@produtype/core 0.40.0 → 0.41.0

package/dist/analyzer/detectEnv.js

@@ -45,6 +45,26 @@ function namesItself(snippet) {
     const flatten = (value) => value.toLowerCase().replace(/[^a-z0-9]/g, '');
     return flatten(assignment[1]) === flatten(assignment[2]);
 }
+/**
+ * The value is the name of something, spelled the way every language spells a name.
+ *
+ * `REDIS_SECRET_KEY = "SECRET_TOKEN"` in Discourse is the Redis key under which the
+ * secret is stored — the comment directly above it says so — and it was reported as a
+ * hardcoded secret at `critical`, the severity that bars a report from the top band.
+ * `namesItself` could not catch it: the constant and its value are two different
+ * names, so the letters do not match.
+ *
+ * What settles it is the shape. `SECRET_TOKEN` is SCREAMING_SNAKE_CASE, which is how
+ * constants, environment variables and Redis keys are written and not how secrets are
+ * written — a secret is entropy, and this has none. Kept to that one casing on
+ * purpose: `dev-secret` and `changeme` are lowercase and stay caught.
+ */
+function valueIsAnIdentifier(snippet) {
+    const assignment = /([A-Za-z_][A-Za-z0-9_]*)\s*[:=]\s*["'`]([^"'`]+)["'`]/.exec(snippet);
+    if (!assignment)
+        return false;
+    return /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/.test(assignment[2]);
+}
 async function detectEnv(ctx) {
     const evidence = [];
     const weakSecretEvidence = [];
@@ -98,6 +118,7 @@ async function detectEnv(ctx) {
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
+        && !valueIsAnIdentifier(m.snippet)
         && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };

package/dist/analyzer/detectSecurity.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
 /**
@@ -145,6 +146,10 @@ async function detectSecurity(ctx) {
     const corsLoose = [];
     const corsStrict = [];
     for (const file of source) {
+        // Rails picks one environment file by RAILS_ENV, so a header set in
+        // development.rb is not a header this product sends.
+        if ((0, developmentOnly_1.isDevelopmentOnlyFile)(file))
+            continue;
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
         if (!text)
             continue;

package/dist/analyzer/developmentOnly.d.ts

@@ -0,0 +1 @@
+export declare function isDevelopmentOnlyFile(file: string): boolean;

package/dist/analyzer/developmentOnly.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDevelopmentOnlyFile = isDevelopmentOnlyFile;
+/**
+ * A file the product does not run in production.
+ *
+ * Discourse was reported as allowing every cross-origin request, and one of the two
+ * lines behind it was `config/environments/development.rb:34`. Rails loads exactly one
+ * of those files, chosen by `RAILS_ENV`, so a header set in `development.rb` is as
+ * absent from production as a line inside `if settings.DEBUG:` — the same mistake this
+ * analyzer had already made in Python and fixed there.
+ *
+ * Deliberately only the frameworks that name the environment in the path, because
+ * that is the only case where the file's own name settles the question. A file called
+ * `dev-server.js` might be anything; `config/environments/test.rb` cannot be.
+ */
+const DEVELOPMENT_ONLY_PATHS = [
+    /(^|\/)config\/environments\/(?!production)[a-z_]+\.rb$/i,
+    /(^|\/)config\/environments\/(?!production)[a-z_]+\.exs$/i,
+];
+function isDevelopmentOnlyFile(file) {
+    return DEVELOPMENT_ONLY_PATHS.some((pattern) => pattern.test(file));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {