@produtype/core 0.90.0 → 0.91.0

package/dist/analyzer/detectSecurity.js

@@ -196,7 +196,45 @@ async function detectSecurity(ctx) {
         /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
         /^\s*CSP_DEFAULT_SRC\s*=/m,
     ], 20);
-    const helmet = helmetDep || headerSignals.length > 0;
+    /**
+     * Spring Security, which writes the headers without being asked.
+     *
+     * Adding `spring-boot-starter-security` and configuring an `HttpSecurity` chain
+     * gives every response `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`
+     * and a no-store `Cache-Control` — the framework's defaults, applied whether or not
+     * anybody writes a line about headers. shopizer does exactly that and was told it
+     * has none.
+     *
+     * Unlike Django's `SecurityMiddleware`, which is deliberately not counted a few
+     * lines down: `django-admin startproject` writes that into every new project, so it
+     * distinguishes nothing, and its HSTS and nosniff behaviour still waits on
+     * `SECURE_*` settings. This starter is not in every Spring project — petclinic has
+     * no security at all — and its defaults need no settings.
+     *
+     * The chain is what is required. A project can pull the starter for method-level
+     * authorization in something that serves no requests, and then there is no filter
+     * chain and no headers — which is what the second fixture holds.
+     *
+     * The dependency check in front of it is a pre-filter and nothing more: it keeps
+     * this search off every file of every non-Spring repository. Removing it fails no
+     * test, and the comment says so rather than implying a safety it does not provide.
+     */
+    const springSecurity = (0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-security', 'spring-security-config']);
+    const springFilterChain = springSecurity.length > 0
+        ? await (0, textSearch_1.searchInFiles)(ctx.root, source, [/HttpSecurity\s+\w+|\bhttp\s*\n?\s*\.\s*(?:authorizeHttpRequests|authorizeRequests|securityMatcher|antMatcher)/], 2)
+        : [];
+    if (springFilterChain.length > 0) {
+        for (const dep of springSecurity)
+            evidence.push({ type: 'dependency', value: dep, claim: 'headers' });
+        evidence.push({
+            type: 'snippet',
+            value: springFilterChain[0].snippet,
+            file: springFilterChain[0].file,
+            line: springFilterChain[0].line,
+            claim: 'headers',
+        });
+    }
+    const helmet = helmetDep || headerSignals.length > 0 || springFilterChain.length > 0;
     /**
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.90.0",
+  "version": "0.91.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {