@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/taint/file-analysis-cache.test.ts

@@ -0,0 +1,290 @@
+/**
+ * Tests for Phase 8 Part 1: Per-File Analysis Cache
+ *
+ * Verifies that buildFileAnalysisCache() and buildProjectAnalysisCache()
+ * produce identical results to computing classifiers directly.
+ */
+
+import { parseFile, clearASTCache } from '../../parse/ast'
+import { buildFileCFGs } from '../../taint/cfg-builder'
+import { classifySources } from '../../taint/source-classifier'
+import { classifySinks } from '../../taint/sink-classifier'
+import { buildSanitizerRegistry } from '../../taint/sanitizer-registry'
+import { collectImportBindings } from '../../taint/helpers'
+import { collectVariableAliases } from '../../detect/ast-rules/helpers/scope-analysis'
+import {
+  buildFileAnalysisCache,
+  buildProjectAnalysisCache,
+  buildCFGNodeMap,
+} from '../../taint/file-analysis-cache'
+
+afterEach(() => clearASTCache())
+
+let counter = 0
+function uniquePath(base: string) {
+  counter++
+  return `file-analysis-cache-test-${counter}-${base}`
+}
+
+// ============================================================================
+// buildFileAnalysisCache
+// ============================================================================
+
+describe('buildFileAnalysisCache', () => {
+  it('produces same CFGs as buildFileCFGs', () => {
+    const code = `
+      import express from 'express'
+      const app = express()
+      app.get('/api', (req, res) => {
+        const name = req.query.name
+        res.send(name)
+      })
+    `
+    const fp = uniquePath('express-cfgs.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const directCFGs = buildFileCFGs(ast)
+
+    expect(cache.cfgs.size).toBe(directCFGs.size)
+    for (const [name] of directCFGs) {
+      expect(cache.cfgs.has(name)).toBe(true)
+      expect(cache.cfgs.get(name)!.nodes.size).toBe(directCFGs.get(name)!.nodes.size)
+    }
+  })
+
+  it('produces same sources as classifySources', () => {
+    const code = `
+      import { Request, Response } from 'express'
+      export function handler(req: Request, res: Response) {
+        const body = req.body
+        return body
+      }
+    `
+    const fp = uniquePath('sources.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const imports = collectImportBindings(ast.tree.rootNode)
+    const directSources = classifySources(ast, imports)
+
+    expect(cache.sources.length).toBe(directSources.length)
+    for (let i = 0; i < directSources.length; i++) {
+      expect(cache.sources[i].variable).toBe(directSources[i].variable)
+      expect(cache.sources[i].line).toBe(directSources[i].line)
+      expect(cache.sources[i].sourceType).toBe(directSources[i].sourceType)
+    }
+  })
+
+  it('produces same sinks as classifySinks', () => {
+    const code = `
+      import { Pool } from 'pg'
+      const pool = new Pool()
+      export async function query(input: string) {
+        return pool.query(input)
+      }
+    `
+    const fp = uniquePath('sinks.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const imports = collectImportBindings(ast.tree.rootNode)
+    const aliases = collectVariableAliases(ast.tree.rootNode)
+    const directSinks = classifySinks(ast, imports, aliases)
+
+    expect(cache.sinks.length).toBe(directSinks.length)
+    for (let i = 0; i < directSinks.length; i++) {
+      expect(cache.sinks[i].line).toBe(directSinks[i].line)
+      expect(cache.sinks[i].sinkType).toBe(directSinks[i].sinkType)
+    }
+  })
+
+  it('produces same sanitizers as buildSanitizerRegistry', () => {
+    const code = `
+      import DOMPurify from 'dompurify'
+      export function clean(input: string) {
+        return DOMPurify.sanitize(input)
+      }
+    `
+    const fp = uniquePath('sanitizers.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const imports = collectImportBindings(ast.tree.rootNode)
+    const aliases = collectVariableAliases(ast.tree.rootNode)
+    const directSanitizers = buildSanitizerRegistry(ast, imports, aliases)
+
+    expect(cache.sanitizers.length).toBe(directSanitizers.length)
+    for (let i = 0; i < directSanitizers.length; i++) {
+      expect(cache.sanitizers[i].name).toBe(directSanitizers[i].name)
+      expect(cache.sanitizers[i].line).toBe(directSanitizers[i].line)
+    }
+  })
+
+  it('produces same import bindings', () => {
+    const code = `
+      import express from 'express'
+      import { Pool } from 'pg'
+      const { readFile } = require('fs')
+    `
+    const fp = uniquePath('imports.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+    const directBindings = collectImportBindings(ast.tree.rootNode)
+
+    expect(cache.importBindings.size).toBe(directBindings.size)
+    for (const [name, info] of directBindings) {
+      expect(cache.importBindings.get(name)).toEqual(info)
+    }
+  })
+
+  it('builds CFG node maps for each function', () => {
+    const code = `
+      function foo() { const x = 1; return x }
+      function bar() { return 2 }
+    `
+    const fp = uniquePath('cfgnodemaps.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+
+    // Should have maps for each function + module-level
+    expect(cache.cfgNodeMaps.size).toBeGreaterThan(0)
+
+    // Each map should contain entries for AST nodes
+    for (const [name, nodeMap] of cache.cfgNodeMaps) {
+      const cfg = cache.cfgs.get(name)
+      if (!cfg) continue
+      let astNodeCount = 0
+      for (const [, cfgNode] of cfg.nodes) {
+        if (cfgNode.astNode) astNodeCount++
+      }
+      expect(nodeMap.size).toBe(astNodeCount)
+    }
+  })
+
+  it('handles file with no functions', () => {
+    const code = `const x = 1; export default x`
+    const fp = uniquePath('no-funcs.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+
+    expect(cache.cfgs.size).toBeGreaterThanOrEqual(0)
+    expect(cache.sources).toBeDefined()
+    expect(cache.sinks).toBeDefined()
+    expect(cache.sanitizers).toBeDefined()
+  })
+
+  it('handles empty file', () => {
+    const code = `// empty file`
+    const fp = uniquePath('empty.ts')
+    const ast = parseFile(code, fp)!
+    const cache = buildFileAnalysisCache(ast)
+
+    expect(cache.sources.length).toBe(0)
+    expect(cache.sinks.length).toBe(0)
+    expect(cache.sanitizers.length).toBe(0)
+  })
+})
+
+// ============================================================================
+// buildProjectAnalysisCache
+// ============================================================================
+
+describe('buildProjectAnalysisCache', () => {
+  it('builds cache for multiple files', () => {
+    const code1 = `
+      export function greet(name: string) { return name }
+    `
+    const code2 = `
+      import { Pool } from 'pg'
+      const pool = new Pool()
+      export async function query(input: string) {
+        return pool.query(input)
+      }
+    `
+    const fp1 = uniquePath('multi1.ts')
+    const fp2 = uniquePath('multi2.ts')
+    const ast1 = parseFile(code1, fp1)!
+    const ast2 = parseFile(code2, fp2)!
+
+    const asts = new Map([[fp1, ast1], [fp2, ast2]])
+    const projectCache = buildProjectAnalysisCache(asts)
+
+    // Lazy cache: .has() checks availability, .get() triggers computation
+    expect(projectCache.has(fp1)).toBe(true)
+    expect(projectCache.has(fp2)).toBe(true)
+    expect(projectCache.get(fp1)).toBeDefined()
+    expect(projectCache.get(fp2)).toBeDefined()
+    expect(projectCache.get(fp1)!.cfgs.size).toBeGreaterThan(0)
+    expect(projectCache.get(fp2)!.cfgs.size).toBeGreaterThan(0)
+  })
+
+  it('produces consistent results on repeated calls', () => {
+    const code = `
+      import express from 'express'
+      const app = express()
+      app.get('/api', (req, res) => {
+        const name = req.query.name
+        res.send(name)
+      })
+    `
+    const fp = uniquePath('consistency.ts')
+    const ast = parseFile(code, fp)!
+    const asts = new Map([[fp, ast]])
+
+    const cache1 = buildProjectAnalysisCache(asts)
+    const cache2 = buildProjectAnalysisCache(asts)
+
+    const c1 = cache1.get(fp)!
+    const c2 = cache2.get(fp)!
+
+    expect(c1.cfgs.size).toBe(c2.cfgs.size)
+    expect(c1.sources.length).toBe(c2.sources.length)
+    expect(c1.sinks.length).toBe(c2.sinks.length)
+    expect(c1.sanitizers.length).toBe(c2.sanitizers.length)
+  })
+})
+
+// ============================================================================
+// buildCFGNodeMap
+// ============================================================================
+
+describe('buildCFGNodeMap', () => {
+  it('maps AST node IDs to CFG nodes', () => {
+    const code = `
+      export function foo(x: number) {
+        const y = x + 1
+        return y
+      }
+    `
+    const fp = uniquePath('cfgmap.ts')
+    const ast = parseFile(code, fp)!
+    const cfgs = buildFileCFGs(ast)
+
+    for (const [, cfg] of cfgs) {
+      const nodeMap = buildCFGNodeMap(cfg)
+
+      // Every CFG node with an astNode should be in the map
+      for (const [, cfgNode] of cfg.nodes) {
+        if (cfgNode.astNode) {
+          expect(nodeMap.get(cfgNode.astNode.id)).toBe(cfgNode)
+        }
+      }
+
+      // Entry/exit nodes (no astNode) should NOT be in the map
+      const entryNode = cfg.nodes.get(cfg.entryId)
+      if (entryNode && !entryNode.astNode) {
+        expect(nodeMap.has(cfg.entryId)).toBe(false)
+      }
+    }
+  })
+
+  it('returns empty map for trivial CFGs', () => {
+    const code = `const x = 1`
+    const fp = uniquePath('trivial.ts')
+    const ast = parseFile(code, fp)!
+    const cfgs = buildFileCFGs(ast)
+
+    for (const [, cfg] of cfgs) {
+      const nodeMap = buildCFGNodeMap(cfg)
+      // Should contain statement nodes but not entry/exit
+      expect(nodeMap.size).toBeGreaterThanOrEqual(0)
+    }
+  })
+})

package/src/__tests__/taint/framework-models.test.ts

@@ -0,0 +1,227 @@
+/**
+ * Tests for Framework Models (Phase 3, Part 3)
+ *
+ * Verifies:
+ * 1. Express middleware and route detection
+ * 2. Next.js Server Action detection
+ * 3. Route handler synthetic source generation
+ */
+
+import type { ScanFile } from '../../shared/types'
+import { parseFiles, clearASTCache } from '../../parse/ast'
+import { buildModuleGraph } from '../../model/module-graph'
+import { analyzeTaintsForProject } from '../../taint/cross-file-analyzer'
+import {
+  detectExpressRoutes,
+  detectServerActions,
+} from '../../taint/framework-models'
+
+function makeFile(path: string, content: string): ScanFile {
+  return {
+    path,
+    content,
+    language: path.endsWith('.js') ? 'javascript' : 'typescript',
+    size: content.length,
+  }
+}
+
+function analyzeProject(files: ScanFile[]) {
+  const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+  const moduleGraph = buildModuleGraph(files)
+  return analyzeTaintsForProject(files, asts, moduleGraph)
+}
+
+beforeEach(() => clearASTCache())
+
+// ============================================================================
+// Express Route & Middleware Detection
+// ============================================================================
+
+describe('Framework Models: Express route detection', () => {
+  it('detects app.get() route registration', () => {
+    const files = [makeFile('src/app.ts', `
+      app.get('/users', handler)
+      app.post('/login', loginHandler)
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/app.ts')!
+
+    const { routes } = detectExpressRoutes(ast, 'src/app.ts')
+
+    expect(routes.length).toBe(2)
+    expect(routes[0].method).toBe('get')
+    expect(routes[0].path).toBe('/users')
+    expect(routes[0].handlerNames).toEqual(['handler'])
+    expect(routes[1].method).toBe('post')
+    expect(routes[1].path).toBe('/login')
+  })
+
+  it('detects app.use() middleware registration', () => {
+    const files = [makeFile('src/app.ts', `
+      app.use(cors())
+      app.use('/api', authMiddleware)
+      app.use(bodyParser.json())
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/app.ts')!
+
+    const { middleware } = detectExpressRoutes(ast, 'src/app.ts')
+
+    // cors() and bodyParser.json() are call expressions, not identifiers
+    // Only authMiddleware is an identifier handler
+    expect(middleware.length).toBe(1)
+    expect(middleware[0].middlewareName).toBe('authMiddleware')
+    expect(middleware[0].mountPath).toBe('/api')
+  })
+
+  it('detects router.get() routes', () => {
+    const files = [makeFile('src/routes.ts', `
+      router.get('/profile', getProfile)
+      router.post('/profile', updateProfile)
+      router.delete('/profile', deleteProfile)
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/routes.ts')!
+
+    const { routes } = detectExpressRoutes(ast, 'src/routes.ts')
+
+    expect(routes.length).toBe(3)
+    expect(routes[0].method).toBe('get')
+    expect(routes[1].method).toBe('post')
+    expect(routes[2].method).toBe('delete')
+  })
+
+  it('handles multiple handlers in one route', () => {
+    const files = [makeFile('src/app.ts', `
+      app.get('/admin', authMiddleware, adminHandler)
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/app.ts')!
+
+    const { routes } = detectExpressRoutes(ast, 'src/app.ts')
+
+    expect(routes.length).toBe(1)
+    expect(routes[0].handlerNames).toEqual(['authMiddleware', 'adminHandler'])
+  })
+
+  it('handles route without path string', () => {
+    const files = [makeFile('src/app.ts', `
+      app.use(middleware)
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/app.ts')!
+
+    const { middleware: mw } = detectExpressRoutes(ast, 'src/app.ts')
+
+    expect(mw.length).toBe(1)
+    expect(mw[0].mountPath).toBeNull()
+    expect(mw[0].middlewareName).toBe('middleware')
+  })
+})
+
+// ============================================================================
+// Next.js Server Actions
+// ============================================================================
+
+describe('Framework Models: Next.js Server Actions', () => {
+  it('detects file-level use server directive', () => {
+    const files = [makeFile('src/actions.ts', `
+      'use server'
+
+      export async function createUser(formData) {
+        const name = formData.get('name')
+        db.query("INSERT INTO users (name) VALUES ('" + name + "')")
+      }
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/actions.ts')!
+
+    const sources = detectServerActions(ast, 'src/actions.ts')
+
+    expect(sources.length).toBeGreaterThanOrEqual(1)
+    expect(sources[0].variable).toBe('formData')
+    expect(sources[0].sourceType).toBe('form_data')
+    expect(sources[0].framework).toBe('nextjs')
+  })
+
+  it('detects function-level use server directive', () => {
+    const files = [makeFile('src/page.tsx', `
+      export function Page() {
+        async function handleSubmit(formData) {
+          'use server'
+          const input = formData.get('input')
+          db.execute(input)
+        }
+        return <form action={handleSubmit}><input name="input" /></form>
+      }
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/page.tsx')!
+
+    const sources = detectServerActions(ast, 'src/page.tsx')
+
+    expect(sources.length).toBeGreaterThanOrEqual(1)
+    expect(sources[0].variable).toBe('formData')
+  })
+
+  it('no sources when no use server directive', () => {
+    const files = [makeFile('src/utils.ts', `
+      export function processData(data) {
+        return data.trim()
+      }
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/utils.ts')!
+
+    const sources = detectServerActions(ast, 'src/utils.ts')
+    expect(sources.length).toBe(0)
+  })
+
+  it('detects typed Server Action parameter', () => {
+    const files = [makeFile('src/actions.ts', `
+      'use server'
+
+      export async function createUser(formData: FormData) {
+        const name = formData.get('name')
+      }
+    `)]
+    const asts = parseFiles(files.map(f => ({ path: f.path, content: f.content })))
+    const ast = asts.get('src/actions.ts')!
+
+    const sources = detectServerActions(ast, 'src/actions.ts')
+
+    expect(sources.length).toBeGreaterThanOrEqual(1)
+    expect(sources[0].variable).toBe('formData')
+  })
+})
+
+// ============================================================================
+// Cross-File Route Handler Taint Flow
+// ============================================================================
+
+describe('Framework Models: Express route handler cross-file', () => {
+  it('detects taint through imported route handler', () => {
+    const files = [
+      makeFile('src/app.ts', `
+        import { userHandler } from './handlers'
+        function setup() {
+          app.get('/users', userHandler)
+        }
+      `),
+      makeFile('src/handlers.ts', `
+        export function userHandler(req, res) {
+          const input = req.body
+          db.execute(input)
+        }
+      `),
+    ]
+
+    // The handler file has req.body (source) and db.execute (sink) in the same file
+    // This should be found by normal taint analysis without framework models
+    const findings = analyzeProject(files)
+    const sqlFindings = findings.filter(f =>
+      [...f.matchingKinds].includes('sql')
+    )
+    expect(sqlFindings.length).toBeGreaterThanOrEqual(1)
+  })
+})