@produtype/core 0.64.0 → 0.65.0

package/dist/analyzer/detectEnv.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
+const secretArguments_1 = require("./structural/secretArguments");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -124,6 +125,20 @@ async function detectEnv(ctx) {
      */
     const lookupTables = await (0, lookupTables_1.readLookupTableLines)(ctx.root, sourceFiles);
     const isTableEntry = (match) => lookupTables?.get(match.file)?.has(match.line) === true;
+    /**
+     * The other end of the value, where the library says what it is.
+     *
+     * Everything above starts from the name being assigned, and the name is the
+     * author's: an Italian application signing with `const chiave =
+     * process.env.CHIAVE_FIRMA || 'cambiami'` came back `passed`. `jwt.sign(payload,
+     * secret)` defines its second argument, and arriving there is what makes a literal
+     * a secret whatever it was called on the way.
+     */
+    const secretArguments = await (0, secretArguments_1.readHardcodedSecretArguments)(ctx.root, sourceFiles);
+    for (const hit of secretArguments ?? []) {
+        weakSecretEvidence.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
+        weakSecretByType.unknown.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
+    }
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)

package/dist/analyzer/structural/secretArguments.d.ts

@@ -0,0 +1,8 @@
+export interface HardcodedSecretArgument {
+    file: string;
+    line: number;
+    snippet: string;
+    /** The call that defines this value as a secret, for the sentence shown to a reader. */
+    sink: string;
+}
+export declare function readHardcodedSecretArguments(root: string, files: string[]): Promise<HardcodedSecretArgument[] | null>;

package/dist/analyzer/structural/secretArguments.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readHardcodedSecretArguments = readHardcodedSecretArguments;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * A literal reaching a parameter the library defines as a secret.
+ *
+ * Every other reading of "is this a hardcoded secret" starts from the name of the
+ * thing being assigned — `JWT_SECRET`, `SECRET_KEY`, `API_KEY`. That name is the
+ * author's, and an Italian application signing its tokens with
+ *
+ *     const chiave = process.env.CHIAVE_FIRMA || 'cambiami';
+ *     jwt.sign({ sub: utente.id }, chiave);
+ *
+ * came back `passed`: "no weak fallback secret patterns detected", about a signing
+ * key hardcoded in the source. The check congratulated it.
+ *
+ * The anchor that does not move is the other end. `jsonwebtoken.sign(payload, secret)`
+ * says what its second argument is — that is the library's contract, not a convention
+ * — and `crypto.createHmac(algorithm, key)` says the same. Whatever the value is
+ * called on the way there, arriving there is what makes it a secret.
+ *
+ * One hop of resolution, matching the rest of the structural readers: a literal
+ * passed directly, or an identifier declared in the same file whose initializer is a
+ * literal or falls back to one. Two hops would reach further and be wrong more often,
+ * and the text search remains underneath either way.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const SECRET_SINKS = [
+    { package: 'jsonwebtoken', method: 'sign', argument: 1 },
+    { package: 'jsonwebtoken', method: 'verify', argument: 1 },
+    { package: 'crypto', method: 'createHmac', argument: 1 },
+    { package: 'node:crypto', method: 'createHmac', argument: 1 },
+    { package: 'crypto', method: 'createCipheriv', argument: 1 },
+    { package: 'node:crypto', method: 'createCipheriv', argument: 1 },
+    { package: 'express-session', option: 'secret' },
+    { package: 'cookie-session', option: 'secret' },
+    { package: 'iron-session', option: 'password' },
+];
+function bindingsFor(ts, source, specifier) {
+    const bound = new Set();
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+            if (node.moduleSpecifier.text === specifier) {
+                const clause = node.importClause;
+                if (clause?.name)
+                    bound.add(clause.name.text);
+                if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings))
+                    bound.add(clause.namedBindings.name.text);
+                if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+                    for (const element of clause.namedBindings.elements)
+                        bound.add(element.name.text);
+                }
+            }
+        }
+        if (ts.isVariableDeclaration(node)
+            && node.initializer
+            && ts.isCallExpression(node.initializer)
+            && ts.isIdentifier(node.initializer.expression)
+            && node.initializer.expression.text === 'require'
+            && node.initializer.arguments.length === 1
+            && ts.isStringLiteralLike(node.initializer.arguments[0])
+            && node.initializer.arguments[0].text === specifier) {
+            if (ts.isIdentifier(node.name))
+                bound.add(node.name.text);
+            if (ts.isObjectBindingPattern(node.name)) {
+                for (const element of node.name.elements) {
+                    if (ts.isIdentifier(element.name))
+                        bound.add(element.name.text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return bound;
+}
+/** The literal an expression is, or falls back to, following one declaration. */
+function literalBehind(ts, source, expression) {
+    if (ts.isStringLiteralLike(expression))
+        return true;
+    if (ts.isBinaryExpression(expression)
+        && (expression.operatorToken.kind === ts.SyntaxKind.BarBarToken
+            || expression.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken)) {
+        return literalBehind(ts, source, expression.right);
+    }
+    if (ts.isIdentifier(expression)) {
+        let found = false;
+        const visit = (node) => {
+            if (!found
+                && ts.isVariableDeclaration(node)
+                && ts.isIdentifier(node.name)
+                && node.name.text === expression.text
+                && node.initializer
+                && !ts.isIdentifier(node.initializer)) {
+                found = literalBehind(ts, source, node.initializer);
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return found;
+    }
+    return false;
+}
+async function readHardcodedSecretArguments(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const found = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!SECRET_SINKS.some((sink) => text.includes(sink.package.replace('node:', ''))))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        for (const sink of SECRET_SINKS) {
+            const bound = bindingsFor(ts, source, sink.package);
+            if (bound.size === 0)
+                continue;
+            const visit = (node) => {
+                if (ts.isCallExpression(node)) {
+                    const callee = node.expression;
+                    const named = sink.method
+                        ? ts.isPropertyAccessExpression(callee)
+                            && callee.name.text === sink.method
+                            && ts.isIdentifier(callee.expression)
+                            && bound.has(callee.expression.text)
+                        : ts.isIdentifier(callee) && bound.has(callee.text);
+                    if (named) {
+                        const report = (expression) => {
+                            if (!literalBehind(ts, source, expression))
+                                return;
+                            const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line;
+                            found.push({
+                                file,
+                                line: line + 1,
+                                snippet: (text.split(/\r?\n/)[line] ?? '').trim().slice(0, 200),
+                                sink: sink.method ? `${sink.package}.${sink.method}()` : `${sink.package}()`,
+                            });
+                        };
+                        if (sink.argument !== undefined) {
+                            const argument = node.arguments[sink.argument];
+                            if (argument)
+                                report(argument);
+                        }
+                        if (sink.option) {
+                            for (const argument of node.arguments) {
+                                if (!ts.isObjectLiteralExpression(argument))
+                                    continue;
+                                for (const property of argument.properties) {
+                                    if (ts.isPropertyAssignment(property)
+                                        && ts.isIdentifier(property.name)
+                                        && property.name.text === sink.option) {
+                                        report(property.initializer);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                ts.forEachChild(node, visit);
+            };
+            visit(source);
+        }
+    }
+    return found;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {