@produtype/core 0.80.0 → 0.82.0

package/dist/analyzer/detectBackend.js

@@ -267,20 +267,38 @@ async function detectBackend(ctx) {
             }
         }
     }
-    // Django
+    /**
+     * Django, which four filenames were enough to declare.
+     *
+     * Any two of `manage.py`, a file ending in `settings.py`, a file ending in `urls.py`
+     * and the dependency named Django, and three of those four are names other projects
+     * use. redash is a Flask application: it keeps a `manage.py`, and
+     * `redash/handlers/settings.py` is the HTTP handler for a user's settings page. Its
+     * report said "Backend: flask, django".
+     *
+     * The dependency is the fact — nobody runs Django without installing it — and the
+     * filenames only corroborate it.
+     *
+     * A fallback for the unreadable-manifest case was written and deleted: a settings
+     * file declaring `INSTALLED_APPS` would have stood on its own, and no repository
+     * measured reaches it, because every Django project declares Django. The mutation
+     * run said so — removing it failed nothing. A rule nothing measures is a rule to
+     * delete.
+     */
     const djangoSignals = [];
+    const djangoDep = (0, detectContext_1.hasRuntimePyDep)(ctx, 'django');
+    if (djangoDep)
+        djangoSignals.push({ type: 'dependency', value: 'django' });
     if (ctx.files.all.some((f) => f.endsWith('manage.py') || f === 'manage.py')) {
         djangoSignals.push({ type: 'file', value: 'manage.py' });
     }
     const settingsFile = ctx.files.all.find((f) => f.endsWith('settings.py'));
     if (settingsFile)
         djangoSignals.push({ type: 'file', value: settingsFile });
-    if ((0, detectContext_1.hasRuntimePyDep)(ctx, 'django'))
-        djangoSignals.push({ type: 'dependency', value: 'django' });
     if (ctx.files.all.some((f) => f.endsWith('urls.py'))) {
         djangoSignals.push({ type: 'file', value: ctx.files.all.find((f) => f.endsWith('urls.py')) });
     }
-    if (djangoSignals.length >= 2) {
+    if (djangoDep && djangoSignals.length >= 2) {
         frameworks.push('django');
         evidence.push(...djangoSignals);
     }

package/dist/analyzer/detectSecurity.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectSecurity = detectSecurity;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const djangoSettings_1 = require("./djangoSettings");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
@@ -111,35 +112,6 @@ function detectCorsConfig(text, file, boundNames) {
     }
     return { loose, strict };
 }
-/**
- * A settings file that is Django's, rather than one that shares its name.
- *
- * `diet_hub/api/settings.py` is a FastAPI router that lets an administrator change
- * application options from the browser. It was read as Django's configuration, and on
- * the strength of the filename alone the project was credited with having security
- * middleware it does not have — the one direction of error that matters here, because
- * it hides a missing control rather than inventing a present one.
- *
- * Two conditions, because either alone is wrong. A repository can depend on Django and
- * still own a dozen files called settings.py; a file can declare INSTALLED_APPS in a
- * tutorial that the product does not run. And the first file named settings.py is not
- * the right one: a project with `settings/base.py` and `settings/production.py` has
- * several, so every candidate is examined and the first that is Django's is used.
- */
-async function findDjangoSettings(ctx) {
-    if (!ctx.pythonDeps.includes('django'))
-        return null;
-    const candidates = ctx.files.all.filter((f) => /(^|\/)settings(_[a-z]+)?\.py$/i.test(f) || /(^|\/)settings\/[a-z_]+\.py$/i.test(f));
-    for (const file of candidates) {
-        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
-        if (!text)
-            continue;
-        if (/^\s*INSTALLED_APPS\s*=/m.test(text) || /^\s*MIDDLEWARE\s*=/m.test(text) || /DJANGO_SETTINGS_MODULE/.test(text)) {
-            return { file, text };
-        }
-    }
-    return null;
-}
 const RATE_LIMIT_PACKAGES = [
     'express-rate-limit',
     '@upstash/ratelimit',
@@ -165,6 +137,26 @@ async function detectSecurity(ctx) {
         /X-Frame-Options/i,
         /SECURE_HSTS_SECONDS/,
         /securityHeaders/i,
+        /**
+         * Django's spelling of the same decisions.
+         *
+         * The list held the HTTP header names and one Django setting, so a project that
+         * writes `X_FRAME_OPTIONS = "SAMEORIGIN"` — the setting, with underscores, which
+         * is the only way to say it in Django — matched nothing. paperless-ngx sets it
+         * and was told at `high` to add security headers.
+         *
+         * Only the settings that choose a policy. `SECURE_PROXY_SSL_HEADER` is not one
+         * of them: it tells Django how to tell it is behind HTTPS, and every deployment
+         * behind a proxy needs it whether or not anybody thought about headers. And
+         * `SecurityMiddleware` itself stays out, for the reason recorded further down —
+         * `django-admin startproject` writes it into every new project.
+         */
+        /^\s*X_FRAME_OPTIONS\s*=/m,
+        /^\s*SECURE_CONTENT_TYPE_NOSNIFF\s*=/m,
+        /^\s*SECURE_BROWSER_XSS_FILTER\s*=/m,
+        /^\s*SECURE_REFERRER_POLICY\s*=/m,
+        /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
+        /^\s*CSP_DEFAULT_SRC\s*=/m,
     ], 20);
     const helmet = helmetDep || headerSignals.length > 0;
     /**
@@ -319,9 +311,30 @@ async function detectSecurity(ctx) {
             if (at !== -1) {
                 const window = lines.slice(at, Math.min(lines.length, at + 12)).join('\n');
                 if (STARLETTE_CORS_CALL.test(window)) {
-                    const allowList = /allow_origins\s*=\s*\[([^\]]*)\]/.exec(window);
                     const hit = { file, line: at + 1, snippet: lines[at].trim().slice(0, 200) };
-                    if (!allowList || /^\s*["']\*["']\s*,?\s*$/.test(allowList[1]))
+                    const allowList = /allow_origins\s*=\s*\[([^\]]*)\]/.exec(window);
+                    if (allowList) {
+                        if (/^\s*["']\*["']\s*,?\s*$/.test(allowList[1]))
+                            corsLoose.push(hit);
+                        else
+                            corsStrict.push(hit);
+                        continue;
+                    }
+                    /**
+                     * `allow_origins=allowed_origins`, which is how a real application writes it.
+                     *
+                     * mealie builds the list from its settings and passes the name, and calling
+                     * that "no explicit origin restrictions" at `high` reads as advice to add
+                     * the allowlist it has. The wildcard is written literally when it is meant —
+                     * `allow_origins=["*"]` — so a name is followed to its assignment, and a
+                     * value assembled somewhere this cannot see is a configuration rather than a
+                     * wildcard.
+                     */
+                    const named = /allow_origins\s*=\s*([A-Za-z_][\w.]*)/.exec(window);
+                    const assigned = named
+                        ? new RegExp(`^\\s*${named[1].split('.').pop()}\\s*=\\s*\\[([^\\]]*)\\]`, 'm').exec(text)
+                        : null;
+                    if (assigned && /^\s*["']\*["']\s*,?\s*$/.test(assigned[1]))
                         corsLoose.push(hit);
                     else
                         corsStrict.push(hit);
@@ -353,7 +366,7 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
-    const django = await findDjangoSettings(ctx);
+    const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text
             .split(/\r?\n/)
@@ -412,7 +425,7 @@ async function detectSecurity(ctx) {
      * this repository keeps as a fixture precisely because it is unprotected. What is
      * left is the `SECURE_*` settings above: lines somebody chose to write.
      */
-    const djangoSettings = await findDjangoSettings(ctx);
+    const djangoSettings = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     let djangoDebugTrue = false;
     let djangoSecureCookies = true;
     if (djangoSettings) {

package/dist/analyzer/djangoSettings.d.ts

@@ -0,0 +1,20 @@
+import type { DetectContext } from './detectContext';
+/**
+ * A settings file that is Django's, rather than one that shares its name.
+ *
+ * `diet_hub/api/settings.py` is a FastAPI router that lets an administrator change
+ * application options from the browser. It was read as Django's configuration, and on
+ * the strength of the filename alone the project was credited with having security
+ * middleware it does not have — the one direction of error that matters here, because
+ * it hides a missing control rather than inventing a present one.
+ *
+ * Two conditions, because either alone is wrong. A repository can depend on Django and
+ * still own a dozen files called settings.py; a file can declare INSTALLED_APPS in a
+ * tutorial that the product does not run. And the first file named settings.py is not
+ * the right one: a project with `settings/base.py` and `settings/production.py` has
+ * several, so every candidate is examined and the first that is Django's is used.
+ */
+export declare function findDjangoSettings(ctx: DetectContext): Promise<{
+    file: string;
+    text: string;
+} | null>;

package/dist/analyzer/djangoSettings.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDjangoSettings = findDjangoSettings;
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+/**
+ * A settings file that is Django's, rather than one that shares its name.
+ *
+ * `diet_hub/api/settings.py` is a FastAPI router that lets an administrator change
+ * application options from the browser. It was read as Django's configuration, and on
+ * the strength of the filename alone the project was credited with having security
+ * middleware it does not have — the one direction of error that matters here, because
+ * it hides a missing control rather than inventing a present one.
+ *
+ * Two conditions, because either alone is wrong. A repository can depend on Django and
+ * still own a dozen files called settings.py; a file can declare INSTALLED_APPS in a
+ * tutorial that the product does not run. And the first file named settings.py is not
+ * the right one: a project with `settings/base.py` and `settings/production.py` has
+ * several, so every candidate is examined and the first that is Django's is used.
+ */
+async function findDjangoSettings(ctx) {
+    if (!ctx.pythonDeps.includes('django'))
+        return null;
+    const candidates = ctx.files.all.filter((f) => /(^|\/)settings(_[a-z]+)?\.py$/i.test(f) || /(^|\/)settings\/[a-z_]+\.py$/i.test(f));
+    for (const file of candidates) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        if (/^\s*INSTALLED_APPS\s*=/m.test(text) || /^\s*MIDDLEWARE\s*=/m.test(text) || /DJANGO_SETTINGS_MODULE/.test(text)) {
+            return { file, text };
+        }
+    }
+    return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.80.0",
+  "version": "0.82.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {