@produtype/core 1.7.0 → 1.8.0

package/dist/analyzer/analyzeProject.js

@@ -233,6 +233,20 @@ function isTestOrExamplePath(file) {
         || /\.(e2e|e2e-spec|cy|stories)\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(file)
         || /_spec\.rb$/i.test(file)
         || /_test\.(go|py|rb|java|cs|php)$/i.test(file)
+        || /_test\.exs$/i.test(file)
+        /**
+         * Mix names its environments, and the file name is the environment.
+         *
+         * `config/test.exs` and `config/dev.exs` are compiled only under `MIX_ENV=test` and
+         * `MIX_ENV=dev`; a production release carries `config/prod.exs` and
+         * `config/runtime.exs` and neither of the other two. supabase/realtime keeps
+         * `metrics_jwt_secret: "test"` in `config/test.exs` and it was the one `critical`
+         * in its report — a literal written to be fake, read as production configuration.
+         *
+         * The same argument as `_test.go`: the name is the toolchain's, not the author's,
+         * and it says which build the file is part of.
+         */
+        || /(^|\/)config\/(test|dev)\.exs$/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.

package/dist/analyzer/detectBilling.js

@@ -12,7 +12,24 @@ async function detectBilling(ctx) {
     const hasStripeDep = (0, detectContext_1.hasDep)(ctx, 'stripe');
     if (hasStripeDep)
         evidence.push({ type: 'dependency', value: 'stripe' });
-    const stripeContextHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+    /**
+     * Laravel's table of service credentials, which is a list of slots.
+     *
+     * `config/services.php` ships with the framework and holds a block per service the
+     * skeleton knows about — mailgun, postmark, ses, and for years a `stripe` one
+     * reading `env('STRIPE_KEY')`. Firefly III still carries it, beside sparkpost,
+     * mandrill and pushover, and takes no payments at all: no processor package in its
+     * composer.json, no charge anywhere. It was reported at `medium` for an unhardened
+     * billing webhook, and the rest of that finding was its own webhooks feature —
+     * notifications a *user* registers to hear about their transactions, which point
+     * the other way entirely.
+     *
+     * An entry there is a slot the deployment may fill, not an integration this project
+     * has. A project that charges people declares `stripe/stripe-php` or
+     * `laravel/cashier`, and that is read from the manifest a few lines down.
+     */
+    const LARAVEL_SERVICE_SLOTS = /(^|\/)config\/services\.php$/;
+    const stripeContextHits = (await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /**
          * The bare word is not here, on purpose.
          *
@@ -38,7 +55,7 @@ async function detectBilling(ctx) {
         /stripeSubscriptionId/i,
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
-    ], 30);
+    ], 30)).filter((hit) => !LARAVEL_SERVICE_SLOTS.test(hit.file));
     /**
      * The processor, declared wherever this project declares its dependencies.
      *

package/dist/analyzer/detectEnv.js

@@ -25,6 +25,23 @@ const GENERIC_SECRET_ASSIGNMENT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_
  * because the identifier does — so the value itself was never looked at.
  */
 const REDACTED_VALUE_RE = /[:=]\s*['"`](\*{2,}|x{3,}|<?\[?redacted\]?>?|hidden|\.{3,})['"`]/i;
+/**
+ * A sentence assigned to a secret-named identifier is not a secret.
+ *
+ * `secret_key: "must be #{@secret_key_size} bytes in Base 64 URL alphabet"` is
+ * Livebook's validation message, returned when somebody types a bad key, and it was
+ * the one `critical` in its report. The finding is "Weak/fallback secret values" and
+ * the value was never looked at: every test above runs on the whole line, and the
+ * line says "secret" because the identifier does. The redaction rule beside this one
+ * was the same discovery made once, for one shape, and patched there.
+ *
+ * A secret is a token. It has no spaces in it and it is not a template with a
+ * variable in the middle — an error message, a label and a sentence all do. Three
+ * Elixir products raised this `critical` on the day Elixir became readable, and
+ * `critical` is the severity that caps maturity, so it was the loudest thing in each
+ * of three reports about products that had done nothing wrong.
+ */
+const VALUE_IS_A_SENTENCE_RE = /[:=]\s*(['"`])[^'"`]*(?:\s|#\{|\$\{)[^'"`]*\1/;
 function classifySecretFallback(snippet) {
     if (/JWT_SECRET/i.test(snippet))
         return 'jwt';
@@ -166,6 +183,7 @@ async function detectEnv(ctx) {
         && !namesItself(m.snippet)
         && !valueIsAnIdentifier(m.snippet)
         && !REDACTED_VALUE_RE.test(m.snippet)
+        && !VALUE_IS_A_SENTENCE_RE.test(m.snippet)
         && !isTableEntry(m)
         && !isAnotherSettingsModule(m.file));
     for (const m of weakHits) {

package/dist/analyzer/detectPackageManager.js

@@ -97,7 +97,7 @@ function resolveFromOtherManifests(ctx) {
     const best = pool.reduce((winner, candidate) => candidate.depth < winner.depth || (candidate.depth === winner.depth && candidate.order < winner.order)
         ? candidate
         : winner);
-    return { manager: best.manager, confidence: 'manifest', warnings: [], evidence: [best.file] };
+    return { manager: best.manager, confidence: 'manifest', warnings: [], evidence: [best.file], share: best.share };
 }
 function resolveWorkspaceManager(workspace) {
     const warnings = [];
@@ -156,7 +156,24 @@ async function detectPackageManager(ctx) {
      * prefer: a repository whose only manifest is a package.json is an npm repository
      * however little JavaScript it has.
      */
-    const nodeOrPythonIsTheProduct = (0, languageShare_1.languageShare)(ctx, /\.(ts|tsx|js|jsx|mjs|cjs|py)$/) >= languageShare_1.MINIMUM_LANGUAGE_SHARE;
+    const nodeOrPythonShare = (0, languageShare_1.languageShare)(ctx, /\.(ts|tsx|js|jsx|mjs|cjs|py)$/);
+    /**
+     * And clearing the line is not the same as winning.
+     *
+     * The test above asks whether Node is a real part of the repository, and the
+     * question is which manifest builds the *product*. Firefly III is 1748 PHP files
+     * and 221 of JavaScript — eleven per cent, comfortably over the line — and it is a
+     * Laravel application whose package.json runs Vite over its frontend assets. The
+     * report said "Package manager: npm (lockfile)" about a project installed with
+     * Composer.
+     *
+     * Where both manifests clear the line, the larger language decides, which is the
+     * comparison the other manifests already make among themselves. Below the line
+     * nothing changes, and a repository whose only manifest is a package.json is an npm
+     * repository however little JavaScript it has.
+     */
+    const nodeOrPythonIsTheProduct = nodeOrPythonShare >= languageShare_1.MINIMUM_LANGUAGE_SHARE
+        && nodeOrPythonShare >= (otherManifest?.share ?? 0);
     const selected = fromWorkspaces
         && fromWorkspaces.manager !== 'unknown'
         && (nodeOrPythonIsTheProduct || !otherManifest)

package/dist/analyzer/detectSecurity.js

@@ -11,6 +11,23 @@ const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
+/** The cloud SDKs' names for a bucket's own cross-origin rules. */
+const CLOUD_STORAGE_CORS = /\bStorageCorsRule\b|\bCorsRules\b|\bCORSRule\b|\bCORSConfiguration\b|\bsetCorsConfiguration\b/;
+/**
+ * Whether this line sits inside one of those rules.
+ *
+ * The type is named where the object is opened and the origins are listed a few lines
+ * further in — bitwarden's `CorsRules.Add(new StorageCorsRule` is two lines above its
+ * `AllowedOrigins`. A short window rather than the whole file, because the names are
+ * specific enough to be decisive and a file-wide test would excuse a real policy that
+ * happens to share a file with a bucket's.
+ */
+const CLOUD_STORAGE_CORS_WINDOW = 5;
+function namesACloudStorageRule(text, line) {
+    const lines = text.split(/\r?\n/);
+    const from = Math.max(0, line - 1 - CLOUD_STORAGE_CORS_WINDOW);
+    return lines.slice(from, line).some((candidate) => CLOUD_STORAGE_CORS.test(candidate));
+}
 /**
  * The same line, allowing everyone.
  *
@@ -454,6 +471,22 @@ async function detectSecurity(ctx) {
         // allowlist made a wildcard read as restricted; and it cited line 1, which in
         // every repository that triggered it was an import.
         for (const m of (0, textSearch_1.matchLines)(text, ORIGIN_HANDLING, file)) {
+            /**
+             * A bucket's CORS is not the application's CORS.
+             *
+             * bitwarden's Aspire host configures the local Azurite storage emulator with
+             * `AllowedOrigins = [new BicepValue<string>("*")]` inside a `StorageCorsRule`,
+             * and that one line made a `high` finding out of an API whose actual policy is
+             * `SetIsOriginAllowed(o => CoreHelpers.IsCorsOriginAllowed(o, globalSettings))`
+             * — a function deciding, cited two lines below it in the same report.
+             *
+             * The subject is different, not the severity: a storage account, a bucket or a
+             * CDN distribution answers for the objects it serves, and this check is about
+             * the requests this application answers. `StorageCorsRule`, `CorsRules` and S3's
+             * `CORSRule` are type names from the cloud SDKs, so they are the anchor.
+             */
+            if (namesACloudStorageRule(text, m.line))
+                continue;
             if (WILDCARD_ORIGIN.test(m.snippet))
                 corsLoose.push(m);
             else if (allowsAChosenOrigin(m.snippet, text))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {