0B;gBACrC,OAAO,EAAE,OAAO;aACjB;YACD,IAAI,EAAE;gBACJ,OAAO,EAAE,MAAM,CAAC,WAAW;gBAC3B,SAAS,EAAE,MAAM,CAAC,aAAa;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC;YACD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnD,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,IAAI,CAAC,WAAW;oBACtB,OAAO,EAAE,IAAI,CAAC,gBAAgB;oBAC9B,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;SACJ,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAkB;QACtC,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC1C,gCAAgC;YAChC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,IAAI,EAAE,oBAAoB,IAAI,CAAC,WAAW,EAAE;oBAC5C,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE;oBACnE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,IAAI,0BAA0B,IAAI,CAAC,KAAK,EAAE,EAAE;oBACrF,OAAO,EAAE,oCAAoC,IAAI,CAAC,KAAK,EAAE;oBACzD,oBAAoB,EAAE;wBACpB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;qBACpC;oBACD,UAAU,EAAE;wBACV,SAAS,EAAE,MAAM;wBACjB,mBAAmB,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE;wBACrD,IAAI,EAAE;4BACJ,UAAU;4BACV,eAAe;4BACf,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,SAAS;4BACzC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;yBACrB;qBACF;iBACF,CAAC,CAAC;YACL,CAAC;YAED,aAAa;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,IAAI,CAAC,KAAK;gBAClB,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACnC,OAAO,EAAE;oBACP,IAAI,EAAE,sBAAsB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE;iBAC3G;gBACD,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE;gCAChB,GAAG,EAAE,cAAc;gCACnB,SAAS,EAAE,WAAW;6BACvB;yBACF;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,cAAc,EAAE,IAAI,CAAC,gBAAgB;oBACrC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAgB;YACzB,OAAO,EAAE,gGAAgG;YACzG,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ;oBACE,IAAI,EAAE;wBACJ,MAAM,EAAE;4BACN,IAAI,EAAE,0BAA0B;4BAChC,OAAO,EAAE,OAAO;4BAChB,cAAc,EAAE,qCAAqC;4BACrD,KAAK;yBACN;qBACF;oBACD,OAAO;oBACP,WAAW,EAAE;wBACX;4BACE,mBAAmB,EAAE,IAAI;4BACzB,UAAU,EAAE,MAAM,CAAC,aAAa;yBACjC;qBACF;iBACF;aACF;SACF,CAAC;QAEF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAkB,EAClB,MAAoB,EACpB,OAAuB;IAEvB,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkB,EAClB,QAAgB,EAChB,MAAoB,EACpB,OAAuB;IAEvB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACpD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,IAAI,CAAC;QACV,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"report-generator.test.d.ts","sourceRoot":"","sources":["../../src/cve/report-generator.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}
|
|
@@ -0,0 +1,275 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @fileoverview Report Generator Unit Tests
|
|
3
|
+
* @module @nahisaho/musubix-security/cve/report-generator.test
|
|
4
|
+
*/
|
|
5
|
+
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
|
|
6
|
+
import * as fs from 'node:fs';
|
|
7
|
+
import * as path from 'node:path';
|
|
8
|
+
import * as os from 'node:os';
|
|
9
|
+
import { ReportGenerator, generateReport, generateReportToFile, getFormatFromExtension, } from './report-generator.js';
|
|
10
|
+
/**
|
|
11
|
+
* Create a mock scan result
|
|
12
|
+
*/
|
|
13
|
+
function createMockScanResult(vulns = []) {
|
|
14
|
+
const vulnerabilities = vulns.map((v, i) => ({
|
|
15
|
+
cveId: v.cveId ?? `CVE-2024-${String(i + 1).padStart(5, '0')}`,
|
|
16
|
+
packageName: v.packageName ?? 'test-package',
|
|
17
|
+
installedVersion: v.installedVersion ?? '1.0.0',
|
|
18
|
+
description: v.description ?? `Test vulnerability ${i + 1}`,
|
|
19
|
+
cvssScore: v.cvssScore ?? 7.5,
|
|
20
|
+
severity: v.severity ?? 'HIGH',
|
|
21
|
+
cvssVector: v.cvssVector ?? 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N',
|
|
22
|
+
cwes: v.cwes ?? ['CWE-79'],
|
|
23
|
+
references: v.references ?? ['https://example.com/ref'],
|
|
24
|
+
isDirect: v.isDirect ?? true,
|
|
25
|
+
dependencyType: v.dependencyType ?? 'dependencies',
|
|
26
|
+
confidence: v.confidence ?? 0.95,
|
|
27
|
+
fixedVersion: v.fixedVersion,
|
|
28
|
+
affectedVersions: v.affectedVersions,
|
|
29
|
+
}));
|
|
30
|
+
// Calculate summary
|
|
31
|
+
const summary = {
|
|
32
|
+
total: vulnerabilities.length,
|
|
33
|
+
critical: vulnerabilities.filter(v => v.severity === 'CRITICAL').length,
|
|
34
|
+
high: vulnerabilities.filter(v => v.severity === 'HIGH').length,
|
|
35
|
+
medium: vulnerabilities.filter(v => v.severity === 'MEDIUM').length,
|
|
36
|
+
low: vulnerabilities.filter(v => v.severity === 'LOW').length,
|
|
37
|
+
none: vulnerabilities.filter(v => v.severity === 'NONE').length,
|
|
38
|
+
};
|
|
39
|
+
return {
|
|
40
|
+
projectName: 'test-project',
|
|
41
|
+
projectVersion: '1.0.0',
|
|
42
|
+
scanTimestamp: new Date().toISOString(),
|
|
43
|
+
totalPackages: 10,
|
|
44
|
+
directDependencies: 5,
|
|
45
|
+
transitiveDependencies: 5,
|
|
46
|
+
vulnerabilities,
|
|
47
|
+
summary,
|
|
48
|
+
durationMs: 1000,
|
|
49
|
+
errors: [],
|
|
50
|
+
warnings: [],
|
|
51
|
+
};
|
|
52
|
+
}
|
|
53
|
+
describe('ReportGenerator', () => {
|
|
54
|
+
describe('constructor', () => {
|
|
55
|
+
it('should create generator with default options', () => {
|
|
56
|
+
const generator = new ReportGenerator();
|
|
57
|
+
expect(generator).toBeInstanceOf(ReportGenerator);
|
|
58
|
+
});
|
|
59
|
+
it('should accept custom options', () => {
|
|
60
|
+
const generator = new ReportGenerator({
|
|
61
|
+
title: 'Custom Report',
|
|
62
|
+
includeDetails: false,
|
|
63
|
+
minSeverity: 'HIGH',
|
|
64
|
+
});
|
|
65
|
+
expect(generator).toBeInstanceOf(ReportGenerator);
|
|
66
|
+
});
|
|
67
|
+
});
|
|
68
|
+
describe('Markdown generation', () => {
|
|
69
|
+
it('should generate markdown report with no vulnerabilities', () => {
|
|
70
|
+
const generator = new ReportGenerator();
|
|
71
|
+
const result = createMockScanResult([]);
|
|
72
|
+
const report = generator.generate(result, 'markdown');
|
|
73
|
+
expect(report).toContain('# Vulnerability Scan Report');
|
|
74
|
+
expect(report).toContain('No Vulnerabilities Found');
|
|
75
|
+
});
|
|
76
|
+
it('should generate markdown report with vulnerabilities', () => {
|
|
77
|
+
const generator = new ReportGenerator();
|
|
78
|
+
const result = createMockScanResult([
|
|
79
|
+
{ cveId: 'CVE-2024-12345', severity: 'HIGH', cvssScore: 8.0 },
|
|
80
|
+
{ cveId: 'CVE-2024-12346', severity: 'CRITICAL', cvssScore: 9.5 },
|
|
81
|
+
]);
|
|
82
|
+
const report = generator.generate(result, 'markdown');
|
|
83
|
+
expect(report).toContain('CVE-2024-12345');
|
|
84
|
+
expect(report).toContain('CVE-2024-12346');
|
|
85
|
+
expect(report).toContain('HIGH');
|
|
86
|
+
expect(report).toContain('CRITICAL');
|
|
87
|
+
});
|
|
88
|
+
it('should group vulnerabilities by severity', () => {
|
|
89
|
+
const generator = new ReportGenerator({ groupBySeverity: true });
|
|
90
|
+
const result = createMockScanResult([
|
|
91
|
+
{ cveId: 'CVE-2024-0001', severity: 'CRITICAL' },
|
|
92
|
+
{ cveId: 'CVE-2024-0002', severity: 'HIGH' },
|
|
93
|
+
{ cveId: 'CVE-2024-0003', severity: 'MEDIUM' },
|
|
94
|
+
]);
|
|
95
|
+
const report = generator.generate(result, 'markdown');
|
|
96
|
+
expect(report).toContain('### 🔴 CRITICAL');
|
|
97
|
+
expect(report).toContain('### 🟠 HIGH');
|
|
98
|
+
expect(report).toContain('### 🟡 MEDIUM');
|
|
99
|
+
});
|
|
100
|
+
it('should include metadata when configured', () => {
|
|
101
|
+
const generator = new ReportGenerator({ includeMetadata: true });
|
|
102
|
+
const result = createMockScanResult([]);
|
|
103
|
+
const report = generator.generate(result, 'markdown');
|
|
104
|
+
expect(report).toContain('Scan Summary');
|
|
105
|
+
expect(report).toContain('test-project');
|
|
106
|
+
});
|
|
107
|
+
it('should include remediation suggestions', () => {
|
|
108
|
+
const generator = new ReportGenerator({ includeRemediation: true });
|
|
109
|
+
const result = createMockScanResult([
|
|
110
|
+
{ cveId: 'CVE-2024-12345', fixedVersion: '2.0.0' },
|
|
111
|
+
]);
|
|
112
|
+
const report = generator.generate(result, 'markdown');
|
|
113
|
+
expect(report).toContain('Fix Available');
|
|
114
|
+
expect(report).toContain('2.0.0');
|
|
115
|
+
});
|
|
116
|
+
it('should include CWEs and references', () => {
|
|
117
|
+
const generator = new ReportGenerator({ includeDetails: true });
|
|
118
|
+
const result = createMockScanResult([
|
|
119
|
+
{
|
|
120
|
+
cveId: 'CVE-2024-12345',
|
|
121
|
+
cwes: ['CWE-79', 'CWE-89'],
|
|
122
|
+
references: ['https://example.com/advisory'],
|
|
123
|
+
},
|
|
124
|
+
]);
|
|
125
|
+
const report = generator.generate(result, 'markdown');
|
|
126
|
+
expect(report).toContain('CWE-79');
|
|
127
|
+
expect(report).toContain('CWE-89');
|
|
128
|
+
expect(report).toContain('References');
|
|
129
|
+
});
|
|
130
|
+
});
|
|
131
|
+
describe('JSON generation', () => {
|
|
132
|
+
it('should generate valid JSON', () => {
|
|
133
|
+
const generator = new ReportGenerator();
|
|
134
|
+
const result = createMockScanResult([]);
|
|
135
|
+
const report = generator.generate(result, 'json');
|
|
136
|
+
expect(() => JSON.parse(report)).not.toThrow();
|
|
137
|
+
});
|
|
138
|
+
it('should include meta information', () => {
|
|
139
|
+
const generator = new ReportGenerator({ title: 'Custom Report' });
|
|
140
|
+
const result = createMockScanResult([]);
|
|
141
|
+
const report = generator.generate(result, 'json');
|
|
142
|
+
const parsed = JSON.parse(report);
|
|
143
|
+
expect(parsed.meta.title).toBe('Custom Report');
|
|
144
|
+
expect(parsed.meta.generator).toBe('MUSUBIX Security Scanner');
|
|
145
|
+
});
|
|
146
|
+
it('should include vulnerability details', () => {
|
|
147
|
+
const generator = new ReportGenerator();
|
|
148
