@produtype/core 1.15.0 → 1.17.0

package/dist/analyzer/detectSecurity.js

@@ -10,7 +10,21 @@ const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
-const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
+/**
+ * The header, spelled the way each language spells it.
+ *
+ * photoprism refers to its headers by the constants it declared for them —
+ * `c.Header(header.AccessControlAllowOrigin, header.Any)` in `start.go` and
+ * `static.go`, which is where it opens itself — and those lines carry no hyphens, so
+ * a pattern written as the wire name could not see any of them. Excluding the
+ * constant table without this took the project from a right verdict on the wrong
+ * evidence to no verdict at all, which is worse.
+ *
+ * The camel spelling is still the protocol's name: Go, Java and C# write
+ * `AccessControlAllowOrigin` because that is what their conventions do to
+ * `Access-Control-Allow-Origin`. It is not the author's word either way.
+ */
+const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /\bAccessControlAllowOrigin\b/, /ALLOWED_ORIGINS/, /allowedOrigins/i];
 /** A header name used as a key into a headers object: a lookup, not a decision. */
 const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
 /** The calls that put one on a response, in the frameworks this reads. */
@@ -726,6 +740,36 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
+    /**
+     * Rust's answer, which is a builder rather than a value.
+     *
+     * meilisearch calls `.send_wildcard()` and `.allow_any_origin()` on an
+     * `actix_cors::Cors` — the most explicit way there is to say "everybody" — and the
+     * report said "CORS configuration not detected". Third product in three releases
+     * scoring well while answering every origin on the web, after kimai's
+     * `nelmio_cors.yaml` and chatwoot's `origins '*'`.
+     *
+     * Nothing here is a header name or an `allowedOrigins` field. `Cors`,
+     * `allow_any_origin`, `allowed_origin` and `permissive` are actix-cors'; `CorsLayer`
+     * and `allow_origin` are tower-http's. The method says which branch it is:
+     * `allow_any_origin`, `permissive` and `Any` are open, a named origin is a choice.
+     *
+     * The tower-http half ships weaker and this says so: meilisearch is the actix case,
+     * and two axum services cloned looking for the other one — atuin and lapdev — turned
+     * out to configure no CORS at all. It is the same contract read from the same kind
+     * of builder, but no repository stands behind it yet.
+     */
+    const RUST_CORS_OPEN = [/\.allow_any_origin\s*\(/, /\.send_wildcard\s*\(/, /Cors::permissive\s*\(/, /CorsLayer::permissive\s*\(/, /\.allow_origin\s*\(\s*Any\b/];
+    const RUST_CORS_CHOSEN = [/\.allowed_origin\s*\(/, /\.allowed_origin_fn\s*\(/, /\.allow_origin\s*\(\s*["'[]/];
+    const rustSource = source.filter((f) => /\.rs$/.test(f));
+    if (rustSource.length > 0) {
+        const open = await (0, textSearch_1.searchInFiles)(ctx.root, rustSource, RUST_CORS_OPEN, 5);
+        const chosen = await (0, textSearch_1.searchInFiles)(ctx.root, rustSource, RUST_CORS_CHOSEN, 5);
+        for (const hit of open)
+            corsLoose.push(hit);
+        for (const hit of chosen)
+            corsStrict.push(hit);
+    }
     /**
      * Rails' answer, which is a gem with a small language of its own.
      *

package/dist/utils/textSearch.js

@@ -26,6 +26,33 @@ const blockComments_1 = require("../analyzer/blockComments");
  * and is left alone.
  */
 const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\\.)+\/[gimsuy]*\s*[,;]?$/;
+/**
+ * A constant that spells its own name.
+ *
+ * photoprism keeps `AccessControlAllowOrigin = "Access-Control-Allow-Origin"` in
+ * `pkg/http/header/cors.go`, beside three more of the same, and that table was the
+ * whole evidence for its cross-origin finding — while
+ * `c.Header(header.AccessControlAllowOrigin, header.Any)` in `start.go` and
+ * `static.go`, the lines that actually open it, went uncited.
+ *
+ * A line whose value is its own identifier written out is a name for something, not a
+ * use of it. It is the third member of a family this file already has: a regex in a
+ * table is not a search, a name given a type is not a decision, and a header constant
+ * is not a header.
+ *
+ * Compared after normalising case and separators, because that is the only difference
+ * between the two halves — `ACCESS_CONTROL_ALLOW_ORIGIN`, `AccessControlAllowOrigin`
+ * and `"access-control-allow-origin"` are one string spelled three ways. A trailing
+ * comment is dropped first; Go puts the documentation link on the same line.
+ */
+function spellsItsOwnName(trimmed) {
+    const withoutComment = trimmed.replace(/\s*(\/\/|#).*$/, '').replace(/[,;]\s*$/, '');
+    const assignment = /^(?:const|let|var|final|static|public|private)?\s*([A-Za-z_][\w.]*)\s*(?::\s*[\w<>[\].]+)?\s*=\s*(['"`])([^'"`]+)\2$/.exec(withoutComment);
+    if (!assignment)
+        return false;
+    const plain = (value) => value.toLowerCase().replace(/[-_.\s]/g, '');
+    return plain(assignment[1]) === plain(assignment[3]);
+}
 /**
  * A name given a type, rather than a value.
  *
@@ -92,7 +119,7 @@ function declaresAType(trimmed) {
 }
 function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
-    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed);
+    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed);
 }
 /**
  * Whether this line may be quoted back to the reader as something the code does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {