@produtype/core 0.36.0 → 0.38.0

package/dist/analyzer/detectEnv.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
+const lookupTables_1 = require("./structural/lookupTables");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -83,9 +84,21 @@ async function detectEnv(ctx) {
      * the thing actually being claimed.
      */
     const fallbackHits = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [FALLBACK_SECRET_RE, ENV_FALLBACK_RE, GENERIC_SECRET_ASSIGNMENT_RE], 30);
+    /**
+     * Entries in a lookup table, which text cannot tell from assignments.
+     *
+     * `admin_session_secret: 'core'` is one property of a sixty-entry map from settings to
+     * the group they belong to, and Ghost was told it was a hardcoded secret. The table is
+     * visible only in the shape, so this is one of the places a syntax tree earns its
+     * keep. Absent the optional parser the map is null and nothing is excused, which is
+     * the behaviour this product had yesterday.
+     */
+    const lookupTables = await (0, lookupTables_1.readLookupTableLines)(ctx.root, sourceFiles);
+    const isTableEntry = (match) => lookupTables?.get(match.file)?.has(match.line) === true;
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
-        && !namesItself(m.snippet));
+        && !namesItself(m.snippet)
+        && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };
         evidence.push(hitEvidence);

package/dist/analyzer/structural/lookupTables.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Which lines of which files are table entries, or null when the question cannot be asked.
+ *
+ * `null` means the optional TypeScript dependency is absent, not that there are no
+ * tables — the caller keeps whatever it found rather than discarding it.
+ */
+export declare function readLookupTableLines(root: string, files: string[]): Promise<Map<string, Set<number>> | null>;

package/dist/analyzer/structural/lookupTables.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readLookupTableLines = readLookupTableLines;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * Lines that are entries in a lookup table rather than assignments.
+ *
+ * Ghost keeps a map of every setting to the group it belongs to:
+ *
+ *     admin_session_secret: 'core',
+ *     theme_session_secret: 'core',
+ *     members_email_auth_secret: 'core',
+ *
+ * Read as text this is a secret-named key assigned a short string, which is exactly
+ * the shape of a hardcoded fallback — and Ghost was told it had a critical. Read as a
+ * tree it is one property of an object with sixty of them, and what it says is "this
+ * setting is in the core group".
+ *
+ * Nothing in the words tells the two apart. The table is visible only in the shape.
+ */
+/**
+ * How many string-valued properties make an object a table.
+ *
+ * Low enough to catch a modest map, high enough that a small configuration object —
+ * `{ secret: 'dev-secret', port: 3000 }`, which is a real finding — is not excused.
+ * A genuine fallback secret sits in an object with a handful of siblings at most.
+ */
+const TABLE_SIZE = 8;
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const MAX_READABLE_LINE = 500;
+function tableLines(ts, file, text) {
+    const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+    const lines = new Set();
+    const visit = (node) => {
+        if (ts.isObjectLiteralExpression(node)) {
+            const properties = node.properties.filter(ts.isPropertyAssignment);
+            const stringValued = properties.filter((property) => ts.isStringLiteral(property.initializer)
+                || ts.isNoSubstitutionTemplateLiteral(property.initializer));
+            /**
+             * Every property a string, and plenty of them. A mixed object — some strings,
+             * some calls, some numbers — is configuration, and configuration is where a
+             * fallback secret actually lives.
+             */
+            if (stringValued.length >= TABLE_SIZE && stringValued.length === properties.length) {
+                for (const property of stringValued) {
+                    lines.add(source.getLineAndCharacterOfPosition(property.getStart(source)).line + 1);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return lines;
+}
+/**
+ * Which lines of which files are table entries, or null when the question cannot be asked.
+ *
+ * `null` means the optional TypeScript dependency is absent, not that there are no
+ * tables — the caller keeps whatever it found rather than discarding it.
+ */
+async function readLookupTableLines(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const found = new Map();
+    for (const file of files.filter((candidate) => READABLE.test(candidate))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text || text.split(/\r?\n/).some((line) => line.length > MAX_READABLE_LINE))
+            continue;
+        try {
+            const lines = tableLines(ts, file, text);
+            if (lines.size > 0)
+                found.set(file, lines);
+        }
+        catch {
+            // A file the parser refuses keeps whatever the text layer decided about it.
+        }
+    }
+    return found;
+}

package/dist/report/buildReport.js

@@ -14,6 +14,7 @@ const evidenceDigest_1 = require("./evidenceDigest");
 const complianceMapping_1 = require("./complianceMapping");
 const executiveSummary_1 = require("./executiveSummary");
 const remediationCatalog_1 = require("../planner/remediationCatalog");
+const detectPackaging_1 = require("../analyzer/detectPackaging");
 // Derived from the union in report/types.ts, so a new category cannot be missed here.
 function bySeverityPriority(f) {
     const order = {
@@ -50,6 +51,27 @@ function determineExpectationMode(requestedProfile, productProfile, expectationS
     }
     return 'explicit-profile';
 }
+/**
+ * A finding whose every citation is in the documentation site or a playground.
+ *
+ * Medusa was told its CORS policy was open, evidenced from `www/apps/cloud/`, and that
+ * its Stripe webhook handling was unverified, evidenced from the documentation's
+ * `sidebar.mjs` — the navigation menu that lists a page about webhooks. Vite keeps ten
+ * Express servers under `playground/` for the same kind of reason.
+ *
+ * These are not false matches: the lines are there. They are matches about something
+ * other than the product, and a report that cannot tell the two apart tells its reader
+ * to go and fix a documentation site.
+ *
+ * Only where the repository has source outside those directories. A documentation site
+ * that *is* the product keeps every finding it earns.
+ */
+function onlyEvidencedInDocumentation(finding, hasProductSource) {
+    if (!hasProductSource)
+        return false;
+    const cited = finding.evidence.filter((item) => item.file);
+    return cited.length > 0 && cited.every((item) => detectPackaging_1.DOCS_DIRECTORIES.test(item.file));
+}
 function buildReport(analysis, options) {
     const observedFindings = (0, ruleEngine_1.runRules)(analysis);
     const observedScore = (0, score_1.computeScore)(observedFindings);
@@ -109,7 +131,23 @@ function buildReport(analysis, options) {
             expectationScore = evaluated.result.score;
         }
     }
-    const findings = (0, evidenceDigest_1.withEvidenceDigest)((0, businessImpact_1.withBusinessImpact)([...observedFindings, ...expectationFindings].sort((a, b) => bySeverityPriority(a) - bySeverityPriority(b))));
+    /**
+     * Whether this repository is more than its documentation.
+     *
+     * If every source file lives under `docs/` or `website/`, the documentation is the
+     * product and its findings are the product's.
+     */
+    const hasProductSource = analysis.files.source.some((file) => !detectPackaging_1.DOCS_DIRECTORIES.test(file));
+    const findings = (0, evidenceDigest_1.withEvidenceDigest)((0, businessImpact_1.withBusinessImpact)([...observedFindings, ...expectationFindings]
+        .map((finding) => onlyEvidencedInDocumentation(finding, hasProductSource)
+        ? {
+            ...finding,
+            status: 'unknown',
+            severity: 'info',
+            description: `${finding.description} Every line behind this is in the documentation site or a playground rather than in the product, so nothing here says the product does it.`,
+        }
+        : finding)
+        .sort((a, b) => bySeverityPriority(a) - bySeverityPriority(b))));
     const combinedScore = expectationScore === undefined
         ? observedScore
         : Math.max(0, Math.min(100, Math.round((observedScore * 0.6) + (expectationScore * 0.4))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {