@produtype/core 0.48.0 → 0.49.0

package/dist/analyzer/detectEnv.js

@@ -13,6 +13,15 @@ const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s
  */
 const SECRET_ASSIGNMENT_CONTEXT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_KEY|jwt_secret|secret_key|session_secret|api_key)\s*[:=]|process\.env\.[A-Z0-9_]*(SECRET|API_KEY)/;
 const GENERIC_SECRET_ASSIGNMENT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_KEY)\s*[:=]\s*['"][^'"]+['"]/i;
+/**
+ * A value that exists to hide a secret, not to be one.
+ *
+ * `config.global_settings.jwt_secret = "***"` is windmill's own redaction, in the
+ * command that prints an instance's settings, and it was reported as a hardcoded
+ * secret. The weak-value test runs on the whole line, and the line says "secret"
+ * because the identifier does — so the value itself was never looked at.
+ */
+const REDACTED_VALUE_RE = /[:=]\s*['"`](\*{2,}|x{3,}|<?\[?redacted\]?>?|hidden|\.{3,})['"`]/i;
 function classifySecretFallback(snippet) {
     if (/JWT_SECRET/i.test(snippet))
         return 'jwt';
@@ -119,6 +128,7 @@ async function detectEnv(ctx) {
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
         && !valueIsAnIdentifier(m.snippet)
+        && !REDACTED_VALUE_RE.test(m.snippet)
         && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };

package/dist/analyzer/developmentOnly.d.ts

@@ -1 +1,21 @@
 export declare function isDevelopmentOnlyFile(file: string): boolean;
+/**
+ * The lines of a Rust file that only exist to test it.
+ *
+ * windmill was reported with a `critical` hardcoded secret:
+ * `secret_key: "wrong_secret".to_string()`, in `http_trigger_auth.rs`. It is the
+ * fixture of `test_github_authenticate_wrong_secret` — a test asserting that the
+ * wrong secret is rejected — and the whole block sits under `#[cfg(test)]`, four
+ * hundred lines below the code it tests.
+ *
+ * The path filter cannot help here and never could: Rust keeps its unit tests inside
+ * the file they test, so there is no `tests/` directory to exclude. The language says
+ * plainly which lines are test-only, in an attribute written for exactly this purpose,
+ * and nothing was reading it.
+ *
+ * Brace depth rather than a parser: `#[cfg(test)]` is followed by a module, and a
+ * module ends where its braces balance. Strings containing braces would confuse it,
+ * and the cost of being confused is excluding a few more lines from a security scan
+ * of test code — which is where it was heading anyway.
+ */
+export declare function testOnlyLines(file: string, text: string): Set<number>;

package/dist/analyzer/developmentOnly.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isDevelopmentOnlyFile = isDevelopmentOnlyFile;
+exports.testOnlyLines = testOnlyLines;
 /**
  * A file the product does not run in production.
  *
@@ -21,3 +22,48 @@ const DEVELOPMENT_ONLY_PATHS = [
 function isDevelopmentOnlyFile(file) {
     return DEVELOPMENT_ONLY_PATHS.some((pattern) => pattern.test(file));
 }
+/**
+ * The lines of a Rust file that only exist to test it.
+ *
+ * windmill was reported with a `critical` hardcoded secret:
+ * `secret_key: "wrong_secret".to_string()`, in `http_trigger_auth.rs`. It is the
+ * fixture of `test_github_authenticate_wrong_secret` — a test asserting that the
+ * wrong secret is rejected — and the whole block sits under `#[cfg(test)]`, four
+ * hundred lines below the code it tests.
+ *
+ * The path filter cannot help here and never could: Rust keeps its unit tests inside
+ * the file they test, so there is no `tests/` directory to exclude. The language says
+ * plainly which lines are test-only, in an attribute written for exactly this purpose,
+ * and nothing was reading it.
+ *
+ * Brace depth rather than a parser: `#[cfg(test)]` is followed by a module, and a
+ * module ends where its braces balance. Strings containing braces would confuse it,
+ * and the cost of being confused is excluding a few more lines from a security scan
+ * of test code — which is where it was heading anyway.
+ */
+function testOnlyLines(file, text) {
+    const testOnly = new Set();
+    if (!/\.rs$/i.test(file))
+        return testOnly;
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        if (!/^\s*#\[cfg\(test\)\]/.test(lines[i]))
+            continue;
+        let depth = 0;
+        let opened = false;
+        for (let j = i + 1; j < lines.length; j++) {
+            testOnly.add(j + 1);
+            for (const character of lines[j]) {
+                if (character === '{') {
+                    depth++;
+                    opened = true;
+                }
+                else if (character === '}')
+                    depth--;
+            }
+            if (opened && depth <= 0)
+                break;
+        }
+    }
+    return testOnly;
+}

package/dist/utils/textSearch.js

@@ -5,6 +5,7 @@ exports.matchLines = matchLines;
 exports.searchInFiles = searchInFiles;
 exports.anyIncludes = anyIncludes;
 const readTextFileSafe_1 = require("./readTextFileSafe");
+const developmentOnly_1 = require("../analyzer/developmentOnly");
 /**
  * A line that declares a pattern rather than doing anything.
  *
@@ -96,8 +97,16 @@ const MAX_CITABLE_LINE = 500;
 function matchLines(text, needles, file = '') {
     const matches = [];
     const lines = text.split(/\r?\n/);
+    /**
+     * Rust keeps its unit tests in the file they test, so no path filter can exclude
+     * them. windmill was reported with a `critical` hardcoded secret that was the
+     * fixture of a test asserting the wrong secret is rejected.
+     */
+    const testOnly = (0, developmentOnly_1.testOnlyLines)(file, text);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
+        if (testOnly.has(i + 1))
+            continue;
         if (line.length > MAX_CITABLE_LINE)
             continue;
         if (declaresRatherThanDoes(line))
@@ -125,8 +134,11 @@ async function searchInFiles(root, files, needles, limit = 25) {
         if (!text)
             continue;
         const lines = text.split(/\r?\n/);
+        const testOnly = (0, developmentOnly_1.testOnlyLines)(file, text);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
+            if (testOnly.has(i + 1))
+                continue;
             if (line.length > MAX_CITABLE_LINE)
                 continue;
             if (declaresRatherThanDoes(line))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {