@profullstack/threatcrush 0.7.1 → 0.8.0

package/dist/daemon.js

@@ -4362,7 +4362,7 @@ var XXE_GUARD = /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-do
 var XML_PARSING_FILE = /\b(?:javax\.xml|org\.xml\.sax|org\.w3c\.dom|org\.jdom2?|org\.dom4j|XmlPullParser|DocumentBuilderFactory|DocumentBuilder|SAXParserFactory|SAXParser|XMLInputFactory|XMLReaderFactory|XMLReader|SAXBuilder|SAXReader)\b/;
 var CODE_SINK = /\bglobalThis\s*\[|\bconstructor\b|\beval\b|\bFunction\b|\brun\s*\(|\bvm\s*\.\s*run/;
 var EXFIL_SINK = /\bconsole\s*\.\s*(?:log|debug|info|warn|error)\s*\(|\bfetch\s*\(|\baxios\b|\brequest\s*\(|\.\s*send\s*\(/;
-var SQL_KEYWORDS = "SELECT|INSERT\\s+INTO|INSERT|UPDATE|DELETE\\s+FROM|DELETE|DROP|UNION\\s+SELECT";
+var SQL_KEYWORDS = "SELECT\\b(?=[^`'\"\\n]*\\bFROM\\b)|INSERT\\s+INTO|UPDATE\\b(?=[^`'\"\\n]*\\bSET\\b)|DELETE\\s+FROM|DROP\\s+(?:TABLE|DATABASE|INDEX|VIEW|SCHEMA)|TRUNCATE\\s+TABLE|UNION\\s+SELECT";
 var SQL_IN_DOUBLE = `"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*"`;
 var SQL_IN_SINGLE = `'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*'`;
 var SQL_STRING = `(?:${SQL_IN_DOUBLE}|${SQL_IN_SINGLE})`;
@@ -5866,6 +5866,81 @@ function scanManifest(relativePath, filename, text) {
 // ../../packages/scan/src/node/walk.ts
 var import_node_fs10 = require("fs");
 var import_node_path5 = require("path");
+function compileExcludes(patterns) {
+  const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
+  if (matchers.length === 0) return () => false;
+  return (relPath) => {
+    const segs = relPath.split("/");
+    return matchers.some((m) => m(segs));
+  };
+}
+var GLOBSTAR = /* @__PURE__ */ Symbol("globstar");
+function compilePattern(pattern) {
+  const withoutLead = pattern.replace(/^\.?\//, "");
+  let end = withoutLead.length;
+  while (end > 0 && withoutLead[end - 1] === "/") end -= 1;
+  const p = withoutLead.slice(0, end);
+  if (!p.includes("/")) {
+    if (p === "**") return () => true;
+    const rx = segToRegExp(p);
+    return (segs) => segs.some((s) => rx.test(s));
+  }
+  const raw = p.split("/");
+  const trailingGlobstar = raw[raw.length - 1] === "**";
+  const core = trailingGlobstar ? raw.slice(0, -1) : raw;
+  const parts = core.map((s) => s === "**" ? GLOBSTAR : segToRegExp(s));
+  return (segs) => {
+    const end2 = matchPrefix(parts, segs);
+    if (end2 < 0) return false;
+    return trailingGlobstar ? end2 < segs.length : true;
+  };
+}
+function segToRegExp(seg) {
+  let body = "";
+  for (let i = 0; i < seg.length; i += 1) {
+    const c = seg[i];
+    if (c === "*") {
+      while (seg[i + 1] === "*") i += 1;
+      body += "[^/]*";
+    } else if (c === "?") {
+      body += "[^/]";
+    } else {
+      body += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchPrefix(parts, segs) {
+  let pi = 0;
+  let si = 0;
+  let star = -1;
+  let starSi = -1;
+  while (pi < parts.length) {
+    const part = parts[pi];
+    if (part === GLOBSTAR) {
+      star = pi;
+      starSi = si;
+      pi += 1;
+    } else if (si < segs.length && part.test(segs[si])) {
+      pi += 1;
+      si += 1;
+    } else if (star !== -1 && starSi < segs.length) {
+      starSi += 1;
+      si = starSi;
+      pi = star + 1;
+    } else {
+      return -1;
+    }
+  }
+  return si;
+}
+function readIgnoreFile(root) {
+  try {
+    return (0, import_node_fs10.readFileSync)((0, import_node_path5.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+  } catch {
+    return [];
+  }
+}
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -5873,6 +5948,7 @@ function scanPath(targetPath, options = {}) {
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
+  let excluded = 0;
   const rootIsDirectory = (() => {
     try {
       return (0, import_node_fs10.statSync)(targetPath).isDirectory();
@@ -5881,6 +5957,7 @@ function scanPath(targetPath, options = {}) {
     }
   })();
   const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path5.dirname)(targetPath);
+  const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
     const extension = (0, import_node_path5.extname)(filename).toLowerCase();
@@ -5938,17 +6015,28 @@ function scanPath(targetPath, options = {}) {
     }
     for (const entry of entries) {
       const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
+      const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
+        if (isExcluded(relativePath)) {
+          excluded += 1;
+          continue;
+        }
         walk(fullPath);
         continue;
       }
       if (!entry.isFile()) continue;
+      if (isExcluded(relativePath)) {
+        excluded += 1;
+        continue;
+      }
       scanFile(fullPath, entry.name);
     }
   };
   if (rootIsDirectory) {
     walk(targetPath);
+  } else if (isExcluded(toRelative(walkRoot, targetPath))) {
+    excluded += 1;
   } else {
     scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
   }
@@ -5956,7 +6044,7 @@ function scanPath(targetPath, options = {}) {
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
   );
-  return { findings: filtered, filesScanned, unreadable, suppressed, root: walkRoot };
+  return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };
 }
 function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   if (fileFindings.length > 0) return;