@produtype/core 1.7.1 → 1.8.1

package/dist/analyzer/catalogue.js

@@ -104,7 +104,20 @@ exports.JVM_DATABASES = [
 ];
 /** Ruby frameworks, read from the Gemfile. */
 exports.RUBY_BACKEND_FRAMEWORKS = [
-    ['rails', ['rails']],
+    /**
+     * Rails is often declared by its parts rather than by its name.
+     *
+     * Discourse's Gemfile has no `gem "rails"` in it at all: it pins `actionpack`,
+     * `actionview`, `activerecord` and `railties` separately, which is what a large
+     * application does when it wants to control the pieces. The report said
+     * `backend: ruby` — the fallback for a Gemfile with no web framework in it — about
+     * the best-known Rails application there is.
+     *
+     * `railties` is the framework itself and nothing but Rails and its engines depends
+     * on it; `actionpack` is the half that handles requests. Both are names the Rails
+     * team chose, which is the whole argument.
+     */
+    ['rails', ['rails', 'railties', 'actionpack']],
     ['sinatra', ['sinatra']],
     ['hanami', ['hanami']],
     ['roda', ['roda']],

package/dist/analyzer/detectBilling.js

@@ -12,7 +12,24 @@ async function detectBilling(ctx) {
     const hasStripeDep = (0, detectContext_1.hasDep)(ctx, 'stripe');
     if (hasStripeDep)
         evidence.push({ type: 'dependency', value: 'stripe' });
-    const stripeContextHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+    /**
+     * Laravel's table of service credentials, which is a list of slots.
+     *
+     * `config/services.php` ships with the framework and holds a block per service the
+     * skeleton knows about — mailgun, postmark, ses, and for years a `stripe` one
+     * reading `env('STRIPE_KEY')`. Firefly III still carries it, beside sparkpost,
+     * mandrill and pushover, and takes no payments at all: no processor package in its
+     * composer.json, no charge anywhere. It was reported at `medium` for an unhardened
+     * billing webhook, and the rest of that finding was its own webhooks feature —
+     * notifications a *user* registers to hear about their transactions, which point
+     * the other way entirely.
+     *
+     * An entry there is a slot the deployment may fill, not an integration this project
+     * has. A project that charges people declares `stripe/stripe-php` or
+     * `laravel/cashier`, and that is read from the manifest a few lines down.
+     */
+    const LARAVEL_SERVICE_SLOTS = /(^|\/)config\/services\.php$/;
+    const stripeContextHits = (await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /**
          * The bare word is not here, on purpose.
          *
@@ -38,7 +55,7 @@ async function detectBilling(ctx) {
         /stripeSubscriptionId/i,
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
-    ], 30);
+    ], 30)).filter((hit) => !LARAVEL_SERVICE_SLOTS.test(hit.file));
     /**
      * The processor, declared wherever this project declares its dependencies.
      *

package/dist/analyzer/detectPackageManager.js

@@ -97,7 +97,7 @@ function resolveFromOtherManifests(ctx) {
     const best = pool.reduce((winner, candidate) => candidate.depth < winner.depth || (candidate.depth === winner.depth && candidate.order < winner.order)
         ? candidate
         : winner);
-    return { manager: best.manager, confidence: 'manifest', warnings: [], evidence: [best.file] };
+    return { manager: best.manager, confidence: 'manifest', warnings: [], evidence: [best.file], share: best.share };
 }
 function resolveWorkspaceManager(workspace) {
     const warnings = [];
@@ -156,7 +156,24 @@ async function detectPackageManager(ctx) {
      * prefer: a repository whose only manifest is a package.json is an npm repository
      * however little JavaScript it has.
      */
-    const nodeOrPythonIsTheProduct = (0, languageShare_1.languageShare)(ctx, /\.(ts|tsx|js|jsx|mjs|cjs|py)$/) >= languageShare_1.MINIMUM_LANGUAGE_SHARE;
+    const nodeOrPythonShare = (0, languageShare_1.languageShare)(ctx, /\.(ts|tsx|js|jsx|mjs|cjs|py)$/);
+    /**
+     * And clearing the line is not the same as winning.
+     *
+     * The test above asks whether Node is a real part of the repository, and the
+     * question is which manifest builds the *product*. Firefly III is 1748 PHP files
+     * and 221 of JavaScript — eleven per cent, comfortably over the line — and it is a
+     * Laravel application whose package.json runs Vite over its frontend assets. The
+     * report said "Package manager: npm (lockfile)" about a project installed with
+     * Composer.
+     *
+     * Where both manifests clear the line, the larger language decides, which is the
+     * comparison the other manifests already make among themselves. Below the line
+     * nothing changes, and a repository whose only manifest is a package.json is an npm
+     * repository however little JavaScript it has.
+     */
+    const nodeOrPythonIsTheProduct = nodeOrPythonShare >= languageShare_1.MINIMUM_LANGUAGE_SHARE
+        && nodeOrPythonShare >= (otherManifest?.share ?? 0);
     const selected = fromWorkspaces
         && fromWorkspaces.manager !== 'unknown'
         && (nodeOrPythonIsTheProduct || !otherManifest)

package/dist/analyzer/detectSecurity.js

@@ -11,6 +11,23 @@ const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
+/** The cloud SDKs' names for a bucket's own cross-origin rules. */
+const CLOUD_STORAGE_CORS = /\bStorageCorsRule\b|\bCorsRules\b|\bCORSRule\b|\bCORSConfiguration\b|\bsetCorsConfiguration\b/;
+/**
+ * Whether this line sits inside one of those rules.
+ *
+ * The type is named where the object is opened and the origins are listed a few lines
+ * further in — bitwarden's `CorsRules.Add(new StorageCorsRule` is two lines above its
+ * `AllowedOrigins`. A short window rather than the whole file, because the names are
+ * specific enough to be decisive and a file-wide test would excuse a real policy that
+ * happens to share a file with a bucket's.
+ */
+const CLOUD_STORAGE_CORS_WINDOW = 5;
+function namesACloudStorageRule(text, line) {
+    const lines = text.split(/\r?\n/);
+    const from = Math.max(0, line - 1 - CLOUD_STORAGE_CORS_WINDOW);
+    return lines.slice(from, line).some((candidate) => CLOUD_STORAGE_CORS.test(candidate));
+}
 /**
  * The same line, allowing everyone.
  *
@@ -454,6 +471,22 @@ async function detectSecurity(ctx) {
         // allowlist made a wildcard read as restricted; and it cited line 1, which in
         // every repository that triggered it was an import.
         for (const m of (0, textSearch_1.matchLines)(text, ORIGIN_HANDLING, file)) {
+            /**
+             * A bucket's CORS is not the application's CORS.
+             *
+             * bitwarden's Aspire host configures the local Azurite storage emulator with
+             * `AllowedOrigins = [new BicepValue<string>("*")]` inside a `StorageCorsRule`,
+             * and that one line made a `high` finding out of an API whose actual policy is
+             * `SetIsOriginAllowed(o => CoreHelpers.IsCorsOriginAllowed(o, globalSettings))`
+             * — a function deciding, cited two lines below it in the same report.
+             *
+             * The subject is different, not the severity: a storage account, a bucket or a
+             * CDN distribution answers for the objects it serves, and this check is about
+             * the requests this application answers. `StorageCorsRule`, `CorsRules` and S3's
+             * `CORSRule` are type names from the cloud SDKs, so they are the anchor.
+             */
+            if (namesACloudStorageRule(text, m.line))
+                continue;
             if (WILDCARD_ORIGIN.test(m.snippet))
                 corsLoose.push(m);
             else if (allowsAChosenOrigin(m.snippet, text))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {