@produtype/core 1.6.0 → 1.7.1

package/dist/analyzer/analyzeProject.js

@@ -233,6 +233,20 @@ function isTestOrExamplePath(file) {
         || /\.(e2e|e2e-spec|cy|stories)\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(file)
         || /_spec\.rb$/i.test(file)
         || /_test\.(go|py|rb|java|cs|php)$/i.test(file)
+        || /_test\.exs$/i.test(file)
+        /**
+         * Mix names its environments, and the file name is the environment.
+         *
+         * `config/test.exs` and `config/dev.exs` are compiled only under `MIX_ENV=test` and
+         * `MIX_ENV=dev`; a production release carries `config/prod.exs` and
+         * `config/runtime.exs` and neither of the other two. supabase/realtime keeps
+         * `metrics_jwt_secret: "test"` in `config/test.exs` and it was the one `critical`
+         * in its report — a literal written to be fake, read as production configuration.
+         *
+         * The same argument as `_test.go`: the name is the toolchain's, not the author's,
+         * and it says which build the file is part of.
+         */
+        || /(^|\/)config\/(test|dev)\.exs$/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.
@@ -306,7 +320,7 @@ function isTestOrExamplePath(file) {
  * `.vue`, `.svelte` and `.astro` were missing for the same reason: a single-file
  * component holds the logic, not just the markup.
  */
-const SOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rb|java|cs|rs|kt|swift|dart|html?|vue|svelte|astro)$/;
+const SOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rb|java|cs|rs|kt|swift|dart|ex|exs|html?|vue|svelte|astro)$/;
 function pickSource(files) {
     return files.filter((f) => SOURCE_EXTENSIONS.test(f) && !isTestOrExamplePath(f));
 }
@@ -321,7 +335,6 @@ function pickSource(files) {
  * Being wrong is recoverable. Being wrong while announcing no reservations is not.
  */
 const KNOWN_UNREADABLE = [
-    [/\.(ex|exs)$/, 'Elixir'],
     [/\.(scala|sc)$/, 'Scala'],
     [/\.(clj|cljs)$/, 'Clojure'],
     [/\.(cpp|cc|hpp)$/, 'C++'],

package/dist/analyzer/catalogue.js

@@ -193,6 +193,7 @@ exports.LANGUAGES = [
     { id: 'kotlin', label: 'Kotlin', extensions: /\.(kt|kts)$/ },
     { id: 'swift', label: 'Swift', extensions: /\.swift$/ },
     { id: 'dart', label: 'Dart', extensions: /\.dart$/ },
+    { id: 'elixir', label: 'Elixir', extensions: /\.exs?$/ },
 ];
 /** Display names for ids the tables above produce. */
 const LABELS = {

package/dist/analyzer/detectEnv.js

@@ -25,6 +25,23 @@ const GENERIC_SECRET_ASSIGNMENT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_
  * because the identifier does — so the value itself was never looked at.
  */
 const REDACTED_VALUE_RE = /[:=]\s*['"`](\*{2,}|x{3,}|<?\[?redacted\]?>?|hidden|\.{3,})['"`]/i;
+/**
+ * A sentence assigned to a secret-named identifier is not a secret.
+ *
+ * `secret_key: "must be #{@secret_key_size} bytes in Base 64 URL alphabet"` is
+ * Livebook's validation message, returned when somebody types a bad key, and it was
+ * the one `critical` in its report. The finding is "Weak/fallback secret values" and
+ * the value was never looked at: every test above runs on the whole line, and the
+ * line says "secret" because the identifier does. The redaction rule beside this one
+ * was the same discovery made once, for one shape, and patched there.
+ *
+ * A secret is a token. It has no spaces in it and it is not a template with a
+ * variable in the middle — an error message, a label and a sentence all do. Three
+ * Elixir products raised this `critical` on the day Elixir became readable, and
+ * `critical` is the severity that caps maturity, so it was the loudest thing in each
+ * of three reports about products that had done nothing wrong.
+ */
+const VALUE_IS_A_SENTENCE_RE = /[:=]\s*(['"`])[^'"`]*(?:\s|#\{|\$\{)[^'"`]*\1/;
 function classifySecretFallback(snippet) {
     if (/JWT_SECRET/i.test(snippet))
         return 'jwt';
@@ -166,6 +183,7 @@ async function detectEnv(ctx) {
         && !namesItself(m.snippet)
         && !valueIsAnIdentifier(m.snippet)
         && !REDACTED_VALUE_RE.test(m.snippet)
+        && !VALUE_IS_A_SENTENCE_RE.test(m.snippet)
         && !isTableEntry(m)
         && !isAnotherSettingsModule(m.file));
     for (const m of weakHits) {

package/dist/analyzer/detectObservability.js

@@ -30,9 +30,11 @@ const LOGGING_PACKAGES = [
     'debug',
     'npmlog',
 ];
+/** Elixir reaches for a backend rather than a logger: Logger itself is in OTP. */
+const ELIXIR_LOGGING_PACKAGES = ['logger_json', 'logger_file_backend', 'sentry'];
 async function detectObservability(ctx) {
     const evidence = [];
-    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES);
+    const logDeps = [...(0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES), ...(0, detectContext_1.hasAnyElixirDep)(ctx, ELIXIR_LOGGING_PACKAGES)];
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
@@ -100,6 +102,13 @@ async function detectObservability(ctx) {
         /LoggerFactory\.getLogger|org\.slf4j/,
         /Rails\.logger/,
         /\btracing::(info|warn|error|debug)!|\blog::(info|warn|error)!/,
+        /**
+         * Elixir's, which is one module in the standard library.
+         *
+         * `Logger.info(...)` is how every Phoenix application logs, and `Logger` is
+         * OTP's name rather than anybody's variable.
+         */
+        /\bLogger\.(info|warning|warn|error|debug|notice)\(/,
     ], 15);
     for (const m of structuredHits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'logging' });
@@ -140,7 +149,7 @@ async function detectObservability(ctx) {
         evidence.push(...(0, absenceEvidence_1.searchedFor)('a health endpoint', ['/health', '/healthz', '/readyz', 'a health, healthz, readyz, liveness or readiness route file'], 'health'));
     }
     if (!hasAnyLogging) {
-        evidence.push(...(0, absenceEvidence_1.searchedFor)('logging', ['winston', 'pino', 'morgan', 'bunyan', 'Monolog', 'slog', 'zap', 'logrus', 'slf4j', 'Rails.logger', 'tracing::', 'logger.info/warn/error/debug', 'error_log(', 'JSON.stringify with a level field'], 'logging'));
+        evidence.push(...(0, absenceEvidence_1.searchedFor)('logging', ['winston', 'pino', 'morgan', 'bunyan', 'Monolog', 'slog', 'zap', 'logrus', 'slf4j', 'Rails.logger', 'tracing::', 'logger.info/warn/error/debug', 'Logger.info', 'error_log(', 'JSON.stringify with a level field'], 'logging'));
     }
     return {
         key: 'observability.core',

package/dist/analyzer/detectSecurity.js

@@ -211,6 +211,23 @@ async function detectSecurity(ctx) {
         /config\.content_security_policy\b/,
         /^\s*config\.force_ssl\s*=\s*true/m,
     ], 20);
+    /**
+     * Reading a header is not setting one.
+     *
+     * plausible ships `tracker/installation_support/check-disallowed-by-csp.js`, whose
+     * whole job is to look at somebody else's `content-security-policy` and tell a user
+     * why the tracker was blocked. Its line `responseHeaders?.['content-security-policy']`
+     * was the evidence behind "security headers: passed" — a tool that inspects other
+     * people's headers credited with setting its own.
+     *
+     * The shape is the anchor, not the file: a header name used as a key into a headers
+     * object is a lookup. Setting one is a call — `put_resp_header`, `setHeader`,
+     * `headers.set`, `add_header` — or an assignment to that subscript, and a line doing
+     * either is left alone.
+     */
+    const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
+    const SETS_A_HEADER = /put_resp_header|setHeader|set_header|add_header|headers\.(?:set|append)|writeHead/i;
+    const headerSignalsThatSet = headerSignals.filter((hit) => !READS_A_HEADER.test(hit.snippet) || SETS_A_HEADER.test(hit.snippet));
     /**
      * Spring Security, which writes the headers without being asked.
      *
@@ -249,7 +266,7 @@ async function detectSecurity(ctx) {
             claim: 'headers',
         });
     }
-    const helmet = helmetDep || headerSignals.length > 0 || springFilterChain.length > 0;
+    const helmet = helmetDep || headerSignalsThatSet.length > 0 || springFilterChain.length > 0;
     /**
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.
@@ -406,7 +423,7 @@ async function detectSecurity(ctx) {
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
         evidence.push({ type: 'dependency', value: 'rate limiting package', claim: 'rate-limit' });
-    for (const m of headerSignals)
+    for (const m of headerSignalsThatSet)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of issuedRateLimits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
@@ -580,6 +597,33 @@ async function detectSecurity(ctx) {
         const cited = anyOrigin[0] ?? chosen[0] ?? aspNetCors[0];
         target.push({ file: cited.file, line: cited.line, snippet: cited.snippet.trim().slice(0, 200) });
     }
+    /**
+     * Elixir's, which is a plug in the endpoint or the router.
+     *
+     * `cors_plug` and `corsica` are the two packages, and both are used the same way:
+     * `plug CORSPlug, origin: ["https://app.example.com"]` or `plug Corsica, origins:
+     * "*"`. The module name comes from the package, so it is the anchor; what the
+     * author chose is the value of `origin`.
+     *
+     * `plug` takes parentheses as readily as not — plausible writes `plug(CORSPlug)` in
+     * its endpoint, and a rule that required a space after the keyword could not see
+     * it. Both forms are ordinary Elixir and the formatter leaves either alone.
+     *
+     * `"*"` is the wide-open one. A list, a function or a regex is a decision somebody
+     * made, and the same reflection-versus-allowlist question the other frameworks are
+     * asked. Where the plug names no origin at all, cors_plug's own default is `"*"`,
+     * so silence is the open branch rather than the strict one.
+     */
+    const elixirCorsPackages = (0, detectContext_1.hasAnyElixirDep)(ctx, ['cors_plug', 'corsica']);
+    if (elixirCorsPackages.length > 0) {
+        const elixirSource = source.filter((f) => /\.exs?$/i.test(f));
+        const plugged = await (0, textSearch_1.searchInFiles)(ctx.root, elixirSource, [/\bplug[\s(]+(?:CORSPlug|Corsica)\b/], 5);
+        for (const hit of plugged) {
+            const origin = /origins?:\s*(.+)$/.exec(hit.snippet);
+            const wideOpen = !origin || /^["']\*["']/.test(origin[1].trim());
+            (wideOpen ? corsLoose : corsStrict).push({ file: hit.file, line: hit.line, snippet: hit.snippet.trim().slice(0, 200) });
+        }
+    }
     const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text

package/dist/analyzer/proseLines.d.ts

@@ -1,5 +1,5 @@
 /**
- * The lines of a Python file that are a docstring rather than code.
+ * The lines of a Python or Elixir file that are prose rather than code.
  *
  * This analyzer has skipped comments since the day it read its own prose about Stripe
  * as evidence that it takes payments. The rule looks for a line marker — `#`, `//`,

package/dist/analyzer/proseLines.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proseLines = proseLines;
 /**
- * The lines of a Python file that are a docstring rather than code.
+ * The lines of a Python or Elixir file that are prose rather than code.
  *
  * This analyzer has skipped comments since the day it read its own prose about Stripe
  * as evidence that it takes payments. The rule looks for a line marker — `#`, `//`,
@@ -20,6 +20,8 @@ exports.proseLines = proseLines;
  * has nothing before it but indentation.
  */
 function proseLines(file, text) {
+    if (/\.exs?$/i.test(file))
+        return elixirDocLines(text);
     const prose = new Set();
     if (!/\.py$/i.test(file))
         return prose;
@@ -54,3 +56,37 @@ function proseLines(file, text) {
     }
     return prose;
 }
+/**
+ * Elixir writes its prose as a module attribute, and the rest is a heredoc.
+ *
+ * `@moduledoc """ ... """` is the same trap as a Python docstring with a different
+ * marker: the interior lines begin with whatever the author was saying, and nothing
+ * about them says they are not code. Phoenix generators put one at the top of every
+ * controller, context and channel, so a repository has thousands.
+ *
+ * Anchored on Elixir's own attribute names — `@moduledoc`, `@doc`, `@typedoc`,
+ * `@shortdoc` — rather than on the heredoc, because `@query """SELECT ..."""` is data
+ * assigned to a name and a hardcoded secret could live in one. Same distinction the
+ * Python reader draws, made by a different marker.
+ */
+function elixirDocLines(text) {
+    const prose = new Set();
+    const lines = text.split(/\r?\n/);
+    let open = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (open) {
+            prose.add(i + 1);
+            if (/"""/.test(line))
+                open = false;
+            continue;
+        }
+        const doc = /^\s*@(?:module|type|short)?doc\s+(?:~[A-Za-z])?"""/.exec(line);
+        if (!doc)
+            continue;
+        prose.add(i + 1);
+        /** A heredoc cannot close on its opening line, so the block is always open here. */
+        open = true;
+    }
+    return prose;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {