@produtype/core 1.9.3 → 1.11.0

package/dist/analyzer/detectSecurity.js

@@ -180,6 +180,16 @@ const RATE_LIMIT_PACKAGES = [
     'koa-ratelimit',
     'fastify-rate-limit',
     '@fastify/rate-limit',
+    /**
+     * Nest's own, which is a module and a guard rather than a middleware function.
+     *
+     * ghostfolio registers `ThrottlerModule.forRootAsync` and puts a
+     * `CustomThrottlerGuard` on its sign-in route, and was told at `medium` that it has
+     * no rate limiting at all. The package name is Nest's; what the guard is called is
+     * ghostfolio's business.
+     */
+    '@nestjs/throttler',
+    '@nest-lab/throttler-storage-redis',
 ];
 async function detectSecurity(ctx) {
     const evidence = [];
@@ -310,6 +320,7 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, '@upstash/ratelimit') ||
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
+        (0, detectContext_1.hasDep)(ctx, '@nestjs/throttler') ||
         (0, detectContext_1.hasAnyPyDep)(ctx, ['django-ratelimit', 'slowapi', 'flask-limiter']).length > 0 ||
         (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0 ||
         /**
@@ -437,7 +448,22 @@ async function detectSecurity(ctx) {
      * project's authentication surface. Per pattern, the decisive search keeps its own
      * budget however much noise the others find.
      */
-    const AUTH_SURFACE_PATTERNS = [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/];
+    /**
+     * A route decorator writes the path without a leading slash.
+     *
+     * Every pattern here wanted `'/login'`, and NestJS writes `@Controller('auth')` and
+     * `@Post('login')` — the slash belongs to the router, not to the string. ghostfolio
+     * throttles its sign-in with a `CustomThrottlerGuard` two lines under
+     * `@Controller('auth')`, and `auth.controller.ts` was not in this set at all: four
+     * files were, none of them the controller, and the report said the product has no
+     * rate limiting.
+     *
+     * The decorator name is the anchor. Dropping the slash from the plain pattern
+     * instead would have let every `from './auth'` into the authentication surface, and
+     * that surface decides what counts as protecting a sign-in.
+     */
+    const ROUTE_DECORATOR = /@(?:Controller|Post|Get|Put|Patch|All|RequestMapping)\(\s*(?:value\s*=\s*)?['"`]\/?(?:login|signin|sign-in|auth|session)/i;
+    const AUTH_SURFACE_PATTERNS = [/['"`]\/(login|signin|sign-in|auth|session)/i, ROUTE_DECORATOR, /passport\./, /signIn\s*\(/, /authenticate\s*\(/];
     const authSurfaceFiles = new Set();
     for (const pattern of AUTH_SURFACE_PATTERNS) {
         for (const match of await (0, textSearch_1.searchInFiles)(ctx.root, source, [pattern], 40))
@@ -477,6 +503,7 @@ async function detectSecurity(ctx) {
      * limiter package at all. A schema field is neither.
      */
     const AUTH_ROUTE_DECLARATION = /['"`]\/(?:login|signin|sign-in|sessions?|auth\/login)['"`]/i;
+    const DECLARES_AN_AUTH_ROUTE = (line) => AUTH_ROUTE_DECLARATION.test(line) || ROUTE_DECORATOR.test(line);
     const LIMIT_IN_ROUTE_OPTIONS = /rate[_-]?limit|throttle/i;
     const ROUTE_OPTIONS_WINDOW = 8;
     const limitedAuthRoutes = [];
@@ -487,7 +514,7 @@ async function detectSecurity(ctx) {
                 continue;
             const lines = text.split(/\r?\n/);
             for (let i = 0; i < lines.length; i++) {
-                if (!AUTH_ROUTE_DECLARATION.test(lines[i]))
+                if (!DECLARES_AN_AUTH_ROUTE(lines[i]))
                     continue;
                 const window = lines.slice(i + 1, i + 1 + ROUTE_OPTIONS_WINDOW);
                 const offset = window.findIndex((line) => LIMIT_IN_ROUTE_OPTIONS.test(line));
@@ -501,8 +528,33 @@ async function detectSecurity(ctx) {
     for (const hit of limitedAuthRoutes.slice(0, 3)) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line, claim: 'rate-limit' });
     }
+    /**
+     * A guard is applied to a class, not to a line.
+     *
+     * ghostfolio puts `@UseGuards(CustomThrottlerGuard)` on three routes of
+     * `auth.controller.ts`, nine lines below `@Controller('auth')` — one past the window
+     * that reads a route's own options, and that window is the wrong question anyway. A
+     * Nest guard protects the handler it decorates, wherever in the class it sits.
+     *
+     * `Throttler` is the word `@nestjs/throttler` exports; what the guard wrapping it is
+     * called is the author's business. So the claim is narrow: the package is declared,
+     * and its name appears in a file this analyzer already established as the
+     * authentication surface.
+     *
+     * Matched without word boundaries and without case, because the author's name for it
+     * wraps the package's: `CustomThrottlerGuard` has no boundary before `Throttler`,
+     * and `custom-throttler.guard` spells it in lower case. The first version of this
+     * rule asked for `\bThrottler` and found neither.
+     */
+    const nestThrottler = (0, detectContext_1.hasDep)(ctx, '@nestjs/throttler')
+        ? (await (0, textSearch_1.searchInFiles)(ctx.root, source, [/throttler/i], 20)).filter((hit) => authSurfaceFiles.has(hit.file))
+        : [];
+    for (const hit of nestThrottler.slice(0, 2)) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line, claim: 'rate-limit' });
+    }
     const rateLimitNearAuth = coversAnAuthMount
         || limitedAuthRoutes.length > 0
+        || nestThrottler.length > 0
         || (boundLimiterUses ?? []).some((use) => authSurfaceFiles.has(use.file))
         || issuedRateLimits.some((match) => authSurfaceFiles.has(match.file));
     if (helmetDep)
@@ -639,6 +691,26 @@ async function detectSecurity(ctx) {
         corsLoose.push(...detected.loose);
         corsStrict.push(...detected.strict);
     }
+    /**
+     * NestJS turns it on with a method of its own.
+     *
+     * `app.enableCors()` is how a Nest application does this, and bare — with no
+     * argument — it is Nest's default, which is every origin. ghostfolio calls exactly
+     * that in `apps/api/src/main.ts`, and the one line the report cited was
+     * `allowedOrigins: [hostname]` in an MCP module twelve directories away: an
+     * allowlist, while the whole API answers anybody.
+     *
+     * `enableCors` is the framework's name for the method, so it is the anchor. An
+     * argument means somebody chose something and the choice is read the same way as
+     * everywhere else here — a literal `'*'` is open, anything else is a decision this
+     * search cannot settle and says so.
+     */
+    const nestCors = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/\.enableCors\s*\(/], 5);
+    for (const hit of nestCors) {
+        const argument = /\.enableCors\s*\(\s*([^)]*)/.exec(hit.snippet)?.[1]?.trim() ?? '';
+        const wideOpen = argument === '' || /^["']\*["']/.test(argument) || /origin\s*:\s*["']\*["']/.test(argument);
+        (wideOpen ? corsLoose : corsStrict).push(hit);
+    }
     /**
      * Django's answer, which is a string in a list.
      *

package/dist/rules/rules.js

@@ -404,7 +404,18 @@ exports.rules = [
         category: 'security',
         severity: 'medium',
         evaluate: ({ analysis }) => {
-            const isExpress = analysis.stack.backend.includes('express');
+            /**
+             * The backends this check can actually read.
+             *
+             * It was `express` alone, and said so in its own unknown sentence — the
+             * coverage reading follows `app.use('/api', limiter)`, which is Express. Two
+             * readers have joined it since: a limit declared in a route's own options, and
+             * a Nest guard applied in the controller that declares the sign-in. A NestJS
+             * application that does not also declare express — which is most of them, since
+             * `@nestjs/platform-express` is the adapter rather than the framework — got no
+             * verdict at all, on a capability this analyzer can now read there.
+             */
+            const readableBackend = ['express', 'nestjs'].some((name) => analysis.stack.backend.includes(name));
             const auth = analysis.detectors['auth.core'];
             const sec = analysis.detectors['security.core'];
             const hasAuth = Boolean(auth?.present);
@@ -427,7 +438,7 @@ exports.rules = [
              * showed it.
              */
             const coverageUnasked = Boolean(sec?.details?.rateLimitCoverageUnasked);
-            const status = !isExpress || !hasAuth
+            const status = !readableBackend || !hasAuth
                 ? 'unknown'
                 : nearAuth ? 'passed' : coverageUnasked && hasRate ? 'unknown' : hasRate ? 'partial' : 'missing';
             return mkFinding({
@@ -452,7 +463,7 @@ exports.rules = [
                                 ? 'Not assessed: this project throttles something, and whether it reaches the login is read from where the limiter is mounted — which needs the optional `typescript` peer dependency. Install it and re-run.'
                                 : !hasAuth
                                     ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
-                                    : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
+                                    : 'This check reads Express and NestJS, and this project uses neither — any throttling it has is somewhere this cannot see.',
                 recommendation: 'Apply express-rate-limit (or equivalent) to login/register/password reset endpoints.',
                 /**
                  * The claim is about rate limiting, so the evidence is about rate limiting.

package/dist/utils/textSearch.js

@@ -127,6 +127,54 @@ function isCitableLine(line) {
  * on is not worth the one it displaces.
  */
 const MAX_CITABLE_LINE = 500;
+/**
+ * A placeholder is not a value.
+ *
+ * pocketbase was reported as having tenant boundaries — `passed`, which raises a
+ * score — and the only two strong matches in its readable source were
+ * `"Ex. https://login.microsoftonline.com/YOUR_DIRECTORY_TENANT_ID/oauth2/v2.0/authorize"`,
+ * twice, in the help text of the form where somebody configures Microsoft sign-in.
+ * Microsoft Entra calls its directory a tenant; the string is telling a reader where
+ * to paste theirs. pocketbase has no organizations at all, and the rest of that
+ * finding was Apple's developer `teamId`, a weak word that cannot stand alone.
+ *
+ * `YOUR_SOMETHING` is the convention for "replace this", in documentation, in example
+ * configuration and in the help text beside a field. This analyzer already knows the
+ * shape: `your[_-]?secret` has been in the weak-secret list since the beginning.
+ *
+ * The token around the match is what decides, not the line. A line may hold a
+ * placeholder and a real value both, and only the matched one is being judged.
+ */
+const PLACEHOLDER_TOKEN = /^(?:your|my|sample|example|placeholder|changeme|todo|xxx+)[_-]/i;
+function insideAPlaceholder(line, index, length) {
+    let start = index;
+    while (start > 0 && /[A-Za-z0-9_-]/.test(line[start - 1]))
+        start--;
+    let end = index + length;
+    while (end < line.length && /[A-Za-z0-9_-]/.test(line[end]))
+        end++;
+    return PLACEHOLDER_TOKEN.test(line.slice(start, end));
+}
+/**
+ * Where a needle first matches, or -1. Shared so that both searches below judge a
+ * match the same way.
+ */
+function findNeedle(line, needle) {
+    if (typeof needle === 'string') {
+        const index = line.indexOf(needle);
+        return index === -1 ? null : { index, length: needle.length };
+    }
+    const found = new RegExp(needle.source, needle.flags.replace('g', '')).exec(line);
+    return found ? { index: found.index, length: found[0].length } : null;
+}
+function matchesHere(line, needles) {
+    for (const needle of needles) {
+        const found = findNeedle(line, needle);
+        if (found && !insideAPlaceholder(line, found.index, found.length))
+            return true;
+    }
+    return false;
+}
 /**
  * The lines of one already-read file that match, with the same hygiene the file
  * search applies: no comments, no pattern tables, no minified lines.
@@ -157,12 +205,8 @@ function matchLines(text, needles, file = '') {
             continue;
         if (declaresRatherThanDoes(line))
             continue;
-        for (const n of needles) {
-            const hit = typeof n === 'string' ? line.includes(n) : n.test(line);
-            if (hit) {
-                matches.push({ file, line: i + 1, snippet: line.trim().slice(0, 200) });
-                break;
-            }
+        if (matchesHere(line, needles)) {
+            matches.push({ file, line: i + 1, snippet: line.trim().slice(0, 200) });
         }
     }
     return matches;
@@ -205,14 +249,10 @@ async function searchInFiles(root, files, needles, limit = 25, keep) {
                 continue;
             if (declaresRatherThanDoes(line))
                 continue;
-            for (const n of needles) {
-                const hit = typeof n === 'string' ? line.includes(n) : n.test(line);
-                if (hit) {
-                    const match = { file, line: i + 1, snippet: line.trim().slice(0, 200) };
-                    if (!keep || keep(match))
-                        matches.push(match);
-                    break;
-                }
+            if (matchesHere(line, needles)) {
+                const match = { file, line: i + 1, snippet: line.trim().slice(0, 200) };
+                if (!keep || keep(match))
+                    matches.push(match);
             }
             if (matches.length >= limit)
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.9.3",
+  "version": "1.11.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {