@produtype/core 0.63.0 → 0.65.0

package/dist/analyzer/detectEnv.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
+const secretArguments_1 = require("./structural/secretArguments");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -124,6 +125,20 @@ async function detectEnv(ctx) {
      */
     const lookupTables = await (0, lookupTables_1.readLookupTableLines)(ctx.root, sourceFiles);
     const isTableEntry = (match) => lookupTables?.get(match.file)?.has(match.line) === true;
+    /**
+     * The other end of the value, where the library says what it is.
+     *
+     * Everything above starts from the name being assigned, and the name is the
+     * author's: an Italian application signing with `const chiave =
+     * process.env.CHIAVE_FIRMA || 'cambiami'` came back `passed`. `jwt.sign(payload,
+     * secret)` defines its second argument, and arriving there is what makes a literal
+     * a secret whatever it was called on the way.
+     */
+    const secretArguments = await (0, secretArguments_1.readHardcodedSecretArguments)(ctx.root, sourceFiles);
+    for (const hit of secretArguments ?? []) {
+        weakSecretEvidence.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
+        weakSecretByType.unknown.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
+    }
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)

package/dist/analyzer/detectSecurity.js

@@ -44,19 +44,32 @@ function withoutStringLiterals(line) {
 }
 /** The Express middleware, brought into the file that configures it. */
 const IMPORTS_CORS = /(require\(['"]cors['"]\))|(from\s+['"]cors['"])|(import\s+['"]cors['"])/;
-function detectCorsConfig(text, file) {
+/**
+ * The middleware, under whatever name it was given.
+ *
+ * `cors(` is the name of the export, and an author is free not to use it:
+ * `const apriTutto = require('cors'); app.use(apriTutto());` is a wide-open policy
+ * that came back as "CORS configuration not detected" — a real hole reported as the
+ * absence of a question. The package is the anchor; the names come from the binding
+ * and are recognised here rather than guessed.
+ */
+function detectCorsConfig(text, file, boundNames) {
     const loose = [];
     const strict = [];
     const lines = text.split(/\r?\n/);
-    const corsVarRegex = /\bcors\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+    const names = [...new Set(['cors', ...boundNames])].map((name) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    const anyName = names.join('|');
+    const callRegex = new RegExp(`\\b(?:${anyName})\\s*\\(`);
+    const bareCallRegex = new RegExp(`\\b(?:${anyName})\\(\\s*\\)`);
+    const corsVarRegex = new RegExp(`\\b(?:${anyName})\\(\\s*([A-Za-z_$][\\w$]*)\\s*\\)`);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (!(0, textSearch_1.isCitableLine)(line))
             continue;
-        if (!/\bcors\s*\(/.test(withoutStringLiterals(line)))
+        if (!callRegex.test(withoutStringLiterals(line)))
             continue;
         const snippet = line.trim().slice(0, 200);
-        if (/\bcors\(\s*\)/.test(line)) {
+        if (bareCallRegex.test(line)) {
             loose.push({ file, line: i + 1, snippet });
             continue;
         }
@@ -202,6 +215,14 @@ async function detectSecurity(ctx) {
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of rateLimitSignals)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
+    /**
+     * Every identifier the `cors` package reaches, per file.
+     *
+     * `const apriTutto = require('cors')` binds the middleware to a name no word list
+     * will ever hold, and `app.use(apriTutto())` is a wide-open policy that read as no
+     * policy at all. The import is the fact; the name is whatever this author typed.
+     */
+    const corsBindings = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, ['cors']);
     const corsLoose = [];
     const corsStrict = [];
     for (const file of source) {
@@ -243,9 +264,11 @@ async function detectSecurity(ctx) {
         }
         if (!IMPORTS_CORS.test(text))
             continue;
-        if (!/\bcors\s*\(/.test(text))
+        const boundNames = new Set((corsBindings ?? []).filter((use) => use.file === file).map((use) => use.name));
+        // `cors(` under its own name, or under the one the binding gave it.
+        if (boundNames.size === 0 && !/\bcors\s*\(/.test(text))
             continue;
-        const detected = detectCorsConfig(text, file);
+        const detected = detectCorsConfig(text, file, boundNames);
         corsLoose.push(...detected.loose);
         corsStrict.push(...detected.strict);
     }

package/dist/analyzer/structural/secretArguments.d.ts

@@ -0,0 +1,8 @@
+export interface HardcodedSecretArgument {
+    file: string;
+    line: number;
+    snippet: string;
+    /** The call that defines this value as a secret, for the sentence shown to a reader. */
+    sink: string;
+}
+export declare function readHardcodedSecretArguments(root: string, files: string[]): Promise<HardcodedSecretArgument[] | null>;

package/dist/analyzer/structural/secretArguments.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readHardcodedSecretArguments = readHardcodedSecretArguments;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * A literal reaching a parameter the library defines as a secret.
+ *
+ * Every other reading of "is this a hardcoded secret" starts from the name of the
+ * thing being assigned — `JWT_SECRET`, `SECRET_KEY`, `API_KEY`. That name is the
+ * author's, and an Italian application signing its tokens with
+ *
+ *     const chiave = process.env.CHIAVE_FIRMA || 'cambiami';
+ *     jwt.sign({ sub: utente.id }, chiave);
+ *
+ * came back `passed`: "no weak fallback secret patterns detected", about a signing
+ * key hardcoded in the source. The check congratulated it.
+ *
+ * The anchor that does not move is the other end. `jsonwebtoken.sign(payload, secret)`
+ * says what its second argument is — that is the library's contract, not a convention
+ * — and `crypto.createHmac(algorithm, key)` says the same. Whatever the value is
+ * called on the way there, arriving there is what makes it a secret.
+ *
+ * One hop of resolution, matching the rest of the structural readers: a literal
+ * passed directly, or an identifier declared in the same file whose initializer is a
+ * literal or falls back to one. Two hops would reach further and be wrong more often,
+ * and the text search remains underneath either way.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const SECRET_SINKS = [
+    { package: 'jsonwebtoken', method: 'sign', argument: 1 },
+    { package: 'jsonwebtoken', method: 'verify', argument: 1 },
+    { package: 'crypto', method: 'createHmac', argument: 1 },
+    { package: 'node:crypto', method: 'createHmac', argument: 1 },
+    { package: 'crypto', method: 'createCipheriv', argument: 1 },
+    { package: 'node:crypto', method: 'createCipheriv', argument: 1 },
+    { package: 'express-session', option: 'secret' },
+    { package: 'cookie-session', option: 'secret' },
+    { package: 'iron-session', option: 'password' },
+];
+function bindingsFor(ts, source, specifier) {
+    const bound = new Set();
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+            if (node.moduleSpecifier.text === specifier) {
+                const clause = node.importClause;
+                if (clause?.name)
+                    bound.add(clause.name.text);
+                if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings))
+                    bound.add(clause.namedBindings.name.text);
+                if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+                    for (const element of clause.namedBindings.elements)
+                        bound.add(element.name.text);
+                }
+            }
+        }
+        if (ts.isVariableDeclaration(node)
+            && node.initializer
+            && ts.isCallExpression(node.initializer)
+            && ts.isIdentifier(node.initializer.expression)
+            && node.initializer.expression.text === 'require'
+            && node.initializer.arguments.length === 1
+            && ts.isStringLiteralLike(node.initializer.arguments[0])
+            && node.initializer.arguments[0].text === specifier) {
+            if (ts.isIdentifier(node.name))
+                bound.add(node.name.text);
+            if (ts.isObjectBindingPattern(node.name)) {
+                for (const element of node.name.elements) {
+                    if (ts.isIdentifier(element.name))
+                        bound.add(element.name.text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return bound;
+}
+/** The literal an expression is, or falls back to, following one declaration. */
+function literalBehind(ts, source, expression) {
+    if (ts.isStringLiteralLike(expression))
+        return true;
+    if (ts.isBinaryExpression(expression)
+        && (expression.operatorToken.kind === ts.SyntaxKind.BarBarToken
+            || expression.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken)) {
+        return literalBehind(ts, source, expression.right);
+    }
+    if (ts.isIdentifier(expression)) {
+        let found = false;
+        const visit = (node) => {
+            if (!found
+                && ts.isVariableDeclaration(node)
+                && ts.isIdentifier(node.name)
+                && node.name.text === expression.text
+                && node.initializer
+                && !ts.isIdentifier(node.initializer)) {
+                found = literalBehind(ts, source, node.initializer);
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return found;
+    }
+    return false;
+}
+async function readHardcodedSecretArguments(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const found = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!SECRET_SINKS.some((sink) => text.includes(sink.package.replace('node:', ''))))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        for (const sink of SECRET_SINKS) {
+            const bound = bindingsFor(ts, source, sink.package);
+            if (bound.size === 0)
+                continue;
+            const visit = (node) => {
+                if (ts.isCallExpression(node)) {
+                    const callee = node.expression;
+                    const named = sink.method
+                        ? ts.isPropertyAccessExpression(callee)
+                            && callee.name.text === sink.method
+                            && ts.isIdentifier(callee.expression)
+                            && bound.has(callee.expression.text)
+                        : ts.isIdentifier(callee) && bound.has(callee.text);
+                    if (named) {
+                        const report = (expression) => {
+                            if (!literalBehind(ts, source, expression))
+                                return;
+                            const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line;
+                            found.push({
+                                file,
+                                line: line + 1,
+                                snippet: (text.split(/\r?\n/)[line] ?? '').trim().slice(0, 200),
+                                sink: sink.method ? `${sink.package}.${sink.method}()` : `${sink.package}()`,
+                            });
+                        };
+                        if (sink.argument !== undefined) {
+                            const argument = node.arguments[sink.argument];
+                            if (argument)
+                                report(argument);
+                        }
+                        if (sink.option) {
+                            for (const argument of node.arguments) {
+                                if (!ts.isObjectLiteralExpression(argument))
+                                    continue;
+                                for (const property of argument.properties) {
+                                    if (ts.isPropertyAssignment(property)
+                                        && ts.isIdentifier(property.name)
+                                        && property.name.text === sink.option) {
+                                        report(property.initializer);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                ts.forEachChild(node, visit);
+            };
+            visit(source);
+        }
+    }
+    return found;
+}

package/dist/analyzer/structural/valuesFromPackage.d.ts

@@ -1,6 +1,14 @@
 export interface PackageValueUse {
     file: string;
     line: number;
+    /**
+     * The identifier the value is reached through.
+     *
+     * A caller that needs to reason about the call — is this `cors()` bare or
+     * `cors({ origin })`? — needs the name the author gave it, not to guess the name
+     * but to recognise it once the import has already proved what it is.
+     */
+    name: string;
     /**
      * The path it was mounted on, where the use is an argument to `use(path, value)`.
      *

package/dist/analyzer/structural/valuesFromPackage.js

@@ -155,6 +155,7 @@ async function readPackageValueUses(root, files, packages) {
                     uses.push({
                         file,
                         line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                        name: node.text,
                         mountPath: mountPathOf(ts, node),
                     });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.63.0",
+  "version": "0.65.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {