@produtype/core 0.35.0 → 0.37.0

package/dist/analyzer/analyzeProject.js

@@ -164,6 +164,20 @@ function isTestOrExamplePath(file) {
     // made PHP one of the languages of an Elixir analytics product — and of cal.com,
     // which is TypeScript.
     return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures?|frontend-example)(\/|$)/i.test(file)
+        /**
+         * The conventions other ecosystems use, which this list did not know.
+         *
+         * Three real products each raised a critical — the severity that bars a report from
+         * the top band — and every piece of evidence behind all three came from a test:
+         * cal.com from `playwright/` and `*.e2e.ts`, chatwoot from `spec/`, which is where
+         * every Ruby project puts its tests, medusa from `integration-tests/`. A syntax tree
+         * would have parsed the same files and reached the same wrong conclusion, which is
+         * the argument for fixing what gets read before fixing how.
+         */
+        || /(^|\/)(spec|specs|e2e|integration-tests?|cypress|playwright|testing)(\/|$)/i.test(file)
+        || /\.(e2e|e2e-spec|cy|stories)\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(file)
+        || /_spec\.rb$/i.test(file)
+        || /_test\.(go|py|rb|java|cs|php)$/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.

package/dist/analyzer/detectEnv.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
+const lookupTables_1 = require("./structural/lookupTables");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -23,6 +24,27 @@ function classifySecretFallback(snippet) {
         return 'apiKey';
     return 'unknown';
 }
+/**
+ * A value that is its own name is a name, not a secret.
+ *
+ * cal.com declares `export const X_CAL_SECRET_KEY = "x-cal-secret-key"` — the name of
+ * an HTTP header, spelled in kebab-case beside the constant that holds it — and it was
+ * reported as a hardcoded secret with the severity that bars a report from the top
+ * band. The same shape appears wherever a library names a field: `SECRET_KEY =
+ * 'AWS_SECRET_ACCESS_KEY'` in botocore is the name of an environment variable.
+ *
+ * Compared with the punctuation and case stripped, because the whole trick is that the
+ * two differ only in spelling: `X_CAL_SECRET_KEY` and `x-cal-secret-key` are the same
+ * eleven letters. Nothing else is excused — a real secret does not happen to equal the
+ * identifier it is assigned to.
+ */
+function namesItself(snippet) {
+    const assignment = /([A-Za-z_][A-Za-z0-9_]*)\s*[:=]\s*["'`]([^"'`]+)["'`]/.exec(snippet);
+    if (!assignment)
+        return false;
+    const flatten = (value) => value.toLowerCase().replace(/[^a-z0-9]/g, '');
+    return flatten(assignment[1]) === flatten(assignment[2]);
+}
 async function detectEnv(ctx) {
     const evidence = [];
     const weakSecretEvidence = [];
@@ -62,7 +84,21 @@ async function detectEnv(ctx) {
      * the thing actually being claimed.
      */
     const fallbackHits = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [FALLBACK_SECRET_RE, ENV_FALLBACK_RE, GENERIC_SECRET_ASSIGNMENT_RE], 30);
-    const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet) && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet));
+    /**
+     * Entries in a lookup table, which text cannot tell from assignments.
+     *
+     * `admin_session_secret: 'core'` is one property of a sixty-entry map from settings to
+     * the group they belong to, and Ghost was told it was a hardcoded secret. The table is
+     * visible only in the shape, so this is one of the places a syntax tree earns its
+     * keep. Absent the optional parser the map is null and nothing is excused, which is
+     * the behaviour this product had yesterday.
+     */
+    const lookupTables = await (0, lookupTables_1.readLookupTableLines)(ctx.root, sourceFiles);
+    const isTableEntry = (match) => lookupTables?.get(match.file)?.has(match.line) === true;
+    const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
+        && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
+        && !namesItself(m.snippet)
+        && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };
         evidence.push(hitEvidence);

package/dist/analyzer/structural/lookupTables.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Which lines of which files are table entries, or null when the question cannot be asked.
+ *
+ * `null` means the optional TypeScript dependency is absent, not that there are no
+ * tables — the caller keeps whatever it found rather than discarding it.
+ */
+export declare function readLookupTableLines(root: string, files: string[]): Promise<Map<string, Set<number>> | null>;

package/dist/analyzer/structural/lookupTables.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLookupTableLines = readLookupTableLines;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * Lines that are entries in a lookup table rather than assignments.
+ *
+ * Ghost keeps a map of every setting to the group it belongs to:
+ *
+ *     admin_session_secret: 'core',
+ *     theme_session_secret: 'core',
+ *     members_email_auth_secret: 'core',
+ *
+ * Read as text this is a secret-named key assigned a short string, which is exactly
+ * the shape of a hardcoded fallback — and Ghost was told it had a critical. Read as a
+ * tree it is one property of an object with sixty of them, and what it says is "this
+ * setting is in the core group".
+ *
+ * Nothing in the words tells the two apart. The table is visible only in the shape.
+ */
+/**
+ * How many string-valued properties make an object a table.
+ *
+ * Low enough to catch a modest map, high enough that a small configuration object —
+ * `{ secret: 'dev-secret', port: 3000 }`, which is a real finding — is not excused.
+ * A genuine fallback secret sits in an object with a handful of siblings at most.
+ */
+const TABLE_SIZE = 8;
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const MAX_READABLE_LINE = 500;
+function tableLines(ts, file, text) {
+    const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+    const lines = new Set();
+    const visit = (node) => {
+        if (ts.isObjectLiteralExpression(node)) {
+            const properties = node.properties.filter(ts.isPropertyAssignment);
+            const stringValued = properties.filter((property) => ts.isStringLiteral(property.initializer)
+                || ts.isNoSubstitutionTemplateLiteral(property.initializer));
+            /**
+             * Every property a string, and plenty of them. A mixed object — some strings,
+             * some calls, some numbers — is configuration, and configuration is where a
+             * fallback secret actually lives.
+             */
+            if (stringValued.length >= TABLE_SIZE && stringValued.length === properties.length) {
+                for (const property of stringValued) {
+                    lines.add(source.getLineAndCharacterOfPosition(property.getStart(source)).line + 1);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return lines;
+}
+/**
+ * Which lines of which files are table entries, or null when the question cannot be asked.
+ *
+ * `null` means the optional TypeScript dependency is absent, not that there are no
+ * tables — the caller keeps whatever it found rather than discarding it.
+ */
+async function readLookupTableLines(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const found = new Map();
+    for (const file of files.filter((candidate) => READABLE.test(candidate))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text || text.split(/\r?\n/).some((line) => line.length > MAX_READABLE_LINE))
+            continue;
+        try {
+            const lines = tableLines(ts, file, text);
+            if (lines.size > 0)
+                found.set(file, lines);
+        }
+        catch {
+            // A file the parser refuses keeps whatever the text layer decided about it.
+        }
+    }
+    return found;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {