@produtype/core 0.63.0 → 0.64.0

package/dist/analyzer/detectSecurity.js

@@ -44,19 +44,32 @@ function withoutStringLiterals(line) {
 }
 /** The Express middleware, brought into the file that configures it. */
 const IMPORTS_CORS = /(require\(['"]cors['"]\))|(from\s+['"]cors['"])|(import\s+['"]cors['"])/;
-function detectCorsConfig(text, file) {
+/**
+ * The middleware, under whatever name it was given.
+ *
+ * `cors(` is the name of the export, and an author is free not to use it:
+ * `const apriTutto = require('cors'); app.use(apriTutto());` is a wide-open policy
+ * that came back as "CORS configuration not detected" — a real hole reported as the
+ * absence of a question. The package is the anchor; the names come from the binding
+ * and are recognised here rather than guessed.
+ */
+function detectCorsConfig(text, file, boundNames) {
     const loose = [];
     const strict = [];
     const lines = text.split(/\r?\n/);
-    const corsVarRegex = /\bcors\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+    const names = [...new Set(['cors', ...boundNames])].map((name) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    const anyName = names.join('|');
+    const callRegex = new RegExp(`\\b(?:${anyName})\\s*\\(`);
+    const bareCallRegex = new RegExp(`\\b(?:${anyName})\\(\\s*\\)`);
+    const corsVarRegex = new RegExp(`\\b(?:${anyName})\\(\\s*([A-Za-z_$][\\w$]*)\\s*\\)`);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (!(0, textSearch_1.isCitableLine)(line))
             continue;
-        if (!/\bcors\s*\(/.test(withoutStringLiterals(line)))
+        if (!callRegex.test(withoutStringLiterals(line)))
             continue;
         const snippet = line.trim().slice(0, 200);
-        if (/\bcors\(\s*\)/.test(line)) {
+        if (bareCallRegex.test(line)) {
             loose.push({ file, line: i + 1, snippet });
             continue;
         }
@@ -202,6 +215,14 @@ async function detectSecurity(ctx) {
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of rateLimitSignals)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
+    /**
+     * Every identifier the `cors` package reaches, per file.
+     *
+     * `const apriTutto = require('cors')` binds the middleware to a name no word list
+     * will ever hold, and `app.use(apriTutto())` is a wide-open policy that read as no
+     * policy at all. The import is the fact; the name is whatever this author typed.
+     */
+    const corsBindings = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, ['cors']);
     const corsLoose = [];
     const corsStrict = [];
     for (const file of source) {
@@ -243,9 +264,11 @@ async function detectSecurity(ctx) {
         }
         if (!IMPORTS_CORS.test(text))
             continue;
-        if (!/\bcors\s*\(/.test(text))
+        const boundNames = new Set((corsBindings ?? []).filter((use) => use.file === file).map((use) => use.name));
+        // `cors(` under its own name, or under the one the binding gave it.
+        if (boundNames.size === 0 && !/\bcors\s*\(/.test(text))
             continue;
-        const detected = detectCorsConfig(text, file);
+        const detected = detectCorsConfig(text, file, boundNames);
         corsLoose.push(...detected.loose);
         corsStrict.push(...detected.strict);
     }

package/dist/analyzer/structural/valuesFromPackage.d.ts

@@ -1,6 +1,14 @@
 export interface PackageValueUse {
     file: string;
     line: number;
+    /**
+     * The identifier the value is reached through.
+     *
+     * A caller that needs to reason about the call — is this `cors()` bare or
+     * `cors({ origin })`? — needs the name the author gave it, not to guess the name
+     * but to recognise it once the import has already proved what it is.
+     */
+    name: string;
     /**
      * The path it was mounted on, where the use is an argument to `use(path, value)`.
      *

package/dist/analyzer/structural/valuesFromPackage.js

@@ -155,6 +155,7 @@ async function readPackageValueUses(root, files, packages) {
                     uses.push({
                         file,
                         line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                        name: node.text,
                         mountPath: mountPathOf(ts, node),
                     });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.63.0",
+  "version": "0.64.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {