@profullstack/threatcrush 0.7.2 → 0.8.0

package/dist/index.js

@@ -11141,6 +11141,81 @@ function meetsFailThreshold(findings, threshold) {
 // ../../packages/scan/src/node/walk.ts
 var import_node_fs5 = require("fs");
 var import_node_path2 = require("path");
+function compileExcludes(patterns) {
+  const matchers = patterns.map((p) => p.trim()).filter((p) => p.length > 0 && !p.startsWith("#")).map(compilePattern);
+  if (matchers.length === 0) return () => false;
+  return (relPath) => {
+    const segs = relPath.split("/");
+    return matchers.some((m) => m(segs));
+  };
+}
+var GLOBSTAR = /* @__PURE__ */ Symbol("globstar");
+function compilePattern(pattern) {
+  const withoutLead = pattern.replace(/^\.?\//, "");
+  let end = withoutLead.length;
+  while (end > 0 && withoutLead[end - 1] === "/") end -= 1;
+  const p = withoutLead.slice(0, end);
+  if (!p.includes("/")) {
+    if (p === "**") return () => true;
+    const rx = segToRegExp(p);
+    return (segs) => segs.some((s) => rx.test(s));
+  }
+  const raw = p.split("/");
+  const trailingGlobstar = raw[raw.length - 1] === "**";
+  const core = trailingGlobstar ? raw.slice(0, -1) : raw;
+  const parts = core.map((s) => s === "**" ? GLOBSTAR : segToRegExp(s));
+  return (segs) => {
+    const end2 = matchPrefix(parts, segs);
+    if (end2 < 0) return false;
+    return trailingGlobstar ? end2 < segs.length : true;
+  };
+}
+function segToRegExp(seg) {
+  let body = "";
+  for (let i = 0; i < seg.length; i += 1) {
+    const c = seg[i];
+    if (c === "*") {
+      while (seg[i + 1] === "*") i += 1;
+      body += "[^/]*";
+    } else if (c === "?") {
+      body += "[^/]";
+    } else {
+      body += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+  }
+  return new RegExp(`^${body}$`);
+}
+function matchPrefix(parts, segs) {
+  let pi = 0;
+  let si = 0;
+  let star = -1;
+  let starSi = -1;
+  while (pi < parts.length) {
+    const part = parts[pi];
+    if (part === GLOBSTAR) {
+      star = pi;
+      starSi = si;
+      pi += 1;
+    } else if (si < segs.length && part.test(segs[si])) {
+      pi += 1;
+      si += 1;
+    } else if (star !== -1 && starSi < segs.length) {
+      starSi += 1;
+      si = starSi;
+      pi = star + 1;
+    } else {
+      return -1;
+    }
+  }
+  return si;
+}
+function readIgnoreFile(root) {
+  try {
+    return (0, import_node_fs5.readFileSync)((0, import_node_path2.join)(root, ".threatcrushignore"), "utf-8").split("\n");
+  } catch {
+    return [];
+  }
+}
 function scanPath(targetPath, options = {}) {
   const maxFileBytes = options.maxFileBytes ?? 1024 * 1024;
   const allowed = options.categories ? new Set(options.categories) : null;
@@ -11148,6 +11223,7 @@ function scanPath(targetPath, options = {}) {
   const unreadable = [];
   let filesScanned = 0;
   let suppressed = 0;
+  let excluded = 0;
   const rootIsDirectory = (() => {
     try {
       return (0, import_node_fs5.statSync)(targetPath).isDirectory();
@@ -11156,6 +11232,7 @@ function scanPath(targetPath, options = {}) {
     }
   })();
   const walkRoot = rootIsDirectory ? targetPath : (0, import_node_path2.dirname)(targetPath);
+  const isExcluded = compileExcludes([...options.exclude ?? [], ...readIgnoreFile(walkRoot)]);
   const scanFile = (fullPath, filename) => {
     const relativePath = toRelative(walkRoot, fullPath);
     const extension = (0, import_node_path2.extname)(filename).toLowerCase();
@@ -11213,17 +11290,28 @@ function scanPath(targetPath, options = {}) {
     }
     for (const entry of entries) {
       const fullPath = (0, import_node_path2.join)(currentPath, entry.name);
+      const relativePath = toRelative(walkRoot, fullPath);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
+        if (isExcluded(relativePath)) {
+          excluded += 1;
+          continue;
+        }
         walk(fullPath);
         continue;
       }
       if (!entry.isFile()) continue;
+      if (isExcluded(relativePath)) {
+        excluded += 1;
+        continue;
+      }
       scanFile(fullPath, entry.name);
     }
   };
   if (rootIsDirectory) {
     walk(targetPath);
+  } else if (isExcluded(toRelative(walkRoot, targetPath))) {
+    excluded += 1;
   } else {
     scanFile(targetPath, (0, import_node_path2.basename)(targetPath));
   }
@@ -11231,7 +11319,7 @@ function scanPath(targetPath, options = {}) {
   filtered.sort(
     (a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line
   );
-  return { findings: filtered, filesScanned, unreadable, suppressed, root: walkRoot };
+  return { findings: filtered, filesScanned, unreadable, suppressed, excluded, root: walkRoot };
 }
 function recordSensitiveFile(filename, relativePath, sink, fileFindings) {
   if (fileFindings.length > 0) return;
@@ -11580,6 +11668,7 @@ async function scanCommand(targetPath, options = {}) {
   try {
     let seen = 0;
     const report = scanPath(targetPath, {
+      exclude: options.exclude,
       onFile: () => {
         seen += 1;
         if (spinner) spinner.text = `Scanning files... (${seen} files)`;
@@ -11595,6 +11684,7 @@ async function scanCommand(targetPath, options = {}) {
       filesScanned: report.filesScanned,
       unreadable: report.unreadable,
       suppressed: report.suppressed,
+      excluded: report.excluded,
       root: report.root
     };
   } catch (err) {
@@ -11614,6 +11704,13 @@ async function scanCommand(targetPath, options = {}) {
       for (const path of outcome.unreadable) say(source_default.gray(`      ${path}`));
     }
   }
+  if (outcome.excluded > 0) {
+    say(
+      source_default.gray(
+        `  \xB7 ${outcome.excluded} path(s) excluded by --exclude or .threatcrushignore`
+      )
+    );
+  }
   if (outcome.suppressed > 0) {
     say(
       source_default.gray(
@@ -17245,7 +17342,12 @@ program2.command("scan").description("Scan codebase for vulnerabilities and secr
 ).option(
   "--path-prefix <prefix>",
   "prepend this to SARIF file URIs \u2014 use when the scan root is not the repository root"
-).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
+).option("--deps", "also query OSV.dev for advisories against lockfile versions (network)").option(
+  "--exclude <glob>",
+  "skip paths matching this glob (repeatable); merged with a .threatcrushignore at the scan root",
+  (value, previous) => [...previous, value],
+  []
+).option("-v, --verbose", "list the paths that could not be read").action(async (targetPath, opts) => {
   const format = (opts.format ?? "text").toLowerCase();
   if (!["text", "json", "sarif"].includes(format)) {
     console.error(source_default.red(`Unknown --format "${opts.format}" (expected text, json, or sarif)`));
@@ -17264,6 +17366,7 @@ program2.command("scan").description("Scan codebase for vulnerabilities and secr
     failOn,
     pathPrefix: opts.pathPrefix,
     dependencies: opts.deps,
+    exclude: opts.exclude,
     verbose: opts.verbose
   });
 });