@reliabilityworks/core 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/builtinRules.d.ts +3 -0
- package/dist/builtinRules.d.ts.map +1 -0
- package/dist/builtinRules.js +41 -0
- package/dist/builtinRules.js.map +1 -0
- package/dist/frameworks.d.ts +5 -0
- package/dist/frameworks.d.ts.map +1 -0
- package/dist/frameworks.js +169 -0
- package/dist/frameworks.js.map +1 -0
- package/dist/index.d.ts +6 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +22 -0
- package/dist/index.js.map +1 -0
- package/dist/reporters/html.d.ts +3 -0
- package/dist/reporters/html.d.ts.map +1 -0
- package/dist/reporters/html.js +64 -0
- package/dist/reporters/html.js.map +1 -0
- package/dist/reporters/sarif.d.ts +52 -0
- package/dist/reporters/sarif.d.ts.map +1 -0
- package/dist/reporters/sarif.js +76 -0
- package/dist/reporters/sarif.js.map +1 -0
- package/dist/scan.d.ts +5 -0
- package/dist/scan.d.ts.map +1 -0
- package/dist/scan.js +315 -0
- package/dist/scan.js.map +1 -0
- package/dist/types.d.ts +77 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +3 -0
- package/dist/types.js.map +1 -0
- package/package.json +18 -0
- package/src/builtinRules.ts +39 -0
- package/src/frameworks.ts +202 -0
- package/src/index.ts +5 -0
- package/src/picomatch.d.ts +10 -0
- package/src/reporters/html.ts +65 -0
- package/src/reporters/sarif.ts +115 -0
- package/src/scan.ts +379 -0
- package/src/types.ts +90 -0
- package/test/fixtures/monorepo/apps/api/next.config.js +3 -0
- package/test/fixtures/monorepo/apps/api/package.json +7 -0
- package/test/fixtures/monorepo/apps/kit/package.json +7 -0
- package/test/fixtures/monorepo/apps/kit/svelte.config.js +9 -0
- package/test/fixtures/monorepo/apps/web/next-env.d.ts +1 -0
- package/test/fixtures/monorepo/apps/web/next.config.js +3 -0
- package/test/fixtures/monorepo/apps/web/package.json +7 -0
- package/test/fixtures/sample-repo/.env +2 -0
- package/test/fixtures/sample-repo/keys.txt +3 -0
- package/test/fixtures/sample-repo/src/index.ts +1 -0
- package/test/frameworksWorkspace.test.js +15 -0
- package/test/scanProject.test.js +15 -0
- package/tsconfig.json +8 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"builtinRules.d.ts","sourceRoot":"","sources":["../src/builtinRules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAEnC,eAAO,MAAM,aAAa,EAAE,IAAI,EAoC/B,CAAA"}
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.BUILTIN_RULES = void 0;
|
|
4
|
+
exports.BUILTIN_RULES = [
|
|
5
|
+
{
|
|
6
|
+
id: 'core/env-file-committed',
|
|
7
|
+
severity: 'critical',
|
|
8
|
+
title: '.env file committed',
|
|
9
|
+
description: 'Environment files often contain secrets and should not be committed.',
|
|
10
|
+
matcher: {
|
|
11
|
+
type: 'file_presence',
|
|
12
|
+
paths: ['.env', '.env.*'],
|
|
13
|
+
message: 'Environment file present in repository',
|
|
14
|
+
},
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
id: 'core/private-key-committed',
|
|
18
|
+
severity: 'critical',
|
|
19
|
+
title: 'Private key committed',
|
|
20
|
+
description: 'Private keys should never be stored in repositories.',
|
|
21
|
+
matcher: {
|
|
22
|
+
type: 'regex',
|
|
23
|
+
fileGlobs: ['**/*'],
|
|
24
|
+
pattern: '-----BEGIN (?:RSA|EC|OPENSSH|DSA) PRIVATE KEY-----',
|
|
25
|
+
message: 'Private key material detected',
|
|
26
|
+
},
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
id: 'core/hardcoded-aws-access-key-id',
|
|
30
|
+
severity: 'high',
|
|
31
|
+
title: 'Hardcoded AWS access key ID',
|
|
32
|
+
description: 'AWS access key IDs should not be embedded in source code.',
|
|
33
|
+
matcher: {
|
|
34
|
+
type: 'regex',
|
|
35
|
+
fileGlobs: ['**/*.{js,jsx,ts,tsx,json,yaml,yml,env,txt,md}'],
|
|
36
|
+
pattern: '\\bAKIA[0-9A-Z]{16}\\b',
|
|
37
|
+
message: 'Potential AWS access key ID detected',
|
|
38
|
+
},
|
|
39
|
+
},
|
|
40
|
+
];
|
|
41
|
+
//# sourceMappingURL=builtinRules.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"builtinRules.js","sourceRoot":"","sources":["../src/builtinRules.ts"],"names":[],"mappings":";;;AAEa,QAAA,aAAa,GAAW;IACnC;QACE,EAAE,EAAE,yBAAyB;QAC7B,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE;YACP,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;YACzB,OAAO,EAAE,wCAAwC;SAClD;KACF;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,oDAAoD;YAC7D,OAAO,EAAE,+BAA+B;SACzC;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,CAAC,+CAA+C,CAAC;YAC5D,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,sCAAsC;SAChD;KACF;CACF,CAAA"}
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import type { FrameworkDetection } from './types';
|
|
2
|
+
export declare function detectFrameworks(rootDir: string): Promise<FrameworkDetection[]>;
|
|
3
|
+
export declare function listWorkspaceProjectRoots(rootDir: string): Promise<string[]>;
|
|
4
|
+
export declare function detectFrameworksInWorkspace(rootDir: string): Promise<FrameworkDetection[]>;
|
|
5
|
+
//# sourceMappingURL=frameworks.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"frameworks.d.ts","sourceRoot":"","sources":["../src/frameworks.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAe,MAAM,SAAS,CAAA;AAkF9D,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6DrF;AAED,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBlF;AAED,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA4BhG"}
|
|
@@ -0,0 +1,169 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
3
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
4
|
+
};
|
|
5
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
6
|
+
exports.detectFrameworks = detectFrameworks;
|
|
7
|
+
exports.listWorkspaceProjectRoots = listWorkspaceProjectRoots;
|
|
8
|
+
exports.detectFrameworksInWorkspace = detectFrameworksInWorkspace;
|
|
9
|
+
const promises_1 = require("node:fs/promises");
|
|
10
|
+
const node_path_1 = __importDefault(require("node:path"));
|
|
11
|
+
const fast_glob_1 = __importDefault(require("fast-glob"));
|
|
12
|
+
const WORKSPACE_IGNORES = [
|
|
13
|
+
'**/.git/**',
|
|
14
|
+
'**/node_modules/**',
|
|
15
|
+
'**/dist/**',
|
|
16
|
+
'**/build/**',
|
|
17
|
+
'**/coverage/**',
|
|
18
|
+
'**/.next/**',
|
|
19
|
+
'**/.turbo/**',
|
|
20
|
+
'**/.cache/**',
|
|
21
|
+
'**/.yarn/**',
|
|
22
|
+
'**/.pnpm/**',
|
|
23
|
+
];
|
|
24
|
+
async function pathStat(p) {
|
|
25
|
+
try {
|
|
26
|
+
return await (0, promises_1.stat)(p);
|
|
27
|
+
}
|
|
28
|
+
catch {
|
|
29
|
+
return null;
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
async function hasFile(rootDir, relativePath) {
|
|
33
|
+
const fileStat = await pathStat(node_path_1.default.join(rootDir, relativePath));
|
|
34
|
+
return fileStat?.isFile() ?? false;
|
|
35
|
+
}
|
|
36
|
+
async function hasDir(rootDir, relativePath) {
|
|
37
|
+
const dirStat = await pathStat(node_path_1.default.join(rootDir, relativePath));
|
|
38
|
+
return dirStat?.isDirectory() ?? false;
|
|
39
|
+
}
|
|
40
|
+
async function readPackageJson(rootDir) {
|
|
41
|
+
const packageJsonPath = node_path_1.default.join(rootDir, 'package.json');
|
|
42
|
+
const fileStat = await pathStat(packageJsonPath);
|
|
43
|
+
if (!fileStat?.isFile())
|
|
44
|
+
return null;
|
|
45
|
+
try {
|
|
46
|
+
const raw = await (0, promises_1.readFile)(packageJsonPath, 'utf8');
|
|
47
|
+
return JSON.parse(raw);
|
|
48
|
+
}
|
|
49
|
+
catch {
|
|
50
|
+
return null;
|
|
51
|
+
}
|
|
52
|
+
}
|
|
53
|
+
function packageHasDep(pkg, name) {
|
|
54
|
+
if (!pkg)
|
|
55
|
+
return false;
|
|
56
|
+
return Boolean(pkg.dependencies?.[name] ?? pkg.devDependencies?.[name]);
|
|
57
|
+
}
|
|
58
|
+
function pushIf(value, condition, into) {
|
|
59
|
+
if (condition)
|
|
60
|
+
into.push(value);
|
|
61
|
+
}
|
|
62
|
+
function confidenceFromEvidenceCount(count) {
|
|
63
|
+
if (count >= 3)
|
|
64
|
+
return 'high';
|
|
65
|
+
if (count >= 2)
|
|
66
|
+
return 'medium';
|
|
67
|
+
return 'low';
|
|
68
|
+
}
|
|
69
|
+
function makeDetection(id, evidence) {
|
|
70
|
+
return {
|
|
71
|
+
id,
|
|
72
|
+
confidence: confidenceFromEvidenceCount(evidence.length),
|
|
73
|
+
evidence,
|
|
74
|
+
};
|
|
75
|
+
}
|
|
76
|
+
function sortFrameworks(frameworks) {
|
|
77
|
+
frameworks.sort((a, b) => {
|
|
78
|
+
const score = (d) => d.confidence === 'high' ? 3 : d.confidence === 'medium' ? 2 : 1;
|
|
79
|
+
return score(b) - score(a);
|
|
80
|
+
});
|
|
81
|
+
}
|
|
82
|
+
async function detectFrameworks(rootDir) {
|
|
83
|
+
const pkg = await readPackageJson(rootDir);
|
|
84
|
+
const hasNextDep = packageHasDep(pkg, 'next');
|
|
85
|
+
const hasNextEnv = await hasFile(rootDir, 'next-env.d.ts');
|
|
86
|
+
const nextEvidence = [];
|
|
87
|
+
pushIf('dependency: next', hasNextDep, nextEvidence);
|
|
88
|
+
pushIf('file: next-env.d.ts', hasNextEnv, nextEvidence);
|
|
89
|
+
pushIf('dir: app/', await hasDir(rootDir, 'app'), nextEvidence);
|
|
90
|
+
pushIf('dir: pages/', await hasDir(rootDir, 'pages'), nextEvidence);
|
|
91
|
+
const nextConfigFiles = ['next.config.js', 'next.config.mjs', 'next.config.cjs', 'next.config.ts'];
|
|
92
|
+
for (const f of nextConfigFiles) {
|
|
93
|
+
pushIf(`file: ${f}`, await hasFile(rootDir, f), nextEvidence);
|
|
94
|
+
}
|
|
95
|
+
const hasReactNativeDep = packageHasDep(pkg, 'react-native');
|
|
96
|
+
const rnEvidence = [];
|
|
97
|
+
pushIf('dependency: react-native', hasReactNativeDep, rnEvidence);
|
|
98
|
+
pushIf('dir: ios/', await hasDir(rootDir, 'ios'), rnEvidence);
|
|
99
|
+
pushIf('dir: android/', await hasDir(rootDir, 'android'), rnEvidence);
|
|
100
|
+
pushIf('file: metro.config.js', await hasFile(rootDir, 'metro.config.js'), rnEvidence);
|
|
101
|
+
const expoEvidence = [];
|
|
102
|
+
pushIf('dependency: expo', packageHasDep(pkg, 'expo'), expoEvidence);
|
|
103
|
+
pushIf('file: app.json', await hasFile(rootDir, 'app.json'), expoEvidence);
|
|
104
|
+
pushIf('file: app.config.js', await hasFile(rootDir, 'app.config.js'), expoEvidence);
|
|
105
|
+
pushIf('file: app.config.ts', await hasFile(rootDir, 'app.config.ts'), expoEvidence);
|
|
106
|
+
pushIf('file: eas.json', await hasFile(rootDir, 'eas.json'), expoEvidence);
|
|
107
|
+
const expressEvidence = [];
|
|
108
|
+
pushIf('dependency: express', packageHasDep(pkg, 'express'), expressEvidence);
|
|
109
|
+
const hasSvelteKitDep = packageHasDep(pkg, '@sveltejs/kit');
|
|
110
|
+
const kitEvidence = [];
|
|
111
|
+
pushIf('dependency: @sveltejs/kit', hasSvelteKitDep, kitEvidence);
|
|
112
|
+
pushIf('file: svelte.config.js', await hasFile(rootDir, 'svelte.config.js'), kitEvidence);
|
|
113
|
+
pushIf('file: svelte.config.ts', await hasFile(rootDir, 'svelte.config.ts'), kitEvidence);
|
|
114
|
+
pushIf('dir: src/routes/', await hasDir(rootDir, node_path_1.default.join('src', 'routes')), kitEvidence);
|
|
115
|
+
const frameworks = [];
|
|
116
|
+
if (hasNextDep || hasNextEnv)
|
|
117
|
+
frameworks.push(makeDetection('nextjs', nextEvidence));
|
|
118
|
+
if (hasReactNativeDep) {
|
|
119
|
+
const combined = Array.from(new Set([...rnEvidence, ...expoEvidence]));
|
|
120
|
+
frameworks.push(makeDetection('react-native', combined));
|
|
121
|
+
}
|
|
122
|
+
if (expoEvidence.length > 0)
|
|
123
|
+
frameworks.push(makeDetection('expo', expoEvidence));
|
|
124
|
+
if (expressEvidence.length > 0)
|
|
125
|
+
frameworks.push(makeDetection('express', expressEvidence));
|
|
126
|
+
if (hasSvelteKitDep)
|
|
127
|
+
frameworks.push(makeDetection('sveltekit', kitEvidence));
|
|
128
|
+
sortFrameworks(frameworks);
|
|
129
|
+
return frameworks;
|
|
130
|
+
}
|
|
131
|
+
async function listWorkspaceProjectRoots(rootDir) {
|
|
132
|
+
const packageJsonPaths = await (0, fast_glob_1.default)('**/package.json', {
|
|
133
|
+
cwd: rootDir,
|
|
134
|
+
dot: true,
|
|
135
|
+
onlyFiles: true,
|
|
136
|
+
followSymbolicLinks: false,
|
|
137
|
+
ignore: WORKSPACE_IGNORES,
|
|
138
|
+
});
|
|
139
|
+
const resolvedRoot = node_path_1.default.resolve(rootDir);
|
|
140
|
+
const roots = Array.from(new Set(packageJsonPaths.map((relativePath) => node_path_1.default.join(rootDir, node_path_1.default.dirname(relativePath)))))
|
|
141
|
+
.map((p) => node_path_1.default.resolve(p))
|
|
142
|
+
.filter((p) => p !== resolvedRoot);
|
|
143
|
+
roots.sort();
|
|
144
|
+
return roots;
|
|
145
|
+
}
|
|
146
|
+
async function detectFrameworksInWorkspace(rootDir) {
|
|
147
|
+
const roots = await listWorkspaceProjectRoots(rootDir);
|
|
148
|
+
const byFramework = new Map();
|
|
149
|
+
for (const projectRoot of roots) {
|
|
150
|
+
const detections = await detectFrameworks(projectRoot);
|
|
151
|
+
if (detections.length === 0)
|
|
152
|
+
continue;
|
|
153
|
+
const relativeRoot = node_path_1.default.relative(rootDir, projectRoot) || '.';
|
|
154
|
+
for (const detection of detections) {
|
|
155
|
+
const existing = byFramework.get(detection.id) ?? new Set();
|
|
156
|
+
for (const evidence of detection.evidence) {
|
|
157
|
+
existing.add(`${relativeRoot}: ${evidence}`);
|
|
158
|
+
}
|
|
159
|
+
byFramework.set(detection.id, existing);
|
|
160
|
+
}
|
|
161
|
+
}
|
|
162
|
+
const frameworks = [];
|
|
163
|
+
for (const [id, evidenceSet] of byFramework.entries()) {
|
|
164
|
+
frameworks.push(makeDetection(id, Array.from(evidenceSet)));
|
|
165
|
+
}
|
|
166
|
+
sortFrameworks(frameworks);
|
|
167
|
+
return frameworks;
|
|
168
|
+
}
|
|
169
|
+
//# sourceMappingURL=frameworks.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"frameworks.js","sourceRoot":"","sources":["../src/frameworks.ts"],"names":[],"mappings":";;;;;AAwFA,4CA6DC;AAED,8DAoBC;AAED,kEA4BC;AAzMD,+CAAiD;AAEjD,0DAA4B;AAE5B,0DAA0B;AAS1B,MAAM,iBAAiB,GAAG;IACxB,YAAY;IACZ,oBAAoB;IACpB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,cAAc;IACd,aAAa;IACb,aAAa;CACd,CAAA;AAED,KAAK,UAAU,QAAQ,CAAC,CAAS;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,eAAI,EAAC,CAAC,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,YAAoB;IAC1D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;IACjE,OAAO,QAAQ,EAAE,MAAM,EAAE,IAAI,KAAK,CAAA;AACpC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAe,EAAE,YAAoB;IACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;IAChE,OAAO,OAAO,EAAE,WAAW,EAAE,IAAI,KAAK,CAAA;AACxC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,eAAe,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAA;IAChD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE;QAAE,OAAO,IAAI,CAAA;IAEpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,eAAe,EAAE,MAAM,CAAC,CAAA;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB,EAAE,IAAY;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,SAAkB,EAAE,IAAc;IAC/D,IAAI,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,MAAM,CAAA;IAC7B,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC/B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,EAAe,EAAE,QAAkB;IACxD,OAAO;QACL,EAAE;QACF,UAAU,EAAE,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxD,QAAQ;KACT,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,UAAgC;IACtD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CACtC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;IAE1C,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAE1D,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,MAAM,CAAC,kBAAkB,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IACpD,MAAM,CAAC,qBAAqB,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IACvD,MAAM,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,YAAY,CAAC,CAAA;IAC/D,MAAM,CAAC,aAAa,EAAE,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,CAAA;IAEnE,MAAM,eAAe,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAA;IAClG,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IAE5D,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAA;IACjE,MAAM,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAA;IAC7D,MAAM,CAAC,eAAe,EAAE,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACrE,MAAM,CAAC,uBAAuB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,UAAU,CAAC,CAAA;IAEtF,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,MAAM,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAA;IACpE,MAAM,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAA;IAC1E,MAAM,CAAC,qBAAqB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,CAAA;IACpF,MAAM,CAAC,qBAAqB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,YAAY,CAAC,CAAA;IACpF,MAAM,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,CAAA;IAE1E,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,MAAM,CAAC,qBAAqB,EAAE,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,eAAe,CAAC,CAAA;IAE7E,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAE3D,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,CAAC,2BAA2B,EAAE,eAAe,EAAE,WAAW,CAAC,CAAA;IACjE,MAAM,CAAC,wBAAwB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,WAAW,CAAC,CAAA;IACzF,MAAM,CAAC,wBAAwB,EAAE,MAAM,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,WAAW,CAAC,CAAA;IACzF,MAAM,CAAC,kBAAkB,EAAE,MAAM,MAAM,CAAC,OAAO,EAAE,mBAAI,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAyB,EAAE,CAAA;IAE3C,IAAI,UAAU,IAAI,UAAU;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAA;IAEpF,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAA;QACtE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;IAEjF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAA;IAE1F,IAAI,eAAe;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;IAE7E,cAAc,CAAC,UAAU,CAAC,CAAA;IAE1B,OAAO,UAAU,CAAA;AACnB,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,OAAe;IAC7D,MAAM,gBAAgB,GAAG,MAAM,IAAA,mBAAE,EAAC,iBAAiB,EAAE;QACnD,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,mBAAmB,EAAE,KAAK;QAC1B,MAAM,EAAE,iBAAiB;KAC1B,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAChG;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAA;IAEpC,KAAK,CAAC,IAAI,EAAE,CAAA;IAEZ,OAAO,KAAK,CAAA;AACd,CAAC;AAEM,KAAK,UAAU,2BAA2B,CAAC,OAAe;IAC/D,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAEtD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAA;IAEvD,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAA;QACtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAErC,MAAM,YAAY,GAAG,mBAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,GAAG,CAAA;QAC/D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;YACnE,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,CAAC,GAAG,YAAY,KAAK,QAAQ,EAAE,CAAC,CAAA;YAC9C,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAyB,EAAE,CAAA;IAE3C,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC7D,CAAC;IAED,cAAc,CAAC,UAAU,CAAC,CAAA;IAE1B,OAAO,UAAU,CAAA;AACnB,CAAC"}
|
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,QAAQ,CAAA;AACtB,cAAc,SAAS,CAAA"}
|
package/dist/index.js
ADDED
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
14
|
+
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
|
+
};
|
|
16
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
+
__exportStar(require("./frameworks"), exports);
|
|
18
|
+
__exportStar(require("./reporters/html"), exports);
|
|
19
|
+
__exportStar(require("./reporters/sarif"), exports);
|
|
20
|
+
__exportStar(require("./scan"), exports);
|
|
21
|
+
__exportStar(require("./types"), exports);
|
|
22
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA4B;AAC5B,mDAAgC;AAChC,oDAAiC;AACjC,yCAAsB;AACtB,0CAAuB"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/reporters/html.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAW1C,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAqDjD"}
|
|
@@ -0,0 +1,64 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.toHtml = toHtml;
|
|
4
|
+
function escapeHtml(input) {
|
|
5
|
+
return input
|
|
6
|
+
.replaceAll('&', '&')
|
|
7
|
+
.replaceAll('<', '<')
|
|
8
|
+
.replaceAll('>', '>')
|
|
9
|
+
.replaceAll('"', '"')
|
|
10
|
+
.replaceAll("'", ''');
|
|
11
|
+
}
|
|
12
|
+
function toHtml(result) {
|
|
13
|
+
const frameworks = result.frameworks.map((f) => escapeHtml(f.id)).join(', ');
|
|
14
|
+
const findings = result.findings
|
|
15
|
+
.map((f) => {
|
|
16
|
+
const location = `${escapeHtml(f.location.path)}:${f.location.startLine}`;
|
|
17
|
+
const title = escapeHtml(f.ruleTitle);
|
|
18
|
+
const message = escapeHtml(f.message);
|
|
19
|
+
const severity = escapeHtml(f.severity.toUpperCase());
|
|
20
|
+
return `
|
|
21
|
+
<div class="finding">
|
|
22
|
+
<div class="finding__header">
|
|
23
|
+
<span class="badge badge--${f.severity}">${severity}</span>
|
|
24
|
+
<span class="finding__rule">${escapeHtml(f.ruleId)}</span>
|
|
25
|
+
</div>
|
|
26
|
+
<div class="finding__title">${title}</div>
|
|
27
|
+
<div class="finding__location">${location}</div>
|
|
28
|
+
<div class="finding__message">${message}</div>
|
|
29
|
+
</div>
|
|
30
|
+
`;
|
|
31
|
+
})
|
|
32
|
+
.join('\n');
|
|
33
|
+
return `<!doctype html>
|
|
34
|
+
<html lang="en">
|
|
35
|
+
<head>
|
|
36
|
+
<meta charset="utf-8" />
|
|
37
|
+
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
38
|
+
<title>VibeSec report</title>
|
|
39
|
+
<style>
|
|
40
|
+
body { font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial; margin: 24px; color: #e5e7eb; background: #0b1220; }
|
|
41
|
+
h1 { margin: 0 0 8px 0; }
|
|
42
|
+
.meta { color: #9ca3af; margin-bottom: 16px; }
|
|
43
|
+
.finding { border: 1px solid #1f2937; border-radius: 10px; padding: 12px; margin: 12px 0; background: #0f172a; }
|
|
44
|
+
.finding__header { display: flex; gap: 10px; align-items: center; margin-bottom: 8px; }
|
|
45
|
+
.finding__rule { color: #cbd5e1; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono"; font-size: 12px; }
|
|
46
|
+
.finding__title { font-weight: 600; margin-bottom: 6px; }
|
|
47
|
+
.finding__location { color: #9ca3af; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono"; font-size: 12px; margin-bottom: 6px; }
|
|
48
|
+
.finding__message { color: #e5e7eb; }
|
|
49
|
+
.badge { display: inline-block; padding: 2px 8px; border-radius: 999px; font-size: 12px; font-weight: 700; text-transform: uppercase; letter-spacing: .02em; }
|
|
50
|
+
.badge--critical { background: #7f1d1d; color: #fecaca; }
|
|
51
|
+
.badge--high { background: #9a3412; color: #ffedd5; }
|
|
52
|
+
.badge--medium { background: #92400e; color: #fef3c7; }
|
|
53
|
+
.badge--low { background: #1f2937; color: #e5e7eb; }
|
|
54
|
+
</style>
|
|
55
|
+
</head>
|
|
56
|
+
<body>
|
|
57
|
+
<h1>VibeSec report</h1>
|
|
58
|
+
<div class="meta">Frameworks: ${frameworks || 'none'} · Findings: ${result.findings.length}</div>
|
|
59
|
+
${findings || '<div class="meta">No findings.</div>'}
|
|
60
|
+
</body>
|
|
61
|
+
</html>
|
|
62
|
+
`;
|
|
63
|
+
}
|
|
64
|
+
//# sourceMappingURL=html.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/reporters/html.ts"],"names":[],"mappings":";;AAWA,wBAqDC;AA9DD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED,SAAgB,MAAM,CAAC,MAAkB;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,QAAQ,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAA;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;QAErD,OAAO;;;wCAG2B,CAAC,CAAC,QAAQ,KAAK,QAAQ;0CACrB,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;wCAEtB,KAAK;2CACF,QAAQ;0CACT,OAAO;;OAE1C,CAAA;IACH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAA;IAEb,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;oCAyB2B,UAAU,IAAI,MAAM,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM;MACxF,QAAQ,IAAI,sCAAsC;;;CAGvD,CAAA;AACD,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
import type { ScanResult } from '../types';
|
|
2
|
+
type SarifLevel = 'error' | 'warning' | 'note';
|
|
3
|
+
type SarifReport = {
|
|
4
|
+
version: '2.1.0';
|
|
5
|
+
$schema: string;
|
|
6
|
+
runs: Array<{
|
|
7
|
+
tool: {
|
|
8
|
+
driver: {
|
|
9
|
+
name: string;
|
|
10
|
+
version: string;
|
|
11
|
+
informationUri?: string;
|
|
12
|
+
rules?: Array<{
|
|
13
|
+
id: string;
|
|
14
|
+
name?: string;
|
|
15
|
+
shortDescription: {
|
|
16
|
+
text: string;
|
|
17
|
+
};
|
|
18
|
+
fullDescription?: {
|
|
19
|
+
text: string;
|
|
20
|
+
};
|
|
21
|
+
help?: {
|
|
22
|
+
text: string;
|
|
23
|
+
};
|
|
24
|
+
properties?: Record<string, unknown>;
|
|
25
|
+
}>;
|
|
26
|
+
};
|
|
27
|
+
};
|
|
28
|
+
results: Array<{
|
|
29
|
+
ruleId: string;
|
|
30
|
+
level: SarifLevel;
|
|
31
|
+
message: {
|
|
32
|
+
text: string;
|
|
33
|
+
};
|
|
34
|
+
locations: Array<{
|
|
35
|
+
physicalLocation: {
|
|
36
|
+
artifactLocation: {
|
|
37
|
+
uri: string;
|
|
38
|
+
};
|
|
39
|
+
region: {
|
|
40
|
+
startLine: number;
|
|
41
|
+
startColumn: number;
|
|
42
|
+
};
|
|
43
|
+
};
|
|
44
|
+
}>;
|
|
45
|
+
partialFingerprints?: Record<string, string>;
|
|
46
|
+
properties?: Record<string, unknown>;
|
|
47
|
+
}>;
|
|
48
|
+
}>;
|
|
49
|
+
};
|
|
50
|
+
export declare function toSarif(result: ScanResult): SarifReport;
|
|
51
|
+
export {};
|
|
52
|
+
//# sourceMappingURL=sarif.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../src/reporters/sarif.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,UAAU,EAAgB,MAAM,UAAU,CAAA;AAEjE,KAAK,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;AAE9C,KAAK,WAAW,GAAG;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,KAAK,CAAC;QACV,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAA;gBACZ,OAAO,EAAE,MAAM,CAAA;gBACf,cAAc,CAAC,EAAE,MAAM,CAAA;gBACvB,KAAK,CAAC,EAAE,KAAK,CAAC;oBACZ,EAAE,EAAE,MAAM,CAAA;oBACV,IAAI,CAAC,EAAE,MAAM,CAAA;oBACb,gBAAgB,EAAE;wBAAE,IAAI,EAAE,MAAM,CAAA;qBAAE,CAAA;oBAClC,eAAe,CAAC,EAAE;wBAAE,IAAI,EAAE,MAAM,CAAA;qBAAE,CAAA;oBAClC,IAAI,CAAC,EAAE;wBAAE,IAAI,EAAE,MAAM,CAAA;qBAAE,CAAA;oBACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;iBACrC,CAAC,CAAA;aACH,CAAA;SACF,CAAA;QACD,OAAO,EAAE,KAAK,CAAC;YACb,MAAM,EAAE,MAAM,CAAA;YACd,KAAK,EAAE,UAAU,CAAA;YACjB,OAAO,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAA;aAAE,CAAA;YACzB,SAAS,EAAE,KAAK,CAAC;gBACf,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE;wBAAE,GAAG,EAAE,MAAM,CAAA;qBAAE,CAAA;oBACjC,MAAM,EAAE;wBAAE,SAAS,EAAE,MAAM,CAAC;wBAAC,WAAW,EAAE,MAAM,CAAA;qBAAE,CAAA;iBACnD,CAAA;aACF,CAAC,CAAA;YACF,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YAC5C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SACrC,CAAC,CAAA;KACH,CAAC,CAAA;CACH,CAAA;AAkBD,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CA2DvD"}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.toSarif = toSarif;
|
|
4
|
+
function sarifLevel(severity) {
|
|
5
|
+
switch (severity) {
|
|
6
|
+
case 'critical':
|
|
7
|
+
case 'high':
|
|
8
|
+
return 'error';
|
|
9
|
+
case 'medium':
|
|
10
|
+
return 'warning';
|
|
11
|
+
case 'low':
|
|
12
|
+
return 'note';
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
function ruleKey(finding) {
|
|
16
|
+
return finding.ruleId;
|
|
17
|
+
}
|
|
18
|
+
function toSarif(result) {
|
|
19
|
+
const rulesById = new Map();
|
|
20
|
+
for (const finding of result.findings) {
|
|
21
|
+
const id = ruleKey(finding);
|
|
22
|
+
if (!rulesById.has(id))
|
|
23
|
+
rulesById.set(id, finding);
|
|
24
|
+
}
|
|
25
|
+
const rules = Array.from(rulesById.values()).map((finding) => ({
|
|
26
|
+
