@produtype/core 0.79.0 → 0.81.0

package/dist/analyzer/analyzeProject.js

@@ -189,6 +189,22 @@ function isTestOrExamplePath(file) {
          * band — against a line written to be fake.
          */
         || /[-_]tests?\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
+        /**
+         * And the third spelling of it.
+         *
+         * netbox keeps `netbox/netbox/configuration_testing.py`, whose first three lines
+         * say it is a base configuration for testing and not intended for production. Its
+         * `SECRET_KEY = 'abcdefg...'` was the single `critical` in netbox's report — the
+         * severity that bars a report from the top band — raised against a line written to
+         * be thrown away.
+         *
+         * A directory called `testing/` has counted as tests here for a while, so the
+         * suffix is the same decision in the same ecosystem. It does cost a product file
+         * genuinely named `ab_testing.py`, which would go unread rather than be read
+         * wrongly — the cheaper of the two errors, and the same trade the `testing/`
+         * directory rule already makes.
+         */
+        || /[-_]testing\.py$/i.test(file)
         || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * Sample code, which is what a documentation repository is made of.

package/dist/analyzer/detectSecurity.js

@@ -28,6 +28,21 @@ const WILDCARD_ORIGIN = /(Access-Control-Allow-Origin["'\s:,]+\*)|(["']\*["'])/i
  */
 const IMPORTS_FLASK_CORS = /from\s+flask_cors\s+import|import\s+flask_cors/;
 const FLASK_CORS_CALL = /\bCORS\s*\(/;
+/**
+ * Starlette's, which is how every FastAPI application does it.
+ *
+ * The full-stack FastAPI template — the one the framework's own organisation
+ * publishes — was told at `high` to add cross-origin handling, above
+ * `app.add_middleware(CORSMiddleware, allow_origins=[settings.FRONTEND_HOST])`. The
+ * class comes from the framework and `add_middleware` is its contract; neither is a
+ * word the author picked.
+ *
+ * The allowlist decides which case it is, read from the same call: `allow_origins`
+ * holding a bare `"*"` is the wide-open one, and anything else is a list somebody
+ * chose.
+ */
+const IMPORTS_STARLETTE_CORS = /from\s+(?:starlette|fastapi)\.middleware(?:\.cors)?\s+import[^\n]*CORSMiddleware/;
+const STARLETTE_CORS_CALL = /add_middleware\s*\(\s*\n?\s*CORSMiddleware/;
 /**
  * The line with its quoted text removed.
  *
@@ -150,6 +165,26 @@ async function detectSecurity(ctx) {
         /X-Frame-Options/i,
         /SECURE_HSTS_SECONDS/,
         /securityHeaders/i,
+        /**
+         * Django's spelling of the same decisions.
+         *
+         * The list held the HTTP header names and one Django setting, so a project that
+         * writes `X_FRAME_OPTIONS = "SAMEORIGIN"` — the setting, with underscores, which
+         * is the only way to say it in Django — matched nothing. paperless-ngx sets it
+         * and was told at `high` to add security headers.
+         *
+         * Only the settings that choose a policy. `SECURE_PROXY_SSL_HEADER` is not one
+         * of them: it tells Django how to tell it is behind HTTPS, and every deployment
+         * behind a proxy needs it whether or not anybody thought about headers. And
+         * `SecurityMiddleware` itself stays out, for the reason recorded further down —
+         * `django-admin startproject` writes it into every new project.
+         */
+        /^\s*X_FRAME_OPTIONS\s*=/m,
+        /^\s*SECURE_CONTENT_TYPE_NOSNIFF\s*=/m,
+        /^\s*SECURE_BROWSER_XSS_FILTER\s*=/m,
+        /^\s*SECURE_REFERRER_POLICY\s*=/m,
+        /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
+        /^\s*CSP_DEFAULT_SRC\s*=/m,
     ], 20);
     const helmet = helmetDep || headerSignals.length > 0;
     /**
@@ -298,6 +333,42 @@ async function detectSecurity(ctx) {
                     corsLoose.push(m);
             }
         }
+        if (IMPORTS_STARLETTE_CORS.test(text)) {
+            const lines = text.split(/\r?\n/);
+            const at = lines.findIndex((line) => /add_middleware\s*\(/.test(line) && (0, textSearch_1.isCitableLine)(line));