|
+
const result = createMockScanResult([
|
|
149
|
+
{ cveId: 'CVE-2024-12345', packageName: 'lodash', installedVersion: '4.17.20' },
|
|
150
|
+
]);
|
|
151
|
+
const report = generator.generate(result, 'json');
|
|
152
|
+
const parsed = JSON.parse(report);
|
|
153
|
+
expect(parsed.vulnerabilities).toHaveLength(1);
|
|
154
|
+
expect(parsed.vulnerabilities[0].id).toBe('CVE-2024-12345');
|
|
155
|
+
expect(parsed.vulnerabilities[0].package.name).toBe('lodash');
|
|
156
|
+
expect(parsed.vulnerabilities[0].package.version).toBe('4.17.20');
|
|
157
|
+
});
|
|
158
|
+
});
|
|
159
|
+
describe('SARIF generation', () => {
|
|
160
|
+
it('should generate valid SARIF 2.1.0', () => {
|
|
161
|
+
const generator = new ReportGenerator();
|
|
162
|
+
const result = createMockScanResult([]);
|
|
163
|
+
const report = generator.generate(result, 'sarif');
|
|
164
|
+
const sarif = JSON.parse(report);
|
|
165
|
+
expect(sarif.$schema).toContain('sarif-schema-2.1.0');
|
|
166
|
+
expect(sarif.version).toBe('2.1.0');
|
|
167
|
+
});
|
|
168
|
+
it('should include tool information', () => {
|
|
169
|
+
const generator = new ReportGenerator();
|
|
170
|
+
const result = createMockScanResult([]);
|
|
171
|
+
const report = generator.generate(result, 'sarif');
|
|
172
|
+
const sarif = JSON.parse(report);
|
|
173
|
+
expect(sarif.runs[0].tool.driver.name).toBe('MUSUBIX Security Scanner');
|
|
174
|
+
});
|
|
175
|
+
it('should create rules for vulnerabilities', () => {
|
|
176
|
+
const generator = new ReportGenerator();
|
|
177
|
+
const result = createMockScanResult([
|
|
178
|
+
{ cveId: 'CVE-2024-12345', severity: 'HIGH', cvssScore: 8.0 },
|
|
179
|
+
]);
|
|
180
|
+
const report = generator.generate(result, 'sarif');
|
|
181
|
+
const sarif = JSON.parse(report);
|
|
182
|
+
expect(sarif.runs[0].tool.driver.rules).toHaveLength(1);
|
|
183
|
+
expect(sarif.runs[0].tool.driver.rules[0].id).toBe('CVE-2024-12345');
|
|
184
|
+
});
|
|
185
|
+
it('should create results for vulnerabilities', () => {
|
|
186
|
+
const generator = new ReportGenerator();
|
|
187
|
+
const result = createMockScanResult([
|
|
188
|
+
{ cveId: 'CVE-2024-12345', packageName: 'express' },
|
|
189
|
+
]);
|
|
190
|
+
const report = generator.generate(result, 'sarif');
|
|
191
|
+
const sarif = JSON.parse(report);
|
|
192
|
+
expect(sarif.runs[0].results).toHaveLength(1);
|
|
193
|
+
expect(sarif.runs[0].results[0].ruleId).toBe('CVE-2024-12345');
|
|
194
|
+
expect(sarif.runs[0].results[0].properties.packageName).toBe('express');
|
|
195
|
+
});
|
|
196
|
+
it('should map severity to SARIF level', () => {
|
|
197
|
+
const generator = new ReportGenerator();
|
|
198
|
+
const result = createMockScanResult([
|
|
199
|
+
{ cveId: 'CVE-2024-0001', severity: 'CRITICAL' },
|
|
200
|
+
{ cveId: 'CVE-2024-0002', severity: 'MEDIUM' },
|
|
201
|
+
{ cveId: 'CVE-2024-0003', severity: 'LOW' },
|
|
202
|
+
]);
|
|
203
|
+
const report = generator.generate(result, 'sarif');
|
|
204
|
+
const sarif = JSON.parse(report);
|
|
205
|
+
const levels = sarif.runs[0].results.map((r) => r.level);
|
|
206
|
+
expect(levels).toContain('error'); // CRITICAL
|
|
207
|
+
expect(levels).toContain('warning'); // MEDIUM
|
|
208
|
+