id: finding.ruleId,
|
|
27
|
+
name: finding.ruleId,
|
|
28
|
+
shortDescription: { text: finding.ruleTitle },
|
|
29
|
+
fullDescription: finding.ruleDescription ? { text: finding.ruleDescription } : undefined,
|
|
30
|
+
help: { text: finding.message },
|
|
31
|
+
properties: {
|
|
32
|
+
severity: finding.severity,
|
|
33
|
+
},
|
|
34
|
+
}));
|
|
35
|
+
const results = result.findings.map((finding) => ({
|
|
36
|
+
ruleId: finding.ruleId,
|
|
37
|
+
level: sarifLevel(finding.severity),
|
|
38
|
+
message: { text: finding.message },
|
|
39
|
+
locations: [
|
|
40
|
+
{
|
|
41
|
+
physicalLocation: {
|
|
42
|
+
artifactLocation: { uri: finding.location.path },
|
|
43
|
+
region: {
|
|
44
|
+
startLine: finding.location.startLine,
|
|
45
|
+
startColumn: finding.location.startColumn,
|
|
46
|
+
},
|
|
47
|
+
},
|
|
48
|
+
},
|
|
49
|
+
],
|
|
50
|
+
partialFingerprints: {
|
|
51
|
+
'vibesec/fingerprint': finding.fingerprint,
|
|
52
|
+
},
|
|
53
|
+
properties: {
|
|
54
|
+
severity: finding.severity,
|
|
55
|
+
fingerprint: finding.fingerprint,
|
|
56
|
+
},
|
|
57
|
+
}));
|
|
58
|
+
return {
|
|
59
|
+
version: '2.1.0',
|
|
60
|
+
$schema: 'https://json.schemastore.org/sarif-2.1.0.json',
|
|
61
|
+
runs: [
|
|
62
|
+
{
|
|
63
|
+
tool: {
|
|
64
|
+
driver: {
|
|
65
|
+
name: 'vibesec',
|
|
66
|
+
version: '0.0.0',
|
|
67
|
+
informationUri: 'https://github.com/Reliability-Works/vibesec',
|
|
68
|
+
rules,
|
|
69
|
+
},
|
|
70
|
+
},
|
|
71
|
+
results,
|
|
72
|
+
},
|
|
73
|
+
],
|
|
74
|
+
};
|
|
75
|
+
}
|
|
76
|
+
//# sourceMappingURL=sarif.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../../src/reporters/sarif.ts"],"names":[],"mappings":";;AAuDA,0BA2DC;AA3ED,SAAS,UAAU,CAAC,QAAsB;IACxC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAA;QAChB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAA;QAClB,KAAK,KAAK;YACR,OAAO,MAAM,CAAA;IACjB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED,SAAgB,OAAO,CAAC,MAAkB;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC5C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,EAAE,EAAE,OAAO,CAAC,MAAM;QAClB,IAAI,EAAE,OAAO,CAAC,MAAM;QACpB,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE;QAC7C,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS;QACxF,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;QAC/B,UAAU,EAAE;YACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B;KACF,CAAC,CAAC,CAAA;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;QAClC,SAAS,EAAE;YACT;gBACE,gBAAgB,EAAE;oBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;oBAChD,MAAM,EAAE;wBACN,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;wBACrC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;qBAC1C;iBACF;aACF;SACF;QACD,mBAAmB,EAAE;YACnB,qBAAqB,EAAE,OAAO,CAAC,WAAW;SAC3C;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC;KACF,CAAC,CAAC,CAAA;IAEH,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,+CAA+C;QACxD,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,OAAO;wBAChB,cAAc,EAAE,8CAA8C;wBAC9D,KAAK;qBACN;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAA;AACH,CAAC"}
|
package/dist/scan.d.ts
ADDED
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import type { ScanOptions, ScanResult, Severity, SeverityName } from './types';
|
|
2
|
+
export type SeverityNameInput = SeverityName;
|
|
3
|
+
export declare function severityFromString(name: SeverityNameInput): Severity;
|
|
4
|
+
export declare function scanProject(options: ScanOptions): Promise<ScanResult>;
|
|
5
|
+
//# sourceMappingURL=scan.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAIV,WAAW,EACX,UAAU,EACV,QAAQ,EACR,YAAY,EAEb,MAAM,SAAS,CAAA;AAiBhB,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAE5C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,GAAG,QAAQ,CAWpE;AAsOD,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAkG3E"}
|