+            if (at !== -1) {
+                const window = lines.slice(at, Math.min(lines.length, at + 12)).join('\n');
+                if (STARLETTE_CORS_CALL.test(window)) {
+                    const hit = { file, line: at + 1, snippet: lines[at].trim().slice(0, 200) };
+                    const allowList = /allow_origins\s*=\s*\[([^\]]*)\]/.exec(window);
+                    if (allowList) {
+                        if (/^\s*["']\*["']\s*,?\s*$/.test(allowList[1]))
+                            corsLoose.push(hit);
+                        else
+                            corsStrict.push(hit);
+                        continue;
+                    }
+                    /**
+                     * `allow_origins=allowed_origins`, which is how a real application writes it.
+                     *
+                     * mealie builds the list from its settings and passes the name, and calling
+                     * that "no explicit origin restrictions" at `high` reads as advice to add
+                     * the allowlist it has. The wildcard is written literally when it is meant —
+                     * `allow_origins=["*"]` — so a name is followed to its assignment, and a
+                     * value assembled somewhere this cannot see is a configuration rather than a
+                     * wildcard.
+                     */
+                    const named = /allow_origins\s*=\s*([A-Za-z_][\w.]*)/.exec(window);
+                    const assigned = named
+                        ? new RegExp(`^\\s*${named[1].split('.').pop()}\\s*=\\s*\\[([^\\]]*)\\]`, 'm').exec(text)
+                        : null;
+                    if (assigned && /^\s*["']\*["']\s*,?\s*$/.test(assigned[1]))
+                        corsLoose.push(hit);
+                    else
+                        corsStrict.push(hit);
+                }
+            }
+        }
         if (!IMPORTS_CORS.test(text))
             continue;
         const boundNames = new Set((corsBindings ?? []).filter((use) => use.file === file).map((use) => use.name));
@@ -308,6 +379,41 @@ async function detectSecurity(ctx) {
         corsLoose.push(...detected.loose);
         corsStrict.push(...detected.strict);
     }
+    /**
+     * Django's answer, which is a string in a list.
+     *
+     * netbox installs `corsheaders.middleware.CorsMiddleware` and was reported as having
+     * no cross-origin configuration at all — then told, at `high`, to add the handling it
+     * has. Nothing here looked for it: the reading was built around a call expression,
+     * and django-cors-headers is applied by naming it in `MIDDLEWARE` and configured by
+     * setting names the package itself defines.
+     *
+     * The package name and its setting names are the anchor, and neither is the author's
+     * to choose. Installed with no allowlist the package denies every cross-origin
+     * request, so the middleware alone is the strict case; `CORS_ALLOW_ALL_ORIGINS` — and
+     * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
+     * one line that opens it.
+     */
+    const django = await findDjangoSettings(ctx);
+    if (django) {
+        const middlewareLine = django.text
+            .split(/\r?\n/)
+            .findIndex((line) => /corsheaders\.middleware\.CorsMiddleware/.test(line));
+        if (middlewareLine !== -1) {
+            const openedUp = /CORS_(?:ALLOW_ALL_ORIGINS|ORIGIN_ALLOW_ALL)\s*=\s*True/.exec(django.text);
+            const hit = {
+                file: django.file,
+                line: middlewareLine + 1,
+                snippet: openedUp
+                    ? openedUp[0]
+                    : django.text.split(/\r?\n/)[middlewareLine].trim().slice(0, 200),
+            };
+            if (openedUp)
+                corsLoose.push(hit);
+            else
+                corsStrict.push(hit);
+        }
+    }
     for (const m of corsLoose)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'cors' });
     for (const m of corsStrict)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.79.0",
+  "version": "0.81.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {