@profullstack/threatcrush 0.7.2 → 0.8.0

package/dist/daemon.js

@@ -5866,6 +5866,81 @@ function scanManifest(relativePath, filename, text) {
 // ../../packages/scan/src/node/walk.ts
 var import_node_fs10 = require("fs");
 var import_node_path5 = require("path");
+function compileExcludes(patterns) {
+  const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
+  if (matchers.length === 0) return () => false;
+  return (relPath) => {
+    const segs = relPath.split("/");
+    return matchers.some((m) => m(segs));
+  };
+}
+var GLOBSTAR = /* @__PURE__ */ Symbol("globstar");
+function compilePattern(pattern) {
+  const withoutLead = pattern.replace(/^\.?\//, "");
+  let end = withoutLead.length;
+  while (end > 0 && withoutLead[end - 1] === "/") end -= 1;
+  const p = withoutLead.slice(0, end);
+  if (!p.includes("/")) {
+    if (p === "**") return () => true;
+    const rx = segToRegExp(p);
+    return (segs) => segs.some((s) => rx.test(s));
+  }
+  const raw = p.split("/");
+  const trailingGlobstar = raw[raw.length - 1] === "**";
+  const core = trailingGlobstar ? raw.slice(0, -1) : raw;
+  const parts = core.map((s) => s === "**" ? GLOBSTAR : segToRegExp(s));
+  return (segs) => {
+    const end2 = matchPrefix(parts, segs);
+    if (end2 < 0) return false;
+    return trailingGlobstar ? end2 < segs.length : true;
+  };
+}
+function segToRegExp(seg) {
+  let body = "";
+  for (let i = 0; i < seg.length; i += 1) {
+    const c = seg[i];
+    if (c === "*") {
+      while (seg[i + 1] === "*") i += 1;
+      body += "[^/]*";
+    } else if (c === "?") {
+      body += "[^/]";
+    } else {
+      body += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchPrefix(parts, segs) {
+  let pi = 0;
+  let si = 0;
+  let star = -1;
+  let starSi = -1;
+  while (pi < parts.length) {
+    const part = parts[pi];
+    if (part === GLOBSTAR) {
+      star = pi;
+      starSi = si;
+      pi += 1;
+    } else if (si < segs.length && part.test(segs[si])) {
+      pi += 1;
+      si += 1;
+    } else if (star !== -1 && starSi < segs.length) {
+      starSi += 1;
+      si = starSi;
+      pi = star + 1;
+    } else {
+      return -1;
+    }
+  }
+  return si;
+}
+function readIgnoreFile(root) {
+  try {
+    return (0, import_node_fs10.readFileSync)((0, import_node_path5.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+  } catch {
+    return [];
+  }
+}
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -5873,6 +5948,7 @@ function scanPath(targetPath, options = {}) {
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
+  let excluded = 0;
   const rootIsDirectory = (() => {
     try {
       return (0, import_node_fs10.statSync)(targetPath).isDirectory();
@@ -5881,6 +5957,7 @@ function scanPath(targetPath, options = {}) {
     }
   })();
   const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path5.dirname)(targetPath);
+  const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
     const extension = (0, import_node_path5.extname)(filename).toLowerCase();
@@ -5938,17 +6015,28 @@ function scanPath(targetPath, options = {}) {
     }
     for (const entry of entries) {
       const fullPath = (0, import_node_path5.join)(currentPath, entry.name);
+      const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
+        if (isExcluded(relativePath)) {
+          excluded += 1;
+          continue;
+        }
         walk(fullPath);
         continue;
       }
       if (!entry.isFile()) continue;
+      if (isExcluded(relativePath)) {
+        excluded += 1;
+        continue;
+      }
       scanFile(fullPath, entry.name);
     }
   };
   if (rootIsDirectory) {
     walk(targetPath);
+  } else if (isExcluded(toRelative(walkRoot, targetPath))) {
+    excluded += 1;
   } else {
     scanFile(targetPath, (0, import_node_path5.basename)(targetPath));
   }
@@ -5956,7 +6044,7 @@ function scanPath(targetPath, options = {}) {
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
   );
-  return { findings: filtered, filesScanned, unreadable, suppressed, root: walkRoot };
+  return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };
 }
 function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   if (fileFindings.length > 0) return;