@produtype/core 1.13.0 → 1.15.0

package/dist/analyzer/detectSecurity.js

@@ -726,6 +726,74 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
+    /**
+     * Rails' answer, which is a gem with a small language of its own.
+     *
+     * chatwoot scored 98 and `production_ready` with its cross-origin policy reported
+     * as "not detected". It installs `rack-cors`, mounts `Rack::Cors` as the first
+     * middleware in `config/initializers/cors.rb`, and writes `origins '*'` — which
+     * opens `/packs/*`, `/audio/*`, `/public/api/*`, and everything else when
+     * `CW_API_ONLY_SERVER` is set. Not one of the words this check looked for appears
+     * in that file: the gem's DSL says `origins`, not `Access-Control-Allow-Origin`.
+     *
+     * `rack-cors`, `Rack::Cors` and `origins` are the gem's; the values are the
+     * author's. Every `origins` line is read, because the block lists one per rule and
+     * a permissive one beside a restricted one is still permissive.
+     */
+    for (const file of ctx.files.all.filter((f) => /\.rb$/.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text || !/\bRack::Cors\b/.test(text))
+            continue;
+        const lines = text.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const origins = /^\s*origins\s+(.+)$/.exec(lines[i]);
+            if (!origins || !(0, textSearch_1.isCitableLine)(lines[i].trim()))
+                continue;
+            const hit = { file, line: i + 1, snippet: lines[i].trim().slice(0, 200) };
+            if (/^['"]\*['"]/.test(origins[1].trim()))
+                corsLoose.push(hit);
+            else
+                corsStrict.push(hit);
+        }
+    }
+    /**
+     * Symfony's answer, which is a bundle and the file it reads.
+     *
+     * kimai scored 93 and `production_ready` while its API answered every origin on
+     * earth: `config/packages/nelmio_cors.yaml` sets `allow_origin: []` in its defaults
+     * — the bundle's own comment says "for security reasons we do not allow CORS by
+     * default" — and then `allow_origin: ['*']` under `^/api/`. The report said "CORS
+     * configuration not detected" and gave no verdict at all.
+     *
+     * `nelmio/cors-bundle` is what a Symfony project installs for this, `nelmio_cors` is
+     * the configuration key the bundle defines and `allow_origin` is its setting. None
+     * of the three is the author's to choose; the values are.
+     *
+     * Every `allow_origin` in the file is read, not the first. A bundle configures
+     * defaults and then overrides them per path, and it is the override that is
+     * reachable — the same reason the ASP.NET branch above reports the open one where a
+     * project ships both.
+     */
+    for (const file of ctx.files.all.filter((f) => /(^|\/)config\/packages\/[\w.-]*nelmio_cors[\w.-]*\.ya?ml$/i.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        const lines = text.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            const origins = /^\s*allow_origin\s*:\s*(.*)$/.exec(lines[i]);
+            if (!origins)
+                continue;
+            const value = origins[1].trim();
+            /** An empty list is the bundle refusing every cross-origin request. */
+            if (value === '[]' || value === '')
+                continue;
+            const hit = { file, line: i + 1, snippet: lines[i].trim().slice(0, 200) };
+            if (/\[\s*['"]\*['"]\s*\]/.test(value) || value === "'*'" || value === '"*"')
+                corsLoose.push(hit);
+            else
+                corsStrict.push(hit);
+        }
+    }
     /**
      * Laravel's answer, which is a file with a name the framework chose.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {