@profullstack/threatcrush 0.7.1 → 0.8.0

package/dist/index.js

@@ -9632,7 +9632,7 @@ var XXE_GUARD = /FEATURE_SECURE_PROCESSING|setExpandEntityReferences|disallow-do
 var XML_PARSING_FILE = /\b(?:javax\.xml|org\.xml\.sax|org\.w3c\.dom|org\.jdom2?|org\.dom4j|XmlPullParser|DocumentBuilderFactory|DocumentBuilder|SAXParserFactory|SAXParser|XMLInputFactory|XMLReaderFactory|XMLReader|SAXBuilder|SAXReader)\b/;
 var CODE_SINK = /\bglobalThis\s*\[|\bconstructor\b|\beval\b|\bFunction\b|\brun\s*\(|\bvm\s*\.\s*run/;
 var EXFIL_SINK = /\bconsole\s*\.\s*(?:log|debug|info|warn|error)\s*\(|\bfetch\s*\(|\baxios\b|\brequest\s*\(|\.\s*send\s*\(/;
-var SQL_KEYWORDS = "SELECT|INSERT\\s+INTO|INSERT|UPDATE|DELETE\\s+FROM|DELETE|DROP|UNION\\s+SELECT";
+var SQL_KEYWORDS = "SELECT\\b(?=[^`'\"\\n]*\\bFROM\\b)|INSERT\\s+INTO|UPDATE\\b(?=[^`'\"\\n]*\\bSET\\b)|DELETE\\s+FROM|DROP\\s+(?:TABLE|DATABASE|INDEX|VIEW|SCHEMA)|TRUNCATE\\s+TABLE|UNION\\s+SELECT";
 var SQL_IN_DOUBLE = `"[^"\\n]*(?:${SQL_KEYWORDS})\\b[^"\\n]*"`;
 var SQL_IN_SINGLE = `'[^'\\n]*(?:${SQL_KEYWORDS})\\b[^'\\n]*'`;
 var SQL_STRING = `(?:${SQL_IN_DOUBLE}|${SQL_IN_SINGLE})`;
@@ -11141,6 +11141,81 @@ function meetsFailThreshold(findings, threshold) {
 // ../../packages/scan/src/node/walk.ts
 var import_node_fs5 = require("fs");
 var import_node_path2 = require("path");
+function compileExcludes(patterns) {
+  const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
+  if (matchers.length === 0) return () => false;
+  return (relPath) => {
+    const segs = relPath.split("/");
+    return matchers.some((m) => m(segs));
+  };
+}
+var GLOBSTAR = /* @__PURE__ */ Symbol("globstar");
+function compilePattern(pattern) {
+  const withoutLead = pattern.replace(/^\.?\//, "");
+  let end = withoutLead.length;
+  while (end > 0 && withoutLead[end - 1] === "/") end -= 1;
+  const p = withoutLead.slice(0, end);
+  if (!p.includes("/")) {
+    if (p === "**") return () => true;
+    const rx = segToRegExp(p);
+    return (segs) => segs.some((s) => rx.test(s));
+  }
+  const raw = p.split("/");
+  const trailingGlobstar = raw[raw.length - 1] === "**";
+  const core = trailingGlobstar ? raw.slice(0, -1) : raw;
+  const parts = core.map((s) => s === "**" ? GLOBSTAR : segToRegExp(s));
+  return (segs) => {
+    const end2 = matchPrefix(parts, segs);
+    if (end2 < 0) return false;
+    return trailingGlobstar ? end2 < segs.length : true;
+  };
+}
+function segToRegExp(seg) {
+  let body = "";
+  for (let i = 0; i < seg.length; i += 1) {
+    const c = seg[i];
+    if (c === "*") {
+      while (seg[i + 1] === "*") i += 1;
+      body += "[^/]*";
+    } else if (c === "?") {
+      body += "[^/]";
+    } else {
+      body += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchPrefix(parts, segs) {
+  let pi = 0;
+  let si = 0;
+  let star = -1;
+  let starSi = -1;
+  while (pi < parts.length) {
+    const part = parts[pi];
+    if (part === GLOBSTAR) {
+      star = pi;
+      starSi = si;
+      pi += 1;
+    } else if (si < segs.length && part.test(segs[si])) {
+      pi += 1;
+      si += 1;
+    } else if (star !== -1 && starSi < segs.length) {
+      starSi += 1;
+      si = starSi;
+      pi = star + 1;
+    } else {
+      return -1;
+    }
+  }
+  return si;
+}
+function readIgnoreFile(root) {
+  try {
+    return (0, import_node_fs5.readFileSync)((0, import_node_path2.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+  } catch {
+    return [];
+  }
+}
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -11148,6 +11223,7 @@ function scanPath(targetPath, options = {}) {
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
+  let excluded = 0;
   const rootIsDirectory = (() => {
     try {
       return (0, import_node_fs5.statSync)(targetPath).isDirectory();
@@ -11156,6 +11232,7 @@ function scanPath(targetPath, options = {}) {
     }
   })();
   const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path2.dirname)(targetPath);
+  const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
     const extension = (0, import_node_path2.extname)(filename).toLowerCase();
@@ -11213,17 +11290,28 @@ function scanPath(targetPath, options = {}) {
     }
     for (const entry of entries) {
       const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
+      const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
+        if (isExcluded(relativePath)) {
+          excluded += 1;
+          continue;
+        }
         walk(fullPath);
         continue;
       }
       if (!entry.isFile()) continue;
+      if (isExcluded(relativePath)) {
+        excluded += 1;
+        continue;
+      }
       scanFile(fullPath, entry.name);
     }
   };
   if (rootIsDirectory) {
     walk(targetPath);
+  } else if (isExcluded(toRelative(walkRoot, targetPath))) {
+    excluded += 1;
   } else {
     scanFile(targetPath, (0, import_node_path2.basename)(targetPath));
   }
@@ -11231,7 +11319,7 @@ function scanPath(targetPath, options = {}) {
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
   );
-  return { findings: filtered, filesScanned, unreadable, suppressed, root: walkRoot };
+  return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };
 }
 function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   if (fileFindings.length > 0) return;
@@ -11580,6 +11668,7 @@ async function scanCommand(targetPath, options = {}) {
   try {
     let seen = 0;
     const report = scanPath(targetPath, {
+      exclude: options.exclude,
       onFile: () => {
         seen += 1;
         if (spinner) spinner.text = `Scanning files... (${seen} files)`;
@@ -11595,6 +11684,7 @@ async function scanCommand(targetPath, options = {}) {
       filesScanned: report.filesScanned,
       unreadable: report.unreadable,
       suppressed: report.suppressed,
+      excluded: report.excluded,
       root: report.root
     };
   } catch (err) {
@@ -11614,6 +11704,13 @@ async function scanCommand(targetPath, options = {}) {
       for (const path of outcome.unreadable) say(source_default.gray(`      ${path}`));
     }
   }
+  if (outcome.excluded > 0) {
+    say(
+      source_default.gray(
+        `  \xB7 ${outcome.excluded} path(s) excluded by --exclude or .threatcrushignore`
+      )
+    );
+  }
   if (outcome.suppressed > 0) {
     say(
       source_default.gray(
@@ -17245,7 +17342,12 @@ program2.command("scan").description("Scan codebase for vulnerabilities and secr
 ).option(
   "--path-prefix <prefix>",
   "prepend this to SARIF file URIs \u2014 use when the scan root is not the repository root"
-).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
+).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option(
+  "--exclude <glob>",
+  "skip paths matching this glob (repeatable); merged with a .threatcrushignore at the scan root",
+  (value, previous) => [...previous, value],
+  []
+).option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
   const format = (opts.format ?? "text").toLowerCase();
   if (!["text", "json", "sarif"].includes(format)) {
     console.error(source_default.red(`Unknown --format "${opts.format}" (expected text, json, or sarif)`));
@@ -17264,6 +17366,7 @@ program2.command("scan").description("Scan codebase for vulnerabilities and secr
     failOn,
     pathPrefix: opts.pathPrefix,
     dependencies: opts.deps,
+    exclude: opts.exclude,
     verbose: opts.verbose
   });
 });