expect(levels).toContain('note'); // LOW
|
|
209
|
+
});
|
|
210
|
+
});
|
|
211
|
+
describe('severity filtering', () => {
|
|
212
|
+
it('should filter by minimum severity', () => {
|
|
213
|
+
const generator = new ReportGenerator({ minSeverity: 'HIGH' });
|
|
214
|
+
const result = createMockScanResult([
|
|
215
|
+
{ cveId: 'CVE-2024-0001', severity: 'CRITICAL' },
|
|
216
|
+
{ cveId: 'CVE-2024-0002', severity: 'HIGH' },
|
|
217
|
+
{ cveId: 'CVE-2024-0003', severity: 'MEDIUM' },
|
|
218
|
+
{ cveId: 'CVE-2024-0004', severity: 'LOW' },
|
|
219
|
+
]);
|
|
220
|
+
const report = generator.generate(result, 'json');
|
|
221
|
+
const parsed = JSON.parse(report);
|
|
222
|
+
// Should only include CRITICAL and HIGH
|
|
223
|
+
expect(parsed.vulnerabilities).toHaveLength(2);
|
|
224
|
+
expect(parsed.vulnerabilities.some((v) => v.severity === 'MEDIUM')).toBe(false);
|
|
225
|
+
expect(parsed.vulnerabilities.some((v) => v.severity === 'LOW')).toBe(false);
|
|
226
|
+
});
|
|
227
|
+
});
|
|
228
|
+
});
|
|
229
|
+
describe('generateReport', () => {
|
|
230
|
+
it('should generate report with quick function', () => {
|
|
231
|
+
const result = createMockScanResult([]);
|
|
232
|
+
const report = generateReport(result, 'markdown');
|
|
233
|
+
expect(report).toContain('Vulnerability Scan Report');
|
|
234
|
+
});
|
|
235
|
+
it('should accept options', () => {
|
|
236
|
+
const result = createMockScanResult([]);
|
|
237
|
+
const report = generateReport(result, 'markdown', {
|
|
238
|
+
title: 'Custom Title',
|
|
239
|
+
});
|
|
240
|
+
expect(report).toContain('Custom Title');
|
|
241
|
+
});
|
|
242
|
+
});
|
|
243
|
+
describe('generateReportToFile', () => {
|
|
244
|
+
let tempDir;
|
|
245
|
+
beforeEach(() => {
|
|
246
|
+
tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'report-gen-test-'));
|
|
247
|
+
});
|
|
248
|
+
afterEach(() => {
|
|
249
|
+
fs.rmSync(tempDir, { recursive: true, force: true });
|
|
250
|
+
});
|
|
251
|
+
it('should write report to file', async () => {
|
|
252
|
+
const result = createMockScanResult([]);
|
|
253
|
+
const filePath = path.join(tempDir, 'report.md');
|
|
254
|
+
await generateReportToFile(result, filePath, 'markdown');
|
|
255
|
+
expect(fs.existsSync(filePath)).toBe(true);
|
|
256
|
+
const content = fs.readFileSync(filePath, 'utf-8');
|
|
257
|
+
expect(content).toContain('Vulnerability Scan Report');
|
|
258
|
+
});
|
|
259
|
+
});
|
|
260
|
+
describe('getFormatFromExtension', () => {
|
|
261
|
+
it('should detect markdown format', () => {
|
|
262
|
+
expect(getFormatFromExtension('report.md')).toBe('markdown');
|
|
263
|
+
expect(getFormatFromExtension('report.markdown')).toBe('markdown');
|
|
264
|
+
});
|
|
265
|
+
it('should detect SARIF format', () => {
|
|
266
|
+
expect(getFormatFromExtension('report.sarif')).toBe('sarif');
|
|
267
|
+
});
|
|
268
|
+
it('should detect JSON format', () => {
|
|
269
|
+
expect(getFormatFromExtension('report.json')).toBe('json');
|
|
270
|
+
});
|
|
271
|
+
it('should default to JSON for unknown extensions', () => {
|
|
272
|
+
expect(getFormatFromExtension('report.txt')).toBe('json');
|
|
273
|
+
});
|
|
274
|
+
});
|
|
275
|
+
//# sourceMappingURL=report-generator.test.js.map
|