@produtype/core 1.12.1 → 1.14.0

package/dist/analyzer/detectAuth.js

@@ -301,7 +301,64 @@ async function detectAuth(ctx) {
      * is the one that meant three different things in three repositories, and it is the
      * one the tree answers.
      */
-    const unambiguousRoles = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/requireRole/i, /isAdmin/i, /SUPER_ADMIN/i, /roles\.includes\(/i], 20);
+    /**
+     * Spring says all of this with names it owns, and none of them were here.
+     *
+     * mall is a Spring Boot shop with a full authorization model — a filter chain built
+     * with `authorizeHttpRequests`, a `DynamicAuthorizationManager` comparing the
+     * caller's `GrantedAuthority` against the one a path requires, and a
+     * `UmsAdminRoleRelationDao` that loads an administrator's roles from the database —
+     * and it was told at `medium` that it has no role checks and no permission checks
+     * at all.
+     *
+     * Every word above is Spring Security's or the JSR's: `GrantedAuthority`,
+     * `@PreAuthorize`, `@Secured`, `@RolesAllowed`, `hasAuthority`, `hasAnyRole`,
+     * `authorizeHttpRequests` and the `antMatchers` it replaced. What mall chose was
+     * `Ums`, the prefix on its own classes, and that is exactly what a search must not
+     * depend on.
+     */
+    const SPRING_AUTHORIZATION = [
+        /@PreAuthorize\b/,
+        /@PostAuthorize\b/,
+        /@Secured\b/,
+        /@RolesAllowed\b/,
+        /\bGrantedAuthority\b/,
+        /\bhasAuthority\s*\(/,
+        /\bhasAnyAuthority\s*\(/,
+        /\bhasAnyRole\s*\(/,
+        /\bhasRole\s*\(/,
+    ];
+    /**
+     * `authorizeHttpRequests` is not on that list, and the corpus is why.
+     *
+     * It was, and `spring-security-defaults` — a fixture whose whole point is a chain
+     * with no roles in it, `requests.anyRequest().authenticated()` — started reading as
+     * having an authorization model. Every Spring Security setup writes that line: it
+     * says the request must be authenticated, which is the question one capability
+     * along. The same test Django's `SecurityMiddleware` and Rails' default headers
+     * failed — a thing every project has distinguishes nothing.
+     *
+     * What survives is the part somebody chose: which authority a path requires, and
+     * the annotation that says it on a method.
+     */
+    const unambiguousRoles = [
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/requireRole/i, /isAdmin/i, /SUPER_ADMIN/i, /roles\.includes\(/i], 20),
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, SPRING_AUTHORIZATION, 20, 
+        /**
+         * An import is not a check.
+         *
+         * `import org.springframework.security.core.GrantedAuthority;` names the type
+         * and decides nothing; `grantedAuthorities.stream()` twenty files away is where
+         * the caller's authority is compared against the one the path requires. The
+         * first version of this cited the import, which is the same complaint pocketbase
+         * earned two releases ago — a reader is promised the line that decides.
+         *
+         * Filtered inside the search rather than after it, so the budget is spent on
+         * lines that check something: a Java project has one import per file and they
+         * would fill it.
+         */
+        (match) => !/^\s*import\b/.test(match.snippet)),
+    ];
     const comparedRoles = guardedRoles
         ?? excludeChatTurnRoles(await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/req\.user\.role/i, /user\.role/i, /role\s*===/i], 20));
     const roleSignals = [...unambiguousRoles, ...comparedRoles].slice(0, 20);
@@ -524,7 +581,7 @@ async function detectAuth(ctx) {
         {
             key: 'authz.roles',
             present: roleSignals.length > 0,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(roleSignals), 'role checks', ['role ===', 'hasRole', 'isAdmin', 'user.role', 'roles.includes', '@Roles', 'role_required']),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(roleSignals), 'role checks', ['role ===', 'hasRole', 'isAdmin', 'user.role', 'roles.includes', '@Roles', 'role_required', '@PreAuthorize', '@Secured', 'GrantedAuthority', 'hasAuthority(', 'hasAnyRole(']),
         },
         {
             key: 'authz.permissions',

package/dist/analyzer/detectSecurity.js

@@ -726,6 +726,44 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
+    /**
+     * Symfony's answer, which is a bundle and the file it reads.
+     *
+     * kimai scored 93 and `production_ready` while its API answered every origin on
+     * earth: `config/packages/nelmio_cors.yaml` sets `allow_origin: []` in its defaults
+     * — the bundle's own comment says "for security reasons we do not allow CORS by
+     * default" — and then `allow_origin: ['*']` under `^/api/`. The report said "CORS
+     * configuration not detected" and gave no verdict at all.
+     *
+     * `nelmio/cors-bundle` is what a Symfony project installs for this, `nelmio_cors` is
+     * the configuration key the bundle defines and `allow_origin` is its setting. None
+     * of the three is the author's to choose; the values are.
+     *
+     * Every `allow_origin` in the file is read, not the first. A bundle configures
+     * defaults and then overrides them per path, and it is the override that is
+     * reachable — the same reason the ASP.NET branch above reports the open one where a
+     * project ships both.
+     */
+    for (const file of ctx.files.all.filter((f) => /(^|\/)config\/packages\/[\w.-]*nelmio_cors[\w.-]*\.ya?ml$/i.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        const lines = text.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const origins = /^\s*allow_origin\s*:\s*(.*)$/.exec(lines[i]);
+            if (!origins)
+                continue;
+            const value = origins[1].trim();
+            /** An empty list is the bundle refusing every cross-origin request. */
+            if (value === '[]' || value === '')
+                continue;
+            const hit = { file, line: i + 1, snippet: lines[i].trim().slice(0, 200) };
+            if (/\[\s*['"]\*['"]\s*\]/.test(value) || value === "'*'" || value === '"*"')
+                corsLoose.push(hit);
+            else
+                corsStrict.push(hit);
+        }
+    }
     /**
      * Laravel's answer, which is a file with a name the framework chose.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.12.1",
+  "version": "1.14.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {