@profullstack/threatcrush 0.7.0 → 0.7.1

package/dist/index.js

@@ -9580,111 +9580,7 @@ function workerId() {
   return `${import_node_os3.default.hostname()}/${process.pid}`;
 }
 
-// src/scan/dependencies.ts
-var import_node_fs5 = require("fs");
-var import_node_path2 = require("path");
-var LOCKFILES = [
-  { file: "package-lock.json", ecosystem: "npm" },
-  { file: "pnpm-lock.yaml", ecosystem: "npm" },
-  { file: "yarn.lock", ecosystem: "npm" },
-  { file: "requirements.txt", ecosystem: "PyPI" },
-  { file: "Pipfile.lock", ecosystem: "PyPI" }
-];
-var MAX_DEPS_PER_LOCKFILE = 50;
-async function scanDependencies(targetPath) {
-  const findings = [];
-  for (const { file, ecosystem } of LOCKFILES) {
-    const lockPath = (0, import_node_path2.join)(targetPath, file);
-    if (!(0, import_node_fs5.existsSync)(lockPath)) continue;
-    let deps;
-    try {
-      deps = parseDependencies(lockPath, file);
-    } catch {
-      continue;
-    }
-    for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
-      let vulns;
-      try {
-        vulns = await queryOsv(dep.name, dep.version, ecosystem);
-      } catch {
-        continue;
-      }
-      for (const vuln of vulns) {
-        const cvss = vuln.severity?.find((entry) => entry.type === "CVSS_V3")?.score;
-        findings.push({
-          ruleId: "dependency-known-vulnerability",
-          title: "Dependency CVE",
-          file,
-          line: 1,
-          severity: severityFromCvss(cvss),
-          confidence: "evidence",
-          message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,
-          consequence: "A published advisory exists for the exact version resolved in this lockfile.",
-          excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ""}`,
-          category: "dependency"
-        });
-      }
-    }
-  }
-  return findings;
-}
-function severityFromCvss(score) {
-  if (!score) return "medium";
-  const value = Number.parseFloat(score);
-  if (Number.isNaN(value)) return "medium";
-  if (value >= 9) return "critical";
-  if (value >= 7) return "high";
-  if (value >= 4) return "medium";
-  return "low";
-}
-function parseDependencies(lockPath, filename) {
-  const deps = [];
-  if (filename === "package-lock.json") {
-    const lock = JSON.parse((0, import_node_fs5.readFileSync)(lockPath, "utf-8"));
-    const packages = lock.packages ?? lock.dependencies ?? {};
-    for (const [key, value] of Object.entries(packages)) {
-      const name = key.replace(/^node_modules\//, "");
-      const version = value?.version;
-      if (name && version && !name.startsWith(".")) deps.push({ name, version });
-    }
-    return deps;
-  }
-  if (filename === "requirements.txt") {
-    for (const line of (0, import_node_fs5.readFileSync)(lockPath, "utf-8").split("\n")) {
-      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
-      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
-    }
-  }
-  return deps;
-}
-function isValidPackageName(name) {
-  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
-}
-function isValidVersion(version) {
-  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
-}
-async function queryOsv(name, version, ecosystem) {
-  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
-  try {
-    const response = await fetch("https://api.osv.dev/v1/query", {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ package: { name, ecosystem }, version }),
-      signal: AbortSignal.timeout(5e3)
-    });
-    if (!response.ok) return [];
-    const data = await response.json();
-    return data.vulns ?? [];
-  } catch {
-    return [];
-  }
-}
-
-// src/scan/engine.ts
-var import_node_fs6 = require("fs");
-var import_node_path3 = require("path");
-
-// src/scan/types.ts
+// ../../packages/scan/src/types.ts
 var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
 function severityRank(severity) {
   const index = SEVERITY_ORDER.indexOf(severity);
@@ -9695,7 +9591,7 @@ function severityFor(declared, confidence) {
   return severityRank(declared) > severityRank("medium") ? "medium" : declared;
 }
 
-// src/scan/code-rules.ts
+// ../../packages/scan/src/code-rules.ts
 var UNTRUSTED_JS = /\b(?:req|request|ctx|context)\s*\.\s*(?:body|query|params|param|headers|cookies|url|files)\b|\bprocess\.argv\b|\bwindow\.location\b|\bdocument\.location\b|\blocation\.(?:search|hash|href)\b|\bsearchParams\s*\.\s*(?:get|getAll|has|entries|keys|values|forEach)\b|\bgetParameter\s*\(|\bgetQueryString\s*\(|\bgetInputStream\s*\(/;
 var UNTRUSTED_PY = /\brequest\b|\bparams\b|\bflask\b|\bsys\.argv\b|\bos\.environ\b\s*\[/;
 var UNTRUSTED_RB = /\bparams\s*\[|\brequest\b|\bcookies\s*\[/;
@@ -10079,6 +9975,7 @@ var CODE_RULES = [
   },
   {
     id: "tls-verification-disabled",
+    inherent: true,
     title: "TLS certificate verification disabled",
     consequence: "Every connection made this way is trivially interceptable; the encryption is decorative.",
     cwe: "CWE-295",
@@ -10172,6 +10069,7 @@ var CODE_RULES = [
   // of privileged work actually happens, and they run as whoever invoked them.
   {
     id: "sh-remote-script-execution",
+    inherent: true,
     title: "network output piped into a shell",
     consequence: "Whatever that URL serves at the moment this runs is executed as the invoking user. There is no version, no signature, and no review \u2014 a compromise of the host, or anyone able to answer for it, is a compromise of every machine that runs the script.",
     cwe: "CWE-494",
@@ -10227,6 +10125,7 @@ var CODE_RULES = [
   },
   {
     id: "sh-insecure-transport-flag",
+    inherent: true,
     title: "certificate verification disabled",
     consequence: "Anyone positioned between this host and the server can substitute the response. When the response is a package, a key or a script, that is remote code execution with the transport doing nothing to stop it.",
     cwe: "CWE-295",
@@ -10241,6 +10140,7 @@ var CODE_RULES = [
   },
   {
     id: "sh-plaintext-download",
+    inherent: true,
     title: "download over plain HTTP",
     consequence: "The response arrives unauthenticated over a channel any intermediary can rewrite. Where the payload is an archive, a package list or a key, substituting it is straightforward and leaves nothing for the script to notice.",
     cwe: "CWE-319",
@@ -10252,6 +10152,7 @@ var CODE_RULES = [
   },
   {
     id: "sh-world-writable-permissions",
+    inherent: true,
     title: "world-writable permissions",
     consequence: "Any local account can rewrite the file. If it is a script, a config or anything on a privileged path, the next process to read it runs someone else\u2019s content.",
     cwe: "CWE-732",
@@ -10417,6 +10318,7 @@ var CODE_RULES = [
   },
   {
     id: "java-broken-cipher",
+    inherent: true,
     title: "broken cipher or ECB mode",
     consequence: "DES, RC2, RC4 and Blowfish are broken or too small to rely on. ECB encrypts identical plaintext blocks to identical ciphertext blocks, so structure in the data survives encryption and is readable straight off the ciphertext.",
     cwe: "CWE-327",
@@ -10503,6 +10405,9 @@ function fileTextOf(lines) {
   }
   return text;
 }
+function withoutSingleQuoted(text) {
+  return text.replace(/'[^'\n]*'/g, "''");
+}
 function evaluateRule(rule, ctx) {
   if (rule.languages && !rule.languages.includes(ctx.language)) return null;
   const line = ctx.lines[ctx.index] ?? "";
@@ -10517,13 +10422,15 @@ function evaluateRule(rule, ctx) {
   const guard = rule.guard === void 0 ? GENERIC_GUARD : rule.guard;
   if (guard && (guard.test(line) || guard.test(context))) return null;
   const untrusted = untrustedPatternFor(ctx.language);
-  const contextual = untrusted.test(line) || untrusted.test(context);
+  const probeLine = ctx.language === "shell" ? withoutSingleQuoted(line) : line;
+  const probeContext = ctx.language === "shell" ? withoutSingleQuoted(context) : context;
+  const contextual = untrusted.test(probeLine) || untrusted.test(probeContext);
   if (rule.needsContext && !contextual) return null;
-  const confidence = contextual ? "contextual" : "pattern";
+  const confidence = rule.inherent ? "evidence" : contextual ? "contextual" : "pattern";
   return { rule, confidence, severity: severityFor(rule.severity, confidence) };
 }
 
-// src/scan/manifest-rules.ts
+// ../../packages/scan/src/manifest-rules.ts
 var POPULAR_NPM = [
   "react",
   "react-dom",
@@ -10798,7 +10705,7 @@ function scanRequirementsTxt(text) {
   return findings;
 }
 
-// src/scan/secret-rules.ts
+// ../../packages/scan/src/secret-rules.ts
 var SECRET_RULES = [
   {
     id: "secret-aws-access-key",
@@ -10981,7 +10888,15 @@ var SENSITIVE_FILES = [
   // match. Reporting the file itself trades a real finding for a chore.
 ];
 
-// src/scan/engine.ts
+// ../../packages/scan/src/text.ts
+function baseNameOf(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function extensionOf(path) {
+  const base = baseNameOf(path);
+  const dot = base.lastIndexOf(".");
+  return dot <= 0 ? "" : base.slice(dot);
+}
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -11090,7 +11005,7 @@ var LANGUAGE_BY_EXTENSION = {
 };
 function languageOf(filename) {
   if (filename.startsWith(".env") || filename.endsWith(".env")) return "config";
-  return LANGUAGE_BY_EXTENSION[(0, import_node_path3.extname)(filename).toLowerCase()] ?? "other";
+  return LANGUAGE_BY_EXTENSION[extensionOf(filename).toLowerCase()] ?? "other";
 }
 var LANGUAGE_BY_INTERPRETER = {
   sh: "shell",
@@ -11110,10 +11025,12 @@ var LANGUAGE_BY_INTERPRETER = {
   php: "php"
 };
 function languageOfShebang(firstLine) {
-  const match = /^#!\s*(\S+)(?:\s+(\S+))?/.exec(firstLine);
+  const match = /^#!\s*(\S+)(?:\s+(.+?))?\s*$/.exec(firstLine);
   if (!match) return null;
-  const command = (0, import_node_path3.basename)(match[1]);
-  const name = command === "env" && match[2] ? (0, import_node_path3.basename)(match[2]) : command;
+  const command = baseNameOf(match[1]);
+  const args = match[2]?.trim().split(/\s+/) ?? [];
+  const splitString = args[0] === "-S" || args[0] === "--split-string";
+  const name = command === "env" ? baseNameOf(args[splitString ? 1 : 0] ?? "") : command;
   const exact = LANGUAGE_BY_INTERPRETER[name];
   if (exact) return exact;
   const stripped = name.replace(/[\d.]+$/, "");
@@ -11215,6 +11132,15 @@ function scanManifest(relativePath, filename, text) {
     category: "manifest"
   }));
 }
+function meetsFailThreshold(findings, threshold) {
+  if (threshold.length === 0) return false;
+  const floor = Math.min(...threshold.map(severityRank));
+  return findings.some((finding) => severityRank(finding.severity) >= floor);
+}
+
+// ../../packages/scan/src/node/walk.ts
+var import_node_fs5 = require("fs");
+var import_node_path2 = require("path");
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -11224,15 +11150,15 @@ function scanPath(targetPath, options = {}) {
   let suppressed = 0;
   const rootIsDirectory = (() => {
     try {
-      return (0, import_node_fs6.statSync)(targetPath).isDirectory();
+      return (0, import_node_fs5.statSync)(targetPath).isDirectory();
     } catch {
       return true;
     }
   })();
-  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path3.dirname)(targetPath);
+  const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path2.dirname)(targetPath);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
-    const extension = (0, import_node_path3.extname)(filename).toLowerCase();
+    const extension = (0, import_node_path2.extname)(filename).toLowerCase();
     const isManifest = filename === "package.json" || filename === "requirements.txt";
     const scannable = SCAN_EXTENSIONS.has(extension) || filename.startsWith(".env");
     const mayDeclareInterpreter = !scannable && !isManifest && extension === "";
@@ -11244,26 +11170,26 @@ function scanPath(targetPath, options = {}) {
     let handle;
     let declared = null;
     try {
-      handle = (0, import_node_fs6.openSync)(fullPath, "r");
+      handle = (0, import_node_fs5.openSync)(fullPath, "r");
     } catch {
       unreadable.push(relativePath);
       return;
     }
     try {
-      if ((0, import_node_fs6.fstatSync)(handle).size > maxFileBytes) return;
+      if ((0, import_node_fs5.fstatSync)(handle).size > maxFileBytes) return;
       if (mayDeclareInterpreter) {
         const prefix = Buffer.alloc(128);
-        const read = (0, import_node_fs6.readSync)(handle, prefix, 0, prefix.length, 0);
+        const read = (0, import_node_fs5.readSync)(handle, prefix, 0, prefix.length, 0);
         declared = languageOfShebang(prefix.subarray(0, read).toString("utf-8").split("\n", 1)[0] ?? "");
         if (!declared) return;
       }
-      text = (0, import_node_fs6.readFileSync)(handle, "utf-8");
+      text = (0, import_node_fs5.readFileSync)(handle, "utf-8");
     } catch {
       unreadable.push(relativePath);
       return;
     } finally {
       try {
-        (0, import_node_fs6.closeSync)(handle);
+        (0, import_node_fs5.closeSync)(handle);
       } catch {
       }
     }
@@ -11280,13 +11206,13 @@ function scanPath(targetPath, options = {}) {
   const walk = (currentPath) => {
     let entries;
     try {
-      entries = (0, import_node_fs6.readdirSync)(currentPath, { withFileTypes: true });
+      entries = (0, import_node_fs5.readdirSync)(currentPath, { withFileTypes: true });
     } catch {
       unreadable.push(toRelative(walkRoot, currentPath));
       return;
     }
     for (const entry of entries) {
-      const fullPath = (0, import_node_path3.join)(currentPath, entry.name);
+      const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         walk(fullPath);
@@ -11299,7 +11225,7 @@ function scanPath(targetPath, options = {}) {
   if (rootIsDirectory) {
     walk(targetPath);
   } else {
-    scanFile(targetPath, (0, import_node_path3.basename)(targetPath));
+    scanFile(targetPath, (0, import_node_path2.basename)(targetPath));
   }
   const filtered = allowed ? findings.filter((f) => allowed.has(f.category)) : findings;
   filtered.sort(
@@ -11330,16 +11256,111 @@ function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   }
 }
 function toRelative(base, target) {
-  const rel = (0, import_node_path3.relative)(base, target);
-  return (rel === "" ? target : rel).split(import_node_path3.sep).join("/");
+  const rel = (0, import_node_path2.relative)(base, target);
+  return (rel === "" ? target : rel).split(import_node_path2.sep).join("/");
 }
-function meetsFailThreshold(findings, threshold) {
-  if (threshold.length === 0) return false;
-  const floor = Math.min(...threshold.map(severityRank));
-  return findings.some((finding) => severityRank(finding.severity) >= floor);
+
+// ../../packages/scan/src/node/dependencies.ts
+var import_node_fs6 = require("fs");
+var import_node_path3 = require("path");
+var LOCKFILES = [
+  { file: "package-lock.json", ecosystem: "npm" },
+  { file: "pnpm-lock.yaml", ecosystem: "npm" },
+  { file: "yarn.lock", ecosystem: "npm" },
+  { file: "requirements.txt", ecosystem: "PyPI" },
+  { file: "Pipfile.lock", ecosystem: "PyPI" }
+];
+var MAX_DEPS_PER_LOCKFILE = 50;
+async function scanDependencies(targetPath) {
+  const findings = [];
+  for (const { file, ecosystem } of LOCKFILES) {
+    const lockPath = (0, import_node_path3.join)(targetPath, file);
+    if (!(0, import_node_fs6.existsSync)(lockPath)) continue;
+    let deps;
+    try {
+      deps = parseDependencies(lockPath, file);
+    } catch {
+      continue;
+    }
+    for (const dep of deps.slice(0, MAX_DEPS_PER_LOCKFILE)) {
+      let vulns;
+      try {
+        vulns = await queryOsv(dep.name, dep.version, ecosystem);
+      } catch {
+        continue;
+      }
+      for (const vuln of vulns) {
+        const cvss = vuln.severity?.find((entry) => entry.type === "CVSS_V3")?.score;
+        findings.push({
+          ruleId: "dependency-known-vulnerability",
+          title: "Dependency CVE",
+          file,
+          line: 1,
+          severity: severityFromCvss(cvss),
+          confidence: "evidence",
+          message: `${dep.name}@${dep.version}: ${vuln.summary ?? vuln.id}`,
+          consequence: "A published advisory exists for the exact version resolved in this lockfile.",
+          excerpt: `${vuln.id}${cvss ? ` (CVSS: ${cvss})` : ""}`,
+          category: "dependency"
+        });
+      }
+    }
+  }
+  return findings;
+}
+function severityFromCvss(score) {
+  if (!score) return "medium";
+  const value = Number.parseFloat(score);
+  if (Number.isNaN(value)) return "medium";
+  if (value >= 9) return "critical";
+  if (value >= 7) return "high";
+  if (value >= 4) return "medium";
+  return "low";
+}
+function parseDependencies(lockPath, filename) {
+  const deps = [];
+  if (filename === "package-lock.json") {
+    const lock = JSON.parse((0, import_node_fs6.readFileSync)(lockPath, "utf-8"));
+    const packages = lock.packages ?? lock.dependencies ?? {};
+    for (const [key, value] of Object.entries(packages)) {
+      const name = key.replace(/^node_modules\//, "");
+      const version = value?.version;
+      if (name && version && !name.startsWith(".")) deps.push({ name, version });
+    }
+    return deps;
+  }
+  if (filename === "requirements.txt") {
+    for (const line of (0, import_node_fs6.readFileSync)(lockPath, "utf-8").split("\n")) {
+      const match = /^([a-zA-Z0-9_.-]+)==([0-9.]+)/.exec(line);
+      if (match?.[1] && match[2]) deps.push({ name: match[1], version: match[2] });
+    }
+  }
+  return deps;
+}
+function isValidPackageName(name) {
+  return /^[@a-zA-Z0-9_.\-/]{1,214}$/.test(name);
+}
+function isValidVersion(version) {
+  return /^[0-9a-zA-Z._\-+]{1,50}$/.test(version);
+}
+async function queryOsv(name, version, ecosystem) {
+  if (!isValidPackageName(name) || !isValidVersion(version)) return [];
+  try {
+    const response = await fetch("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ package: { name, ecosystem }, version }),
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!response.ok) return [];
+    const data = await response.json();
+    return data.vulns ?? [];
+  } catch {
+    return [];
+  }
 }
 
-// src/scan/sarif.ts
+// ../../packages/scan/src/node/sarif.ts
 var import_node_crypto = require("crypto");
 var import_node_path4 = require("path");
 var FINGERPRINT_KEY = "threatcrush/contentHash/v1";