@produtype/core 0.85.0 → 0.86.0

package/dist/analyzer/detectSecurity.js

@@ -391,6 +391,26 @@ async function detectSecurity(ctx) {
             corsStrict.push(hit);
         break;
     }
+    /**
+     * ASP.NET Core's, which is a call to the framework's own builder.
+     *
+     * `AddCors()` registers the service and `UseCors()` puts it in the pipeline; both
+     * names belong to the framework. Jellyfin calls each of them and was told at `high`
+     * that it has no cross-origin configuration.
+     *
+     * Which policy it is comes from the builder: `AllowAnyOrigin()` is the wide-open
+     * one and `WithOrigins(...)` is a list somebody chose. Jellyfin has both — the
+     * first when no hosts are configured — and where both are shipped the open branch
+     * is the one worth reporting, because it is reachable.
+     */
+    const aspNetCors = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/\.\s*AddCors\s*\(/, /\.\s*UseCors\s*\(/, /\bUseCors\s*\(/, /\bAddCors\s*\(/], 5);
+    if (aspNetCors.length > 0) {
+        const anyOrigin = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/AllowAnyOrigin\s*\(/], 2);
+        const chosen = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/WithOrigins\s*\(/, /SetIsOriginAllowed\s*\(/], 2);
+        const target = anyOrigin.length > 0 || chosen.length === 0 ? corsLoose : corsStrict;
+        const cited = anyOrigin[0] ?? chosen[0] ?? aspNetCors[0];
+        target.push({ file: cited.file, line: cited.line, snippet: cited.snippet.trim().slice(0, 200) });
+    }
     const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.85.0",
+  "version": "0.86.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {