@produtype/core 1.16.0 → 1.17.1

package/dist/analyzer/detectSecurity.js

@@ -10,7 +10,21 @@ const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
-const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
+/**
+ * The header, spelled the way each language spells it.
+ *
+ * photoprism refers to its headers by the constants it declared for them —
+ * `c.Header(header.AccessControlAllowOrigin, header.Any)` in `start.go` and
+ * `static.go`, which is where it opens itself — and those lines carry no hyphens, so
+ * a pattern written as the wire name could not see any of them. Excluding the
+ * constant table without this took the project from a right verdict on the wrong
+ * evidence to no verdict at all, which is worse.
+ *
+ * The camel spelling is still the protocol's name: Go, Java and C# write
+ * `AccessControlAllowOrigin` because that is what their conventions do to
+ * `Access-Control-Allow-Origin`. It is not the author's word either way.
+ */
+const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /\bAccessControlAllowOrigin\b/, /ALLOWED_ORIGINS/, /allowedOrigins/i];
 /** A header name used as a key into a headers object: a lookup, not a decision. */
 const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
 /** The calls that put one on a response, in the frameworks this reads. */

package/dist/utils/textSearch.js

@@ -26,6 +26,50 @@ const blockComments_1 = require("../analyzer/blockComments");
  * and is left alone.
  */
 const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\\.)+\/[gimsuy]*\s*[,;]?$/;
+/**
+ * A constant that spells its own name.
+ *
+ * photoprism keeps `AccessControlAllowOrigin = "Access-Control-Allow-Origin"` in
+ * `pkg/http/header/cors.go`, beside three more of the same, and that table was the
+ * whole evidence for its cross-origin finding — while
+ * `c.Header(header.AccessControlAllowOrigin, header.Any)` in `start.go` and
+ * `static.go`, the lines that actually open it, went uncited.
+ *
+ * A line whose value is its own identifier written out is a name for something, not a
+ * use of it. It is the third member of a family this file already has: a regex in a
+ * table is not a search, a name given a type is not a decision, and a header constant
+ * is not a header.
+ *
+ * Compared after normalising case and separators, because that is the only difference
+ * between the two halves — `ACCESS_CONTROL_ALLOW_ORIGIN`, `AccessControlAllowOrigin`
+ * and `"access-control-allow-origin"` are one string spelled three ways. A trailing
+ * comment is dropped first; Go puts the documentation link on the same line.
+ */
+/**
+ * A header name, in the shape the protocol writes them.
+ *
+ * Radarr shortens its constants — `public const string AllowOrigin =
+ * "Access-Control-Allow-Origin";` — so the two halves do not match and the
+ * spells-its-own-name test says nothing. It is the same table: five lines naming five
+ * headers, and the policy that matters is `builder.AllowAnyOrigin()` in `Startup.cs`,
+ * two files away.
+ *
+ * Hyphenated capitalised words are how HTTP writes a header and almost nothing else
+ * is written that way. It is required to be the whole value of a declaration, so a
+ * line that *sends* one — `res.setHeader('Access-Control-Allow-Origin', origin)` —
+ * has other arguments and is untouched.
+ */
+const HTTP_HEADER_NAME = /^[A-Z][A-Za-z0-9]*(?:-[A-Z][A-Za-z0-9]*)+$/;
+function spellsItsOwnName(trimmed) {
+    const withoutComment = trimmed.replace(/\s*(\/\/|#).*$/, '').replace(/[,;]\s*$/, '');
+    const assignment = /^(?:(?:public|private|protected|internal|export|const|let|var|final|static|readonly|string)\s+)*([A-Za-z_][\w.]*)\s*(?::\s*[\w<>[\].]+)?\s*=\s*(['"`])([^'"`]+)\2$/.exec(withoutComment);
+    if (!assignment)
+        return false;
+    const plain = (value) => value.toLowerCase().replace(/[-_.\s]/g, '');
+    const declared = /^\s*(?:public|private|protected|internal|export|const|let|var|final|static|readonly)\b/.test(withoutComment);
+    return plain(assignment[1]) === plain(assignment[3])
+        || (declared && HTTP_HEADER_NAME.test(assignment[3]));
+}
 /**
  * A name given a type, rather than a value.
  *
@@ -92,7 +136,7 @@ function declaresAType(trimmed) {
 }
 function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
-    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed);
+    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed);
 }
 /**
  * Whether this line may be quoted back to the reader as something the code does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.16.0",
+  "version": "1.17.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {