@produtype/core 0.36.0 → 0.37.0

package/dist/analyzer/detectEnv.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
+const lookupTables_1 = require("./structural/lookupTables");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -83,9 +84,21 @@ async function detectEnv(ctx) {
      * the thing actually being claimed.
      */
     const fallbackHits = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [FALLBACK_SECRET_RE, ENV_FALLBACK_RE, GENERIC_SECRET_ASSIGNMENT_RE], 30);
+    /**
+     * Entries in a lookup table, which text cannot tell from assignments.
+     *
+     * `admin_session_secret: 'core'` is one property of a sixty-entry map from settings to
+     * the group they belong to, and Ghost was told it was a hardcoded secret. The table is
+     * visible only in the shape, so this is one of the places a syntax tree earns its
+     * keep. Absent the optional parser the map is null and nothing is excused, which is
+     * the behaviour this product had yesterday.
+     */
+    const lookupTables = await (0, lookupTables_1.readLookupTableLines)(ctx.root, sourceFiles);
+    const isTableEntry = (match) => lookupTables?.get(match.file)?.has(match.line) === true;
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
-        && !namesItself(m.snippet));
+        && !namesItself(m.snippet)
+        && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };
         evidence.push(hitEvidence);

package/dist/analyzer/structural/lookupTables.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Which lines of which files are table entries, or null when the question cannot be asked.
+ *
+ * `null` means the optional TypeScript dependency is absent, not that there are no
+ * tables — the caller keeps whatever it found rather than discarding it.
+ */
+export declare function readLookupTableLines(root: string, files: string[]): Promise<Map<string, Set<number>> | null>;

package/dist/analyzer/structural/lookupTables.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLookupTableLines = readLookupTableLines;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * Lines that are entries in a lookup table rather than assignments.
+ *
+ * Ghost keeps a map of every setting to the group it belongs to:
+ *
+ *     admin_session_secret: 'core',
+ *     theme_session_secret: 'core',
+ *     members_email_auth_secret: 'core',
+ *
+ * Read as text this is a secret-named key assigned a short string, which is exactly
+ * the shape of a hardcoded fallback — and Ghost was told it had a critical. Read as a
+ * tree it is one property of an object with sixty of them, and what it says is "this
+ * setting is in the core group".
+ *
+ * Nothing in the words tells the two apart. The table is visible only in the shape.
+ */
+/**
+ * How many string-valued properties make an object a table.
+ *
+ * Low enough to catch a modest map, high enough that a small configuration object —
+ * `{ secret: 'dev-secret', port: 3000 }`, which is a real finding — is not excused.
+ * A genuine fallback secret sits in an object with a handful of siblings at most.
+ */
+const TABLE_SIZE = 8;
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const MAX_READABLE_LINE = 500;
+function tableLines(ts, file, text) {
+    const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+    const lines = new Set();
+    const visit = (node) => {
+        if (ts.isObjectLiteralExpression(node)) {
+            const properties = node.properties.filter(ts.isPropertyAssignment);
+            const stringValued = properties.filter((property) => ts.isStringLiteral(property.initializer)
+                || ts.isNoSubstitutionTemplateLiteral(property.initializer));
+            /**
+             * Every property a string, and plenty of them. A mixed object — some strings,
+             * some calls, some numbers — is configuration, and configuration is where a
+             * fallback secret actually lives.
+             */
+            if (stringValued.length >= TABLE_SIZE && stringValued.length === properties.length) {
+                for (const property of stringValued) {
+                    lines.add(source.getLineAndCharacterOfPosition(property.getStart(source)).line + 1);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return lines;
+}
+/**
+ * Which lines of which files are table entries, or null when the question cannot be asked.
+ *
+ * `null` means the optional TypeScript dependency is absent, not that there are no
+ * tables — the caller keeps whatever it found rather than discarding it.
+ */
+async function readLookupTableLines(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const found = new Map();
+    for (const file of files.filter((candidate) => READABLE.test(candidate))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text || text.split(/\r?\n/).some((line) => line.length > MAX_READABLE_LINE))
+            continue;
+        try {
+            const lines = tableLines(ts, file, text);
+            if (lines.size > 0)
+                found.set(file, lines);
+        }
+        catch {
+            // A file the parser refuses keeps whatever the text layer decided about it.
+        }
+    }
+    return found;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {