@produtype/core 1.17.2 → 1.19.0

package/dist/analyzer/detectSecurity.js

@@ -854,10 +854,26 @@ async function detectSecurity(ctx) {
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
         if (!text)
             continue;
+        /**
+         * The key has to be there, and "not found" is not "wide open".
+         *
+         * This read a missing `allowed_origins` as the permissive case, which is
+         * blindness turned into the loudest verdict there is. appwrite is not a Laravel
+         * application — it keeps its own `app/config/cors.php` holding methods and
+         * headers, with origins decided in `src/Appwrite/Network/Cors.php`, where they
+         * are matched by hostname and echoed back one at a time, never as a wildcard.
+         * The path matched, the key did not, and a product with a careful allowlist was
+         * reported at `high` as having opened itself to everybody.
+         *
+         * Laravel publishes that key with the file, so a `config/cors.php` without it is
+         * somebody else's file at the same path. This branch now says nothing about it.
+         */
         const origins = /'allowed_origins'\s*=>\s*\[([^\]]*)\]/.exec(text);
-        const line = origins ? text.slice(0, origins.index).split('\n').length : 1;
-        const hit = { file, line, snippet: (origins?.[0] ?? "config/cors.php").replace(/\s+/g, ' ').trim().slice(0, 200) };
-        if (!origins || /^\s*'\*'\s*,?\s*$/.test(origins[1]))
+        if (!origins)
+            continue;
+        const line = text.slice(0, origins.index).split('\n').length;
+        const hit = { file, line, snippet: origins[0].replace(/\s+/g, ' ').trim().slice(0, 200) };
+        if (/^\s*'\*'\s*,?\s*$/.test(origins[1]))
             corsLoose.push(hit);
         else
             corsStrict.push(hit);

package/dist/utils/textSearch.js

@@ -26,6 +26,44 @@ const blockComments_1 = require("../analyzer/blockComments");
  * and is left alone.
  */
 const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\\.)+\/[gimsuy]*\s*[,;]?$/;
+/**
+ * A header name on a line of its own says which header, not what value.
+ *
+ * saleor's ASGI handler writes the response headers as a list of tuples, so
+ * `b"access-control-allow-origin",` sits alone on line 50 and the origin it will
+ * carry is on line 51. Saleor only appends that pair when the caller's origin matched
+ * its allowlist, and answers 400 when it did not — a strict policy, reported at
+ * `high` as one with no restrictions, on the strength of a line that cannot show a
+ * policy because there is no value on it.
+ *
+ * The bare-string-in-a-list rule this file already records stays intact:
+ * `'django.contrib.auth',` in an INSTALLED_APPS array *is* the behaviour. A header
+ * name is not, for the reason above — it names the slot, and the slot is filled
+ * somewhere else.
+ */
+const LONE_HEADER_NAME = /^[bru]?(['"`])([^'"`]+)\1\s*,?$/i;
+function isALoneHeaderName(trimmed) {
+    const literal = LONE_HEADER_NAME.exec(trimmed);
+    return literal !== null && HTTP_HEADER_NAME.test(literal[2].replace(/\b[a-z]/g, (c) => c.toUpperCase()));
+}
+/**
+ * An entry that says what something is called.
+ *
+ * appwrite ships a catalogue of function templates, and one line of it is
+ * `'name' => 'ALLOWED_ORIGINS',` — an environment variable *the user's* function may
+ * set, described in a table beside its placeholder and its help text. After the other
+ * two citations were withdrawn it was carrying appwrite's whole `high` cross-origin
+ * finding on its own, about a product whose real policy matches origins by hostname
+ * and never answers with a wildcard.
+ *
+ * A string bound to `name`, `key`, `label` or `id` is what a thing is called. That is
+ * not the same as a bare string in a list, which this file deliberately still reads —
+ * `'django.contrib.auth',` in an INSTALLED_APPS array *is* the behaviour, and the
+ * measurement that established it cost a real Django project eight points for being
+ * legible. The difference is the key: one line says "this is called X", the other says
+ * "X".
+ */
+const NAMES_SOMETHING = /^["']?(?:name|key|label|id|title|field|env|variable)["']?\s*(?:=>|:)\s*["'`][^"'`]+["'`],?$/i;
 /**
  * A constant that spells its own name.
  *
@@ -149,7 +187,7 @@ function declaresAType(trimmed) {
 }
 function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
-    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed);
+    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed) || spellsItsOwnName(trimmed) || NAMES_SOMETHING.test(trimmed) || isALoneHeaderName(trimmed);
 }
 /**
  * Whether this line may be quoted back to the reader as something the code does.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.17.2",
+  "version": "1.19.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {