@produtype/core 1.17.1 → 1.18.0

package/dist/analyzer/detectSecurity.js

@@ -854,10 +854,26 @@ async function detectSecurity(ctx) {
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
         if (!text)
             continue;
+        /**
+         * The key has to be there, and "not found" is not "wide open".
+         *
+         * This read a missing `allowed_origins` as the permissive case, which is
+         * blindness turned into the loudest verdict there is. appwrite is not a Laravel
+         * application — it keeps its own `app/config/cors.php` holding methods and
+         * headers, with origins decided in `src/Appwrite/Network/Cors.php`, where they
+         * are matched by hostname and echoed back one at a time, never as a wildcard.
+         * The path matched, the key did not, and a product with a careful allowlist was
+         * reported at `high` as having opened itself to everybody.
+         *
+         * Laravel publishes that key with the file, so a `config/cors.php` without it is
+         * somebody else's file at the same path. This branch now says nothing about it.
+         */
         const origins = /'allowed_origins'\s*=>\s*\[([^\]]*)\]/.exec(text);
-        const line = origins ? text.slice(0, origins.index).split('\n').length : 1;
-        const hit = { file, line, snippet: (origins?.[0] ?? "config/cors.php").replace(/\s+/g, ' ').trim().slice(0, 200) };
-        if (!origins || /^\s*'\*'\s*,?\s*$/.test(origins[1]))
+        if (!origins)
+            continue;
+        const line = text.slice(0, origins.index).split('\n').length;
+        const hit = { file, line, snippet: origins[0].replace(/\s+/g, ' ').trim().slice(0, 200) };
+        if (/^\s*'\*'\s*,?\s*$/.test(origins[1]))
             corsLoose.push(hit);
         else
             corsStrict.push(hit);

package/dist/utils/textSearch.js

@@ -26,6 +26,24 @@ const blockComments_1 = require("../analyzer/blockComments");
  * and is left alone.
  */
 const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\\.)+\/[gimsuy]*\s*[,;]?$/;
+/**
+ * An entry that says what something is called.
+ *
+ * appwrite ships a catalogue of function templates, and one line of it is
+ * `'name' => 'ALLOWED_ORIGINS',` — an environment variable *the user's* function may
+ * set, described in a table beside its placeholder and its help text. After the other
+ * two citations were withdrawn it was carrying appwrite's whole `high` cross-origin
+ * finding on its own, about a product whose real policy matches origins by hostname
+ * and never answers with a wildcard.
+ *
+ * A string bound to `name`, `key`, `label` or `id` is what a thing is called. That is
+ * not the same as a bare string in a list, which this file deliberately still reads —
+ * `'django.contrib.auth',` in an INSTALLED_APPS array *is* the behaviour, and the
+ * measurement that established it cost a real Django project eight points for being
+ * legible. The difference is the key: one line says "this is called X", the other says
+ * "X".
+ */
+const NAMES_SOMETHING = /^["']?(?:name|key|label|id|title|field|env|variable)["']?\s*(?:=>|:)\s*["'`][^"'`]+["'`],?$/i;
 /**
  * A constant that spells its own name.
  *
@@ -99,7 +117,7 @@ function spellsItsOwnName(trimmed) {
  * those really do introduce a declaration.
  */
 const STATEMENT_KEYWORD = /^(?:import|package|from|export|return|case|new|type|class|struct|interface|enum|func|fun|def|public|private|protected|internal|throw|throws|extends|implements|use|using|namespace|module|require|await|yield|delete|typeof|instanceof|in|is|as|if|else|for|while|switch|do|try|catch|finally|with|assert|raise|lambda|val|const)\b/;
-const TYPE_DECLARATION = /^(?:var\s+|let\s+|readonly\s+)?\w+\??\s*(?::\s*|\s+)(?:\[\]|\*|Array<|Map<|\bstring\b|\bnumber\b|\bboolean\b|\bbool\b|\bany\b|\bunknown\b|\bvoid\b|[A-Z])[\w.<>[\]|&\s]*;?$/;
+const TYPE_DECLARATION = /^(?:var\s+|let\s+|readonly\s+)?\w+\??\s*(?::\s*|\s+)(?:\[\]|\*|Array<|Map<|\bstring\b|\bnumber\b|\bboolean\b|\bbool\b|\bany\b|\bunknown\b|\bvoid\b|[A-Z])[\w.<>[\]|&*\s]*;?$/;
 /**
  * Prose about the code, rather than the code.
  *
@@ -130,13 +148,26 @@ const COMMENT_LINE = /^(?:\/\/|\/\*|\*\/?|#(?![![])(?!!)|<!--|--\s)/;
  *
  * Nothing in the shape of the line tells the two apart, so the rule is not made.
  */
+/**
+ * Two shapes the first version of this let through, both found in caddy.
+ *
+ * `allowedOrigins []*url.URL` is a struct field and the type is a pointer, which the
+ * character class did not allow — so a declaration was cited as a cross-origin
+ * decision. `AllowDomain []string // FIXME: this option is from legacy` is the same
+ * thing with gitea's note after it, and the rule required the line to end at the
+ * type.
+ *
+ * A trailing comment is dropped before the test, exactly as the self-naming rule
+ * drops it, and `*` and `&` join the characters a type may be written with.
+ */
 function declaresAType(trimmed) {
-    const withoutDeclarator = trimmed.replace(/^(?:var|let|readonly)\s+/, '');
-    return !STATEMENT_KEYWORD.test(withoutDeclarator) && TYPE_DECLARATION.test(trimmed);
+    const withoutComment = trimmed.replace(/\s*(?:\/\/|#).*$/, '').trimEnd();
+    const withoutDeclarator = withoutComment.replace(/^(?:var|let|readonly)\s+/, '');
+    return !STATEMENT_KEYWORD.test(withoutDeclarator) && TYPE_DECLARATION.test(withoutComment);
 }
 function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
-    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed);
+    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed) || NAMES_SOMETHING.test(trimmed);
 }
 /**
  * Whether this line may be quoted back to the reader as something the code does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.17.1",
+  "version": "1.18.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {