@produtype/core 0.22.1 → 0.23.0

package/dist/analyzer/detectUploads.js

@@ -30,12 +30,22 @@ async function detectUploads(ctx) {
     const uploadDeps = (0, detectContext_1.hasAnyDep)(ctx, ['multer', 'formidable', '@aws-sdk/client-s3', 'aws-sdk']);
     const pyUploadDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['boto3']);
     const avDeps = (0, detectContext_1.hasAnyDep)(ctx, ['clamav', 'clamscan']);
+    /**
+     * Each line tagged with the claim it supports.
+     *
+     * Everything this detector finds used to land in one array, so a report that said "no
+     * upload handling was found in this repository" cited six snippets under it — five of
+     * them `LoginRequiredMixin` and `@login_required`, one a PDF content type — and was
+     * stamped "confidence: high, evidence quality: strong" for them. That a project has
+     * authentication is why an upload check would matter; it is not evidence about
+     * uploads, and the rate-limit rule already carries that sentence for the same reason.
+     */
     for (const d of uploadDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'uploads' });
     for (const d of pyUploadDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'uploads' });
     for (const d of avDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'antivirus' });
     const routeSignals = [];
     for (const file of ctx.files.source) {
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
@@ -74,18 +84,18 @@ async function detectUploads(ctx) {
         /@permission_required/,
     ], 15);
     for (const m of djangoProtectionSignals) {
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'protection' });
     }
     const validationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/file-type/i, /mime/i, /content-type/i], 15);
     const protectedRoutes = routeSignals.filter((r) => r.protected);
     const unprotectedRoutes = routeSignals.filter((r) => !r.protected);
     for (const r of routeSignals) {
-        evidence.push({ type: 'snippet', value: r.snippet, file: r.file, line: r.line });
+        evidence.push({ type: 'snippet', value: r.snippet, file: r.file, line: r.line, claim: 'uploads' });
     }
     for (const m of djangoPublicSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'uploads' });
     for (const m of validationSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'validation' });
     const publicExposure = unprotectedRoutes.length > 0 || djangoPublicSignals.length > 0;
     const protectedSomehow = protectedRoutes.length > 0 || djangoProtectionSignals.length > 0;
     return {

package/dist/rules/rules.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rules = void 0;
 const inferProductProfile_1 = require("../expectations/inferProductProfile");
+const absenceEvidence_1 = require("../analyzer/absenceEvidence");
 function statusFromFlags(present, complete) {
     if (!present)
         return 'missing';
@@ -484,7 +485,20 @@ exports.rules = [
                             ? 'Upload handling was found, and none of it is publicly exposed.'
                             : 'No upload handling was found in this repository.',
                 recommendation: 'Protect upload routes with authz, validate MIME/type, and prefer private object storage.',
-                evidence: up?.evidence ?? [],
+                /**
+                 * The evidence follows the claim.
+                 *
+                 * "No upload handling was found in this repository" used to arrive with six
+                 * snippets under it, five of them Django auth decorators, and a confidence of
+                 * high earned from them. Where nothing was found, the honest citation is the
+                 * terms that were looked for.
+                 */
+                evidence: status === 'unknown'
+                    ? (0, absenceEvidence_1.searchedFor)('upload handling', ['multer', 'formidable', 'django-storages', 'FileField', '/uploads', 'express.static'])
+                    // The routes and the public-serving lines, which is what this claim is about.
+                    // Validation and antivirus signals are tagged separately and belong to other
+                    // questions.
+                    : evidenceForClaim(up?.evidence, 'uploads'),
             });
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {