@produtype/core 0.97.0 → 0.99.0

package/dist/analyzer/detectBilling.js

@@ -39,7 +39,31 @@ async function detectBilling(ctx) {
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
     ], 30);
-    const hasStrongStripeSignal = hasStripeDep || stripeContextHits.length > 0;
+    /**
+     * The processor, declared wherever this project declares its dependencies.
+     *
+     * `hasDep` reads `package.json` and nothing else, so a product that charges people
+     * in any other language had to be caught by the `STRIPE_` variable search instead.
+     * pretix is a ticketing platform with `stripe==7.9.*`, `paypalrestsdk` and
+     * `paypal-checkout-serversdk` in its pyproject, and it was told at `high` that it
+     * has no way to charge for the product.
+     *
+     * Only processors, not billing vocabulary: the `movie-like-billing-no-stripe`
+     * fixture exists to hold that line, and a route called `/api/billing/plans` is
+     * still not a payment integration.
+     */
+    const PROCESSOR_PACKAGES = ['stripe', 'braintree', 'paddle', 'lemonsqueezy', 'mollie', 'razorpay', 'adyen'];
+    const processorDeps = [
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, [...PROCESSOR_PACKAGES, 'paypalrestsdk', 'paypal-checkout-serversdk', 'mollie-api-python']),
+        ...(0, detectContext_1.hasAnyRubyDep)(ctx, [...PROCESSOR_PACKAGES, 'paypal-sdk-rest']),
+        ...(0, detectContext_1.hasAnyPhpDep)(ctx, ['stripe/stripe-php', 'paypal/rest-api-sdk-php', 'mollie/mollie-api-php', 'braintree/braintree_php']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['com.stripe:stripe-java', 'com.braintreepayments']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Stripe.net', 'Braintree', 'PayPalCheckoutSdk']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['stripe-rust', 'async-stripe']),
+    ];
+    for (const dep of processorDeps)
+        evidence.push({ type: 'dependency', value: dep });
+    const hasStrongStripeSignal = hasStripeDep || processorDeps.length > 0 || stripeContextHits.length > 0;
     const webhookRouteHits = hasStrongStripeSignal
         ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
             /\/webhooks?\b/i,

package/dist/analyzer/detectEnv.js

@@ -5,6 +5,7 @@ const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
 const secretArguments_1 = require("./structural/secretArguments");
 const readingDepth_1 = require("./readingDepth");
+const djangoSettings_1 = require("./djangoSettings");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -148,12 +149,25 @@ async function detectEnv(ctx) {
      * argue with — silence is not.
      */
     const secretSinksUnasked = (0, readingDepth_1.wentUnasked)(secretArguments, sourceFiles) && (await (0, secretArguments_1.anyFileReachesASecretSink)(ctx.root, sourceFiles));
+    /**
+     * A settings module the application does not run is not where its secret lives.
+     *
+     * pretix keeps `SECRET_KEY = "build-time-secret-key"` in `_build_settings.py`, a
+     * module named only by its packaging script, while `manage.py` and `wsgi.py` both
+     * name `pretix.settings`. That literal was the one `critical` in its report.
+     *
+     * Only applied when the entry points say something: with no `manage.py` to read,
+     * nothing is excused and the behaviour is what it was.
+     */
+    const runningSettings = await (0, djangoSettings_1.settingsModulesTheAppRuns)(ctx);
+    const isAnotherSettingsModule = (file) => runningSettings.length > 0 && (0, djangoSettings_1.looksLikeDjangoSettings)(file) && !runningSettings.includes(file);
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
         && !valueIsAnIdentifier(m.snippet)
         && !REDACTED_VALUE_RE.test(m.snippet)
-        && !isTableEntry(m));
+        && !isTableEntry(m)
+        && !isAnotherSettingsModule(m.file));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };
         evidence.push(hitEvidence);

package/dist/analyzer/detectSecurity.js

@@ -329,6 +329,17 @@ async function detectSecurity(ctx) {
          * issuing the refusal rather than reading one: a constant is what you construct
          * a response from, where receiving is a comparison against `.status`.
          */
+        /**
+         * Laravel's, which is a middleware alias the framework registers.
+         *
+         * `Route::middleware(['throttle:oauth2-socialite'])` is monica applying the
+         * limiter that ships with the framework, and `RateLimiter::for('login', ...)`
+         * is where the limit is defined. Neither is a package to depend on — the
+         * limiter is part of Laravel — so a list of packages could never find them, and
+         * monica was told at `high` that it does not throttle.
+         */
+        /['"]throttle:[\w.-]+['"]/,
+        /\bRateLimiter::for\s*\(/,
         /StatusCode::TOO_MANY_REQUESTS/,
         /http\.StatusTooManyRequests/,
         /HttpStatus\.TOO_MANY_REQUESTS/,

package/dist/analyzer/djangoSettings.d.ts

@@ -18,3 +18,23 @@ export declare function findDjangoSettings(ctx: DetectContext): Promise<{
     file: string;
     text: string;
 } | null>;
+/**
+ * The settings module the application actually runs, named by Django's own entry points.
+ *
+ * `manage.py`, `wsgi.py` and `asgi.py` each set `DJANGO_SETTINGS_MODULE`, and that is
+ * the framework saying which configuration is the project's. Everything else called
+ * `settings` is somebody's variant: a test harness, a build-time module, a sample.
+ *
+ * pretix is the measured case. `src/pretix/_build_settings.py` holds
+ * `SECRET_KEY = "build-time-secret-key"` and is named only by `src/pretix/_build.py`,
+ * a packaging script; `manage.py` and `wsgi.py` both name `pretix.settings`. That
+ * literal was the single `critical` in pretix's report — the severity that bars a
+ * report from the top band — raised against a line that never serves a request.
+ *
+ * A name rule could not do this: `configuration_testing.py` was caught by one in
+ * 0.80.0, and `_build_settings.py` would need "build" to mean something, which it does
+ * not. The entry point is a fact, not a word.
+ */
+export declare function settingsModulesTheAppRuns(ctx: DetectContext): Promise<string[]>;
+/** Whether a path is the sort of file a Django project keeps its configuration in. */
+export declare function looksLikeDjangoSettings(file: string): boolean;

package/dist/analyzer/djangoSettings.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findDjangoSettings = findDjangoSettings;
+exports.settingsModulesTheAppRuns = settingsModulesTheAppRuns;
+exports.looksLikeDjangoSettings = looksLikeDjangoSettings;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 /**
  * A settings file that is Django's, rather than one that shares its name.
@@ -31,3 +33,71 @@ async function findDjangoSettings(ctx) {
     }
     return null;
 }
+/**
+ * The settings module the application actually runs, named by Django's own entry points.
+ *
+ * `manage.py`, `wsgi.py` and `asgi.py` each set `DJANGO_SETTINGS_MODULE`, and that is
+ * the framework saying which configuration is the project's. Everything else called
+ * `settings` is somebody's variant: a test harness, a build-time module, a sample.
+ *
+ * pretix is the measured case. `src/pretix/_build_settings.py` holds
+ * `SECRET_KEY = "build-time-secret-key"` and is named only by `src/pretix/_build.py`,
+ * a packaging script; `manage.py` and `wsgi.py` both name `pretix.settings`. That
+ * literal was the single `critical` in pretix's report — the severity that bars a
+ * report from the top band — raised against a line that never serves a request.
+ *
+ * A name rule could not do this: `configuration_testing.py` was caught by one in
+ * 0.80.0, and `_build_settings.py` would need "build" to mean something, which it does
+ * not. The entry point is a fact, not a word.
+ */
+async function settingsModulesTheAppRuns(ctx) {
+    const entryPoints = ctx.files.all.filter((file) => /(^|\/)(manage|wsgi|asgi)\.py$/.test(file));
+    const modules = new Set();
+    for (const file of entryPoints.slice(0, 6)) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        for (const match of text.matchAll(/DJANGO_SETTINGS_MODULE["'\s,]+["']([\w.]+)["']/g)) {
+            modules.add(match[1]);
+        }
+    }
+    if (modules.size === 0)
+        return [];
+    const paths = [];
+    for (const module of modules) {
+        const asPath = module.replace(/\./g, '/');
+        for (const file of ctx.files.all) {
+            if (file.endsWith(`${asPath}.py`) || file.endsWith(`${asPath}/__init__.py`))
+                paths.push(file);
+        }
+    }
+    /**
+     * A settings package is loaded whole, through its own imports.
+     *
+     * `config.settings.production` starts with `from .base import *`, so `base.py` is as
+     * much the running configuration as the module named. The first version of this rule
+     * excused `base.py` and a fixture written for exactly that shape — a `SECRET_KEY =
+     * "changeme"` in the base module — went from `missing` to `passed` in the corpus
+     * diff, which is how the mistake surfaced within a minute of making it.
+     *
+     * Every module beside the named one, inside a directory called `settings`, counts.
+     * That is the shape of a split configuration, and it does not reach a sibling of a
+     * plain `settings.py` — which is where pretix keeps the build-time module this rule
+     * exists to exclude.
+     */
+    const withSiblings = new Set(paths);
+    for (const file of paths) {
+        const directory = file.slice(0, file.lastIndexOf('/'));
+        if (!/(^|\/)settings$/.test(directory))
+            continue;
+        for (const candidate of ctx.files.all) {
+            if (candidate.startsWith(`${directory}/`) && candidate.endsWith('.py'))
+                withSiblings.add(candidate);
+        }
+    }
+    return [...withSiblings];
+}
+/** Whether a path is the sort of file a Django project keeps its configuration in. */
+function looksLikeDjangoSettings(file) {
+    return /(^|\/)[\w-]*settings[\w-]*\.py$/i.test(file) || /(^|\/)settings\/[\w-]+\.py$/i.test(file);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.97.0",
+  "version": "0.99.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {