@produtype/core 0.64.0 → 0.66.0

package/dist/analyzer/detectAuth.js

@@ -7,6 +7,7 @@ const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+const ownershipChecks_1 = require("./structural/ownershipChecks");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -360,6 +361,21 @@ async function detectAuth(ctx) {
         file: use.file,
         line: use.line,
     }));
+    /**
+     * The same question asked of the shape rather than of the vocabulary.
+     *
+     * This capability is the one with no package to anchor on — there is no
+     * `npm install authorization` — so every reading of it was a list of the words
+     * people happen to use. An Italian application guarding every route with
+     * `if (nota.proprietario !== richiesta.utente.id)` was told it had no per-record
+     * checks, under a recommendation to add what it already had.
+     *
+     * Express supplies the anchor it lacks: a router comes from the package, `.get(path,
+     * handler)` is the framework saying "this is a request handler", and the handler's
+     * first parameter is the request whatever its author called it. The rest is
+     * structure and needs no vocabulary at all.
+     */
+    const structuralOwnership = await (0, ownershipChecks_1.readOwnershipChecks)(ctx.root, sourceFiles);
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -434,8 +450,16 @@ async function detectAuth(ctx) {
             key: 'authz.resourceLevel',
             // Route-level permission checks no longer stand in for per-record ones: with the
             // needles above narrowed, this clause could only reintroduce what they removed.
-            present: resourceLevelSignals.length > 0,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
+            present: resourceLevelSignals.length > 0 || (structuralOwnership ?? []).length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
+                ...snippetEvidence(resourceLevelSignals),
+                ...(structuralOwnership ?? []).slice(0, 6).map((check) => ({
+                    type: 'snippet',
+                    value: check.snippet,
+                    file: check.file,
+                    line: check.line,
+                })),
+            ], 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {
             key: 'tenancy.organization',

package/dist/analyzer/detectEnv.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
+const secretArguments_1 = require("./structural/secretArguments");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -124,6 +125,20 @@ async function detectEnv(ctx) {
      */
     const lookupTables = await (0, lookupTables_1.readLookupTableLines)(ctx.root, sourceFiles);
     const isTableEntry = (match) => lookupTables?.get(match.file)?.has(match.line) === true;
+    /**
+     * The other end of the value, where the library says what it is.
+     *
+     * Everything above starts from the name being assigned, and the name is the
+     * author's: an Italian application signing with `const chiave =
+     * process.env.CHIAVE_FIRMA || 'cambiami'` came back `passed`. `jwt.sign(payload,
+     * secret)` defines its second argument, and arriving there is what makes a literal
+     * a secret whatever it was called on the way.
+     */
+    const secretArguments = await (0, secretArguments_1.readHardcodedSecretArguments)(ctx.root, sourceFiles);
+    for (const hit of secretArguments ?? []) {
+        weakSecretEvidence.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
+        weakSecretByType.unknown.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
+    }
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)

package/dist/analyzer/structural/ownershipChecks.d.ts

@@ -0,0 +1,6 @@
+export interface OwnershipCheck {
+    file: string;
+    line: number;
+    snippet: string;
+}
+export declare function readOwnershipChecks(root: string, files: string[]): Promise<OwnershipCheck[] | null>;

package/dist/analyzer/structural/ownershipChecks.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOwnershipChecks = readOwnershipChecks;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * A route handler comparing a field of something it fetched against a field of the
+ * caller.
+ *
+ * This is the one capability on the list with no package to anchor on. There is no
+ * `npm install authorization`: ownership is written by hand, in whatever words the
+ * author has, and every reading of it here was a list of those words — `ownerId`,
+ * `createdBy`, `req.user.id`. An Italian application guarding every route with
+ *
+ *     if (nota.proprietario !== richiesta.utente.id) return risposta.sendStatus(404);
+ *
+ * was told it had no per-record checks, under a recommendation to add the thing it
+ * already had.
+ *
+ * The anchor that survives is the framework's contract. `express()` and
+ * `express.Router()` come from a package; a router's `.get(path, handler)` is Express
+ * saying "this is a request handler"; and the handler's first parameter is the
+ * request, whatever its author called it. From there the question is structural and
+ * needs no vocabulary at all: does this handler compare a property reached through
+ * that parameter against a property of something else?
+ *
+ * `nota.proprietario !== richiesta.utente.id` answers yes. `richiesta.method !== 'GET'`
+ * does not — the other side is a literal, and comparing the request to a constant is
+ * routing, not authorisation. Neither does a comparison with the request on both
+ * sides, which is a request talking to itself rather than to a row.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+/** Express methods that take a handler whose first parameter is the request. */
+const ROUTE_METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'all']);
+function expressBindings(ts, source) {
+    const fromPackage = new Set();
+    const routers = new Set();
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier) && node.moduleSpecifier.text === 'express') {
+            if (node.importClause?.name)
+                fromPackage.add(node.importClause.name.text);
+        }
+        if (ts.isVariableDeclaration(node) && node.initializer && ts.isIdentifier(node.name)) {
+            const initializer = node.initializer;
+            /** `const express = require('express')` */
+            if (ts.isCallExpression(initializer)
+                && ts.isIdentifier(initializer.expression)
+                && initializer.expression.text === 'require'
+                && initializer.arguments.length === 1
+                && ts.isStringLiteralLike(initializer.arguments[0])
+                && initializer.arguments[0].text === 'express') {
+                fromPackage.add(node.name.text);
+            }
+            /** `const app = express()` and `const rotte = express.Router()` */
+            if (ts.isCallExpression(initializer)) {
+                const callee = initializer.expression;
+                if (ts.isIdentifier(callee) && fromPackage.has(callee.text))
+                    routers.add(node.name.text);
+                if (ts.isPropertyAccessExpression(callee)
+                    && callee.name.text === 'Router'
+                    && ts.isIdentifier(callee.expression)
+                    && fromPackage.has(callee.expression.text)) {
+                    routers.add(node.name.text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return routers;
+}
+/** The identifier a property access is reached through: `a.b.c` is rooted at `a`. */
+function rootOf(ts, node) {
+    let current = node;
+    while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+        current = current.expression;
+    }
+    return ts.isIdentifier(current) ? current.text : null;
+}
+function isPropertyPath(ts, node) {
+    return ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node);
+}
+async function readOwnershipChecks(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const checks = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!text.includes('express'))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        const routers = expressBindings(ts, source);
+        if (routers.size === 0)
+            continue;
+        const lines = text.split(/\r?\n/);
+        const visit = (node) => {
+            if (ts.isCallExpression(node)) {
+                const callee = node.expression;
+                const isRoute = ts.isPropertyAccessExpression(callee)
+                    && ROUTE_METHODS.has(callee.name.text)
+                    && ts.isIdentifier(callee.expression)
+                    && routers.has(callee.expression.text);
+                if (isRoute) {
+                    for (const argument of node.arguments) {
+                        if (!ts.isArrowFunction(argument) && !ts.isFunctionExpression(argument))
+                            continue;
+                        /**
+                         * The request's position, not its name. Express hands an error-first
+                         * middleware four parameters and puts the request second; every other
+                         * handler takes it first.
+                         */
+                        const parameters = argument.parameters;
+                        const request = parameters.length === 4 ? parameters[1] : parameters[0];
+                        if (!request || !ts.isIdentifier(request.name))
+                            continue;
+                        const requestName = request.name.text;
+                        const inspect = (inner) => {
+                            if (ts.isBinaryExpression(inner)
+                                && [
+                                    ts.SyntaxKind.EqualsEqualsEqualsToken,
+                                    ts.SyntaxKind.ExclamationEqualsEqualsToken,
+                                    ts.SyntaxKind.EqualsEqualsToken,
+                                    ts.SyntaxKind.ExclamationEqualsToken,
+                                ].includes(inner.operatorToken.kind)) {
+                                const left = inner.left;
+                                const right = inner.right;
+                                const leftRoot = rootOf(ts, left);
+                                const rightRoot = rootOf(ts, right);
+                                const fromRequest = (root, side) => root === requestName && isPropertyPath(ts, side);
+                                const fromElsewhere = (root, side) => root !== null && root !== requestName && isPropertyPath(ts, side);
+                                const compares = (fromRequest(leftRoot, left) && fromElsewhere(rightRoot, right))
+                                    || (fromRequest(rightRoot, right) && fromElsewhere(leftRoot, left));
+                                if (compares) {
+                                    const line = source.getLineAndCharacterOfPosition(inner.getStart(source)).line;
+                                    checks.push({ file, line: line + 1, snippet: (lines[line] ?? '').trim().slice(0, 200) });
+                                }
+                            }
+                            ts.forEachChild(inner, inspect);
+                        };
+                        if (argument.body)
+                            inspect(argument.body);
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return checks;
+}

package/dist/analyzer/structural/secretArguments.d.ts

@@ -0,0 +1,8 @@
+export interface HardcodedSecretArgument {
+    file: string;
+    line: number;
+    snippet: string;
+    /** The call that defines this value as a secret, for the sentence shown to a reader. */
+    sink: string;
+}
+export declare function readHardcodedSecretArguments(root: string, files: string[]): Promise<HardcodedSecretArgument[] | null>;

package/dist/analyzer/structural/secretArguments.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readHardcodedSecretArguments = readHardcodedSecretArguments;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * A literal reaching a parameter the library defines as a secret.
+ *
+ * Every other reading of "is this a hardcoded secret" starts from the name of the
+ * thing being assigned — `JWT_SECRET`, `SECRET_KEY`, `API_KEY`. That name is the
+ * author's, and an Italian application signing its tokens with
+ *
+ *     const chiave = process.env.CHIAVE_FIRMA || 'cambiami';
+ *     jwt.sign({ sub: utente.id }, chiave);
+ *
+ * came back `passed`: "no weak fallback secret patterns detected", about a signing
+ * key hardcoded in the source. The check congratulated it.
+ *
+ * The anchor that does not move is the other end. `jsonwebtoken.sign(payload, secret)`
+ * says what its second argument is — that is the library's contract, not a convention
+ * — and `crypto.createHmac(algorithm, key)` says the same. Whatever the value is
+ * called on the way there, arriving there is what makes it a secret.
+ *
+ * One hop of resolution, matching the rest of the structural readers: a literal
+ * passed directly, or an identifier declared in the same file whose initializer is a
+ * literal or falls back to one. Two hops would reach further and be wrong more often,
+ * and the text search remains underneath either way.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const SECRET_SINKS = [
+    { package: 'jsonwebtoken', method: 'sign', argument: 1 },
+    { package: 'jsonwebtoken', method: 'verify', argument: 1 },
+    { package: 'crypto', method: 'createHmac', argument: 1 },
+    { package: 'node:crypto', method: 'createHmac', argument: 1 },
+    { package: 'crypto', method: 'createCipheriv', argument: 1 },
+    { package: 'node:crypto', method: 'createCipheriv', argument: 1 },
+    { package: 'express-session', option: 'secret' },
+    { package: 'cookie-session', option: 'secret' },
+    { package: 'iron-session', option: 'password' },
+];
+function bindingsFor(ts, source, specifier) {
+    const bound = new Set();
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+            if (node.moduleSpecifier.text === specifier) {
+                const clause = node.importClause;
+                if (clause?.name)
+                    bound.add(clause.name.text);
+                if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings))
+                    bound.add(clause.namedBindings.name.text);
+                if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+                    for (const element of clause.namedBindings.elements)
+                        bound.add(element.name.text);
+                }
+            }
+        }
+        if (ts.isVariableDeclaration(node)
+            && node.initializer
+            && ts.isCallExpression(node.initializer)
+            && ts.isIdentifier(node.initializer.expression)
+            && node.initializer.expression.text === 'require'
+            && node.initializer.arguments.length === 1
+            && ts.isStringLiteralLike(node.initializer.arguments[0])
+            && node.initializer.arguments[0].text === specifier) {
+            if (ts.isIdentifier(node.name))
+                bound.add(node.name.text);
+            if (ts.isObjectBindingPattern(node.name)) {
+                for (const element of node.name.elements) {
+                    if (ts.isIdentifier(element.name))
+                        bound.add(element.name.text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return bound;
+}
+/** The literal an expression is, or falls back to, following one declaration. */
+function literalBehind(ts, source, expression) {
+    if (ts.isStringLiteralLike(expression))
+        return true;
+    if (ts.isBinaryExpression(expression)
+        && (expression.operatorToken.kind === ts.SyntaxKind.BarBarToken
+            || expression.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken)) {
+        return literalBehind(ts, source, expression.right);
+    }
+    if (ts.isIdentifier(expression)) {
+        let found = false;
+        const visit = (node) => {
+            if (!found
+                && ts.isVariableDeclaration(node)
+                && ts.isIdentifier(node.name)
+                && node.name.text === expression.text
+                && node.initializer
+                && !ts.isIdentifier(node.initializer)) {
+                found = literalBehind(ts, source, node.initializer);
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return found;
+    }
+    return false;
+}
+async function readHardcodedSecretArguments(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const found = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!SECRET_SINKS.some((sink) => text.includes(sink.package.replace('node:', ''))))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        for (const sink of SECRET_SINKS) {
+            const bound = bindingsFor(ts, source, sink.package);
+            if (bound.size === 0)
+                continue;
+            const visit = (node) => {
+                if (ts.isCallExpression(node)) {
+                    const callee = node.expression;
+                    const named = sink.method
+                        ? ts.isPropertyAccessExpression(callee)
+                            && callee.name.text === sink.method
+                            && ts.isIdentifier(callee.expression)
+                            && bound.has(callee.expression.text)
+                        : ts.isIdentifier(callee) && bound.has(callee.text);
+                    if (named) {
+                        const report = (expression) => {
+                            if (!literalBehind(ts, source, expression))
+                                return;
+                            const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line;
+                            found.push({
+                                file,
+                                line: line + 1,
+                                snippet: (text.split(/\r?\n/)[line] ?? '').trim().slice(0, 200),
+                                sink: sink.method ? `${sink.package}.${sink.method}()` : `${sink.package}()`,
+                            });
+                        };
+                        if (sink.argument !== undefined) {
+                            const argument = node.arguments[sink.argument];
+                            if (argument)
+                                report(argument);
+                        }
+                        if (sink.option) {
+                            for (const argument of node.arguments) {
+                                if (!ts.isObjectLiteralExpression(argument))
+                                    continue;
+                                for (const property of argument.properties) {
+                                    if (ts.isPropertyAssignment(property)
+                                        && ts.isIdentifier(property.name)
+                                        && property.name.text === sink.option) {
+                                        report(property.initializer);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                ts.forEachChild(node, visit);
+            };
+            visit(source);
+        }
+    }
+    return found;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {