@produtype/core 0.96.0 → 0.97.0

package/dist/analyzer/detectSecurity.js

@@ -195,6 +195,21 @@ async function detectSecurity(ctx) {
         /^\s*SECURE_REFERRER_POLICY\s*=/m,
         /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
         /^\s*CSP_DEFAULT_SRC\s*=/m,
+        /**
+         * Rails writes its header policy as Ruby, not as a header name.
+         *
+         * `config.content_security_policy do |policy|` in an initializer is the policy
+         * itself, and `config.force_ssl = true` is what turns on Strict-Transport-Security
+         * for the whole application. lobsters has both and was told at `high` to add
+         * security headers.
+         *
+         * Both are lines somebody chose to write. Rails' *default* headers —
+         * `X-Frame-Options: SAMEORIGIN`, nosniff, and the rest of `DefaultHeaders` —
+         * are not counted, for the reason Django's `SecurityMiddleware` is not: every
+         * application has them, so they distinguish nothing.
+         */
+        /config\.content_security_policy\b/,
+        /^\s*config\.force_ssl\s*=\s*true/m,
     ], 20);
     /**
      * Spring Security, which writes the headers without being asked.
@@ -256,7 +271,15 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
         (0, detectContext_1.hasAnyPyDep)(ctx, ['django-ratelimit', 'slowapi', 'flask-limiter']).length > 0 ||
-        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0;
+        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0 ||
+        /**
+         * Ruby's, which is one gem and nearly universal in Rails.
+         *
+         * lobsters declares `gem "rack-attack" # rate-limiting` and was told at `high`
+         * that it does not throttle. The list had grown npm, Python and Rust entries and
+         * skipped the ecosystem where the answer is a single well-known name.
+         */
+        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0;
     /**
      * Throttling by what the protocol says, not by what the variable is called.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.96.0",
+  "version": "0.97.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {