@reliabilityworks/core 0.6.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/package.json +1 -1
  2. package/test/astroRulesetCoverage.test.js +29 -0
  3. package/test/expoRulesetCoverage.test.js +29 -0
  4. package/test/fixtures/monorepo/apps/astro/src/pages/astro-rules.astro +75 -0
  5. package/test/fixtures/monorepo/apps/expo/app.json +65 -1
  6. package/test/fixtures/monorepo/apps/expo/eas.json +27 -0
  7. package/test/fixtures/monorepo/apps/expo/src.ts +15 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@reliabilityworks/core",
3
- "version": "0.6.0",
3
+ "version": "0.8.0",
4
4
  "main": "dist/index.js",
5
5
  "types": "dist/index.d.ts",
6
6
  "scripts": {
package/test/astroRulesetCoverage.test.js ADDED
@@ -0,0 +1,29 @@
1
+ const assert = require('node:assert/strict')
2
+ const fs = require('node:fs/promises')
3
+ const path = require('node:path')
4
+ const test = require('node:test')
5
+
6
+ const { scanProject } = require('../dist/index.js')
7
+
8
+ test('astro ruleset has fixture coverage', async () => {
9
+ const fixtureRoot = path.join(__dirname, 'fixtures', 'monorepo', 'apps', 'astro')
10
+ const rulesPath = path.join(__dirname, '..', '..', 'rulesets', 'astro', 'rules.json')
11
+
12
+ const raw = await fs.readFile(rulesPath, 'utf8')
13
+ const rules = JSON.parse(raw)
14
+
15
+ assert.ok(Array.isArray(rules))
16
+ assert.ok(rules.length >= 60, `Expected at least 60 astro rules, got ${rules.length}`)
17
+
18
+ const expectedIds = rules.map((r) => r.id)
19
+ const result = await scanProject({
20
+ rootDir: fixtureRoot,
21
+ pathBaseDir: fixtureRoot,
22
+ additionalRules: rules,
23
+ })
24
+
25
+ const foundIds = new Set(result.findings.map((finding) => finding.ruleId))
26
+ const missing = expectedIds.filter((id) => !foundIds.has(id))
27
+
28
+ assert.equal(missing.length, 0, `Missing astro fixture coverage for: ${missing.join(', ')}`)
29
+ })
package/test/expoRulesetCoverage.test.js ADDED
@@ -0,0 +1,29 @@
1
+ const assert = require('node:assert/strict')
2
+ const fs = require('node:fs/promises')
3
+ const path = require('node:path')
4
+ const test = require('node:test')
5
+
6
+ const { scanProject } = require('../dist/index.js')
7
+
8
+ test('expo ruleset has fixture coverage', async () => {
9
+ const fixtureRoot = path.join(__dirname, 'fixtures', 'monorepo', 'apps', 'expo')
10
+ const rulesPath = path.join(__dirname, '..', '..', 'rulesets', 'expo', 'rules.json')
11
+
12
+ const raw = await fs.readFile(rulesPath, 'utf8')
13
+ const rules = JSON.parse(raw)
14
+
15
+ assert.ok(Array.isArray(rules))
16
+ assert.ok(rules.length >= 60, `Expected at least 60 expo rules, got ${rules.length}`)
17
+
18
+ const expectedIds = rules.map((r) => r.id)
19
+ const result = await scanProject({
20
+ rootDir: fixtureRoot,
21
+ pathBaseDir: fixtureRoot,
22
+ additionalRules: rules,
23
+ })
24
+
25
+ const foundIds = new Set(result.findings.map((finding) => finding.ruleId))
26
+ const missing = expectedIds.filter((id) => !foundIds.has(id))
27
+
28
+ assert.equal(missing.length, 0, `Missing expo fixture coverage for: ${missing.join(', ')}`)
29
+ })
package/test/fixtures/monorepo/apps/astro/src/pages/astro-rules.astro ADDED
@@ -0,0 +1,75 @@
1
+ ---
2
+ const a = "document.cookie"
3
+ const b = "response.headers.set('Location', '/login')"
4
+ const c = "Authorization: Basic dXNlcjpwYXNz"
5
+ const d = "Authorization: Bearer not-a-real-token"
6
+ const e = "Astro.url.searchParams.get('next')"
7
+ const f = "Astro.cookies.get('sid')"
8
+ const g = "Astro.cookies.set('sid', '1')"
9
+ const h = "Astro.redirect('/login')"
10
+ const i = "/graphql"
11
+ const j = "eval(\"alert(1)\")"
12
+ const k = "new Function('return 1')"
13
+ const l = "insertAdjacentHTML('<div>')"
14
+ const m = "document.write('<div>')"
15
+ const n = "parseFromString('<div>')"
16
+ const o = "localStorage"
17
+ const p = "sessionStorage"
18
+ const q = "addEventListener('message'"
19
+ const r = ".postMessage('hello')"
20
+ const s = "fetch('http://example.com')"
21
+ const t = "el.innerHTML = '<div>unsafe</div>'"
22
+ ---
23
+
24
+ <head>
25
+ <meta
26
+ http-equiv="Content-Security-Policy"
27
+ content="script-src 'unsafe-inline' 'unsafe-eval' http://example.com"
28
+ />
29
+ <meta http-equiv="refresh" content="0;url=http://example.com" />
30
+ </head>
31
+
32
+ <div
33
+ style="color: red"
34
+ onclick="alert(1)"
35
+ onerror="alert(1)"
36
+ onload="alert(1)"
37
+ onmouseover="1"
38
+ onfocus="1"
39
+ onblur="1"
40
+ onchange="1"
41
+ onsubmit="1"
42
+ onkeyup="1"
43
+ onkeydown="1"
44
+ onkeypress="1"
45
+ onmouseenter="1"
46
+ onmouseleave="1"
47
+ ></div>
48
+
49
+ <a href="javascript:alert(1)" target="_blank" referrerpolicy="unsafe-url">x</a>
50
+
51
+ <img src="http://example.com/x.png" onerror="alert(1)" />
52
+ <img src="data:image/svg+xml,<svg onload=alert(1)></svg>" />
53
+
54
+ <iframe src="http://example.com"></iframe>
55
+ <iframe
56
+ src="http://example.com"
57
+ srcdoc="<img src=x onerror=alert(1)>"
58
+ sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-top-navigation allow-forms"
59
+ ></iframe>
60
+
61
+ <object data="http://example.com"></object>
62
+ <embed src="http://example.com"></embed>
63
+
64
+ <svg></svg>
65
+ <math></math>
66
+
67
+ <script src="http://example.com/app.js"></script>
68
+ <script src="data:text/javascript,alert(1)"></script>
69
+ <link rel="stylesheet" href="http://example.com/app.css" />
70
+
71
+ <video src="http://example.com/v.mp4"></video>
72
+ <audio src="http://example.com/a.mp3"></audio>
73
+
74
+ <input type="password" />
75
+ <input type="file" />
package/test/fixtures/monorepo/apps/expo/app.json CHANGED
@@ -1,5 +1,69 @@
1
1
  {
2
2
  "expo": {
3
- "name": "Expo App"
3
+ "name": "Expo App",
4
+ "scheme": "http",
5
+ "extra": {
6
+ "secret": "REDACTED_SECRET",
7
+ "token": "REDACTED_TOKEN"
8
+ },
9
+ "updates": {
10
+ "url": "http://updates.example.com",
11
+ "fallbackToCacheTimeout": 0
12
+ },
13
+ "android": {
14
+ "usesCleartextTraffic": true,
15
+ "allowBackup": true,
16
+ "requestLegacyExternalStorage": true,
17
+ "networkSecurityConfig": "@xml/network_security_config",
18
+ "permissions": [
19
+ "android.permission.CAMERA",
20
+ "android.permission.RECORD_AUDIO",
21
+ "android.permission.READ_SMS",
22
+ "android.permission.SEND_SMS",
23
+ "android.permission.READ_CONTACTS",
24
+ "android.permission.WRITE_CONTACTS",
25
+ "android.permission.ACCESS_FINE_LOCATION",
26
+ "android.permission.ACCESS_BACKGROUND_LOCATION",
27
+ "android.permission.READ_PHONE_STATE",
28
+ "android.permission.READ_CALL_LOG",
29
+ "android.permission.WRITE_CALL_LOG",
30
+ "android.permission.MANAGE_EXTERNAL_STORAGE",
31
+ "android.permission.SYSTEM_ALERT_WINDOW",
32
+ "android.permission.REQUEST_INSTALL_PACKAGES",
33
+ "android.permission.PACKAGE_USAGE_STATS",
34
+ "android.permission.BIND_ACCESSIBILITY_SERVICE"
35
+ ],
36
+ "intentFilters": [
37
+ {
38
+ "action": "VIEW",
39
+ "autoVerify": true,
40
+ "data": [
41
+ {
42
+ "scheme": "https",
43
+ "host": "*",
44
+ "pathPrefix": "/"
45
+ }
46
+ ],
47
+ "category": ["BROWSABLE", "DEFAULT"]
48
+ }
49
+ ]
50
+ },
51
+ "ios": {
52
+ "infoPlist": {
53
+ "NSAllowsArbitraryLoads": true,
54
+ "NSAllowsArbitraryLoadsInWebContent": true,
55
+ "NSAllowsArbitraryLoadsForMedia": true,
56
+ "NSAllowsArbitraryLoadsForWebContent": true,
57
+ "NSExceptionAllowsInsecureHTTPLoads": true,
58
+ "NSExceptionMinimumTLSVersion": "TLSv1.0",
59
+ "NSAllowsLocalNetworking": true,
60
+ "UIFileSharingEnabled": true,
61
+ "LSSupportsOpeningDocumentsInPlace": true,
62
+ "get-task-allow": true,
63
+ "com.apple.developer.associated-domains": ["applinks:*"],
64
+ "keychain-access-groups": ["group.example.shared"],
65
+ "NSUserTrackingUsageDescription": "We track for analytics."
66
+ }
67
+ }
4
68
  }
5
69
  }
package/test/fixtures/monorepo/apps/expo/eas.json ADDED
@@ -0,0 +1,27 @@
1
+ {
2
+ "build": {
3
+ "production": {
4
+ "developmentClient": true,
5
+ "distribution": "internal",
6
+ "credentialsSource": "local",
7
+ "android": {
8
+ "buildType": "apk"
9
+ },
10
+ "ios": {
11
+ "simulator": true
12
+ },
13
+ "env": {
14
+ "OPENAI_API_KEY": "REDACTED",
15
+ "SENTRY_AUTH_TOKEN": "REDACTED",
16
+ "GOOGLE_SERVICES_JSON": "REDACTED",
17
+ "STRIPE_SECRET_KEY": "REDACTED",
18
+ "AWS_ACCESS_KEY_ID": "REDACTED",
19
+ "AWS_SECRET_ACCESS_KEY": "REDACTED",
20
+ "DATABASE_URL": "postgres://example:example@localhost:5432/example",
21
+ "JWT_SECRET": "REDACTED",
22
+ "PRIVATE_KEY": "REDACTED_PRIVATE_KEY",
23
+ "FIREBASE_PRIVATE_KEY": "REDACTED_FIREBASE_PRIVATE_KEY"
24
+ }
25
+ }
26
+ }
27
+ }
package/test/fixtures/monorepo/apps/expo/src.ts CHANGED
@@ -1 +1,15 @@
1
- export const fixture = "AsyncStorage.setItem('auth_token', 'not-a-real-token')"
1
+ export const fixture = `
2
+ AsyncStorage.setItem('auth_token', 'not-a-real-token')
3
+
4
+ Linking.getInitialURL()
5
+ Linking.openURL('https://example.com')
6
+ WebBrowser.openBrowserAsync('https://example.com')
7
+
8
+ fetch('http://insecure.example.com')
9
+
10
+ console.log('token', 'not-a-real-token')
11
+
12
+ Math.random()
13
+
14
+ Notifications.getExpoPushTokenAsync()
15
+ `