@produtype/core 0.84.1 → 0.86.0

package/dist/analyzer/detectDatabase.js

@@ -139,6 +139,42 @@ async function detectDatabase(ctx) {
         for (const hit of hits)
             evidence.push({ type: 'dependency', value: hit });
     }
+    /**
+     * Laravel, whose database is named in a configuration file rather than in a package.
+     *
+     * PHP has one driver — PDO, in the runtime — so `composer.json` says nothing about
+     * which engine a project talks to, and nothing here read the place that does.
+     * Firefly III reported no data layer at all, above a `config/database.php` whose
+     * first line of substance is `'default' => env('DB_CONNECTION', 'mysql')`.
+     *
+     * Only the default is read. Laravel's file ships every driver it supports in the
+     * `connections` array whether the project uses them or not, so reading those would
+     * credit each project with four databases; the default is the one it actually falls
+     * back to when nothing is configured, which is the project's own statement.
+     */
+    const LARAVEL_DRIVERS = {
+        mysql: 'mysql',
+        mariadb: 'mysql',
+        pgsql: 'postgres',
+        sqlite: 'sqlite',
+        sqlsrv: 'sqlserver',
+    };
+    for (const file of ctx.files.all.filter((f) => /(^|\/)config\/database\.php$/.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        const defaultLine = /^\s*'default'\s*=>.*?['"]([a-z]+)['"]/m.exec(text);
+        const driver = defaultLine ? LARAVEL_DRIVERS[defaultLine[1]] : undefined;
+        if (!driver)
+            continue;
+        databases.add(driver);
+        evidence.push({
+            type: 'snippet',
+            value: defaultLine[0].trim().slice(0, 200),
+            file,
+            line: text.slice(0, defaultLine.index).split('\n').length,
+        });
+    }
     const dotnetHits = [
         ['postgres', ['Npgsql']],
         ['mysql', ['MySql.Data', 'Pomelo.EntityFrameworkCore.MySql']],

package/dist/analyzer/detectSecurity.js

@@ -366,6 +366,51 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
+    /**
+     * Laravel's answer, which is a file with a name the framework chose.
+     *
+     * `config/cors.php` is published by Laravel and read by its own middleware; a
+     * project either has it or does not. Firefly III has one whose `'allowed_origins'`
+     * is `['*']`, and the report said it had no cross-origin configuration at all —
+     * the worst direction for this check, because a project that opened itself to the
+     * whole web read as one that had not thought about it.
+     *
+     * The path is the anchor and the array is the answer: a bare `'*'` is the wide-open
+     * case, and a list of origins is one somebody chose.
+     */
+    for (const file of source.concat(ctx.files.all).filter((f) => /(^|\/)config\/cors\.php$/.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        const origins = /'allowed_origins'\s*=>\s*\[([^\]]*)\]/.exec(text);
+        const line = origins ? text.slice(0, origins.index).split('\n').length : 1;
+        const hit = { file, line, snippet: (origins?.[0] ?? "config/cors.php").replace(/\s+/g, ' ').trim().slice(0, 200) };
+        if (!origins || /^\s*'\*'\s*,?\s*$/.test(origins[1]))
+            corsLoose.push(hit);
+        else
+            corsStrict.push(hit);
+        break;
+    }
+    /**
+     * ASP.NET Core's, which is a call to the framework's own builder.
+     *
+     * `AddCors()` registers the service and `UseCors()` puts it in the pipeline; both
+     * names belong to the framework. Jellyfin calls each of them and was told at `high`
+     * that it has no cross-origin configuration.
+     *
+     * Which policy it is comes from the builder: `AllowAnyOrigin()` is the wide-open
+     * one and `WithOrigins(...)` is a list somebody chose. Jellyfin has both — the
+     * first when no hosts are configured — and where both are shipped the open branch
+     * is the one worth reporting, because it is reachable.
+     */
+    const aspNetCors = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/\.\s*AddCors\s*\(/, /\.\s*UseCors\s*\(/, /\bUseCors\s*\(/, /\bAddCors\s*\(/], 5);
+    if (aspNetCors.length > 0) {
+        const anyOrigin = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/AllowAnyOrigin\s*\(/], 2);
+        const chosen = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/WithOrigins\s*\(/, /SetIsOriginAllowed\s*\(/], 2);
+        const target = anyOrigin.length > 0 || chosen.length === 0 ? corsLoose : corsStrict;
+        const cited = anyOrigin[0] ?? chosen[0] ?? aspNetCors[0];
+        target.push({ file: cited.file, line: cited.line, snippet: cited.snippet.trim().slice(0, 200) });
+    }
     const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.84.1",
+  "version": "0.86.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {