@produtype/core 0.85.0 → 0.87.0

package/dist/analyzer/detectSecurity.js

@@ -19,6 +19,42 @@ const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /all
  * the first was being caught.
  */
 const WILDCARD_ORIGIN = /(Access-Control-Allow-Origin["'\s:,]+\*)|(["']\*["'])/i;
+/**
+ * A line that names an origin somebody chose.
+ *
+ * The test is that the value is written down: a quoted string that is not `*`, or a
+ * list of them. Everything else — a variable, a concatenation, a method call — is a
+ * value the reader of this line cannot see, and a security check does not get to
+ * assume it is an allowlist.
+ */
+function allowsAChosenOrigin(line, file) {
+    /**
+     * The line itself asks whether the origin belongs.
+     *
+     * `!ALLOWED_ORIGINS.includes(origin)` is the allowlist being enforced, and it is
+     * the strongest evidence there is — stronger than the declaration it checks
+     * against, which may live in an environment variable.
+     */
+    if (MEMBERSHIP_TEST.test(line))
+        return true;
+    const assigned = /(?:Access-Control-Allow-Origin|ALLOWED_ORIGINS|allowedOrigins)[^=:,]*[=:,]\s*(.+)$/i.exec(line);
+    if (!assigned)
+        return false;
+    // An origin written down: it has a scheme or a dotted host, which `","` does not.
+    if (/["'`](?:https?:\/\/|\*\.)[^"'`]*["'`]|["'`][^"'`]*\.[a-z]{2,}[^"'`]*["'`]/i.test(assigned[1]))
+        return true;
+    /**
+     * Or a value this line cannot see, checked somewhere else in the same file.
+     *
+     * A list kept in an environment variable is still an allowlist, so the test cannot
+     * be "is the value a literal". What separates it from reflection is that somebody
+     * asks whether the origin belongs before answering yes — and shopizer never does:
+     * `origin = request.getHeader("origin")` goes straight into the header.
+     */
+    return MEMBERSHIP_TEST.test(file);
+}
+/** `includes`, `contains`, `indexOf`, `has` — asking whether a value belongs. */
+const MEMBERSHIP_TEST = /\.(includes|contains|indexOf|has)\s*\(/i;
 /**
  * Flask's answer, which was invisible.
  *
@@ -287,8 +323,25 @@ async function detectSecurity(ctx) {
         for (const m of (0, textSearch_1.matchLines)(text, ORIGIN_HANDLING, file)) {
             if (WILDCARD_ORIGIN.test(m.snippet))
                 corsLoose.push(m);
-            else
+            else if (allowsAChosenOrigin(m.snippet, text))
                 corsStrict.push(m);
+            /**
+             * Anything else sets the header to a value this cannot see.
+             *
+             * shopizer writes `origin = request.getHeader("origin")` and then
+             * `setHeader("Access-Control-Allow-Origin", origin)` — reflecting whatever the
+             * caller asked for, which allows every origin there is. The report called it
+             * "configured with explicit origins" and passed it: a clean verdict on the one
+             * shape this check exists to catch.
+             *
+             * An allowlist is a fixed set, so it is written down. A variable, a
+             * concatenation or a call cannot be shown to be one — it may be a value from
+             * configuration, and it may be the request's own header, and nothing in the line
+             * says which. `partial` is what that deserves: something is configured and
+             * nothing here shows it restricted.
+             */
+            else
+                corsLoose.push(m);
         }
         // Only where the middleware is actually imported. A sentence in this tool's own
         // remediation catalogue — "Replace cors() defaults with an explicit allowlist." —
@@ -391,6 +444,26 @@ async function detectSecurity(ctx) {
             corsStrict.push(hit);
         break;
     }
+    /**
+     * ASP.NET Core's, which is a call to the framework's own builder.
+     *
+     * `AddCors()` registers the service and `UseCors()` puts it in the pipeline; both
+     * names belong to the framework. Jellyfin calls each of them and was told at `high`
+     * that it has no cross-origin configuration.
+     *
+     * Which policy it is comes from the builder: `AllowAnyOrigin()` is the wide-open
+     * one and `WithOrigins(...)` is a list somebody chose. Jellyfin has both — the
+     * first when no hosts are configured — and where both are shipped the open branch
+     * is the one worth reporting, because it is reachable.
+     */
+    const aspNetCors = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/\.\s*AddCors\s*\(/, /\.\s*UseCors\s*\(/, /\bUseCors\s*\(/, /\bAddCors\s*\(/], 5);
+    if (aspNetCors.length > 0) {
+        const anyOrigin = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/AllowAnyOrigin\s*\(/], 2);
+        const chosen = await (0, textSearch_1.searchInFiles)(ctx.root, source.filter((f) => /\.cs$/i.test(f)), [/WithOrigins\s*\(/, /SetIsOriginAllowed\s*\(/], 2);
+        const target = anyOrigin.length > 0 || chosen.length === 0 ? corsLoose : corsStrict;
+        const cited = anyOrigin[0] ?? chosen[0] ?? aspNetCors[0];
+        target.push({ file: cited.file, line: cited.line, snippet: cited.snippet.trim().slice(0, 200) });
+    }
     const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {