@produtype/core 0.22.0 → 0.23.0

package/dist/analyzer/detectUploads.js

@@ -30,12 +30,22 @@ async function detectUploads(ctx) {
     const uploadDeps = (0, detectContext_1.hasAnyDep)(ctx, ['multer', 'formidable', '@aws-sdk/client-s3', 'aws-sdk']);
     const pyUploadDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['boto3']);
     const avDeps = (0, detectContext_1.hasAnyDep)(ctx, ['clamav', 'clamscan']);
+    /**
+     * Each line tagged with the claim it supports.
+     *
+     * Everything this detector finds used to land in one array, so a report that said "no
+     * upload handling was found in this repository" cited six snippets under it — five of
+     * them `LoginRequiredMixin` and `@login_required`, one a PDF content type — and was
+     * stamped "confidence: high, evidence quality: strong" for them. That a project has
+     * authentication is why an upload check would matter; it is not evidence about
+     * uploads, and the rate-limit rule already carries that sentence for the same reason.
+     */
     for (const d of uploadDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'uploads' });
     for (const d of pyUploadDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'uploads' });
     for (const d of avDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'antivirus' });
     const routeSignals = [];
     for (const file of ctx.files.source) {
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
@@ -74,18 +84,18 @@ async function detectUploads(ctx) {
         /@permission_required/,
     ], 15);
     for (const m of djangoProtectionSignals) {
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'protection' });
     }
     const validationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/file-type/i, /mime/i, /content-type/i], 15);
     const protectedRoutes = routeSignals.filter((r) => r.protected);
     const unprotectedRoutes = routeSignals.filter((r) => !r.protected);
     for (const r of routeSignals) {
-        evidence.push({ type: 'snippet', value: r.snippet, file: r.file, line: r.line });
+        evidence.push({ type: 'snippet', value: r.snippet, file: r.file, line: r.line, claim: 'uploads' });
     }
     for (const m of djangoPublicSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'uploads' });
     for (const m of validationSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'validation' });
     const publicExposure = unprotectedRoutes.length > 0 || djangoPublicSignals.length > 0;
     const protectedSomehow = protectedRoutes.length > 0 || djangoProtectionSignals.length > 0;
     return {

package/dist/report/categoryScores.js

@@ -86,7 +86,22 @@ function buildCategoryScores(findings) {
          * critical and nine passing checks is not 90% healthy". The cap keeps that;
          * the proportion does the ranking underneath it.
          */
-        const worstOpen = actionable.reduce((worst, finding) => (SEVERITY_WEIGHT[finding.stakes] > SEVERITY_WEIGHT[worst] ? finding.stakes : worst), 'info');
+        /**
+         * The ceiling follows what the report says is wrong, not what the area is worth.
+         *
+         * These are two different numbers on purpose: `stakes` is what a capability is worth
+         * before confidence is folded in, and `severity` is what the report is willing to
+         * claim about it. Using stakes here capped a category at the critical ceiling while
+         * the row beside it read "0 critical" — a Django project with four of five security
+         * checks verified and one high finding open scored 20 of 100, below an area with one
+         * of three verified.
+         *
+         * The proportion below still uses stakes, which is right: how much of what is at
+         * stake is failing does not change because the report hedged. What changes is the
+         * cap, and a cap that says "nothing looks healthy while something severe is open"
+         * has to mean the severity the reader was shown.
+         */
+        const worstOpen = actionable.reduce((worst, finding) => (SEVERITY_WEIGHT[finding.severity] > SEVERITY_WEIGHT[worst] ? finding.severity : worst), 'info');
         const ceiling = SEVERITY_CEILING[worstOpen];
         return {
             category,

package/dist/rules/rules.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rules = void 0;
 const inferProductProfile_1 = require("../expectations/inferProductProfile");
+const absenceEvidence_1 = require("../analyzer/absenceEvidence");
 function statusFromFlags(present, complete) {
     if (!present)
         return 'missing';
@@ -484,7 +485,20 @@ exports.rules = [
                             ? 'Upload handling was found, and none of it is publicly exposed.'
                             : 'No upload handling was found in this repository.',
                 recommendation: 'Protect upload routes with authz, validate MIME/type, and prefer private object storage.',
-                evidence: up?.evidence ?? [],
+                /**
+                 * The evidence follows the claim.
+                 *
+                 * "No upload handling was found in this repository" used to arrive with six
+                 * snippets under it, five of them Django auth decorators, and a confidence of
+                 * high earned from them. Where nothing was found, the honest citation is the
+                 * terms that were looked for.
+                 */
+                evidence: status === 'unknown'
+                    ? (0, absenceEvidence_1.searchedFor)('upload handling', ['multer', 'formidable', 'django-storages', 'FileField', '/uploads', 'express.static'])
+                    // The routes and the public-serving lines, which is what this claim is about.
+                    // Validation and antivirus signals are tagged separately and belong to other
+                    // questions.
+                    : evidenceForClaim(up?.evidence, 'uploads'),
             });
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {