@sikkuumiii/defuse 0.0.0-stage → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (236) hide show
  1. package/LICENSE +235 -0
  2. package/README.md +561 -2
  3. package/dist/src/cli.d.ts +20 -0
  4. package/dist/src/cli.js +619 -0
  5. package/dist/src/cli.js.map +1 -0
  6. package/dist/src/core/analyze.d.ts +178 -0
  7. package/dist/src/core/analyze.js +834 -0
  8. package/dist/src/core/analyze.js.map +1 -0
  9. package/dist/src/core/coverage.d.ts +87 -0
  10. package/dist/src/core/coverage.js +181 -0
  11. package/dist/src/core/coverage.js.map +1 -0
  12. package/dist/src/core/finding.d.ts +196 -0
  13. package/dist/src/core/finding.js +178 -0
  14. package/dist/src/core/finding.js.map +1 -0
  15. package/dist/src/core/licence.d.ts +50 -0
  16. package/dist/src/core/licence.js +56 -0
  17. package/dist/src/core/licence.js.map +1 -0
  18. package/dist/src/core/paths.d.ts +21 -0
  19. package/dist/src/core/paths.js +58 -0
  20. package/dist/src/core/paths.js.map +1 -0
  21. package/dist/src/core/score.d.ts +137 -0
  22. package/dist/src/core/score.js +232 -0
  23. package/dist/src/core/score.js.map +1 -0
  24. package/dist/src/dast/targets.d.ts +30 -0
  25. package/dist/src/dast/targets.js +79 -0
  26. package/dist/src/dast/targets.js.map +1 -0
  27. package/dist/src/dast/zap.d.ts +42 -0
  28. package/dist/src/dast/zap.js +184 -0
  29. package/dist/src/dast/zap.js.map +1 -0
  30. package/dist/src/engine/scan.d.ts +80 -0
  31. package/dist/src/engine/scan.js +129 -0
  32. package/dist/src/engine/scan.js.map +1 -0
  33. package/dist/src/engine/shapes.d.ts +47 -0
  34. package/dist/src/engine/shapes.js +328 -0
  35. package/dist/src/engine/shapes.js.map +1 -0
  36. package/dist/src/engine/walk.d.ts +60 -0
  37. package/dist/src/engine/walk.js +156 -0
  38. package/dist/src/engine/walk.js.map +1 -0
  39. package/dist/src/parse/astDump.d.ts +31 -0
  40. package/dist/src/parse/astDump.js +66 -0
  41. package/dist/src/parse/astDump.js.map +1 -0
  42. package/dist/src/parse/languages.d.ts +70 -0
  43. package/dist/src/parse/languages.js +174 -0
  44. package/dist/src/parse/languages.js.map +1 -0
  45. package/dist/src/parse/location.d.ts +17 -0
  46. package/dist/src/parse/location.js +38 -0
  47. package/dist/src/parse/location.js.map +1 -0
  48. package/dist/src/parse/node-grammars.d.ts +12 -0
  49. package/dist/src/parse/node-grammars.js +35 -0
  50. package/dist/src/parse/node-grammars.js.map +1 -0
  51. package/dist/src/parse/parser.d.ts +126 -0
  52. package/dist/src/parse/parser.js +202 -0
  53. package/dist/src/parse/parser.js.map +1 -0
  54. package/dist/src/parse/tree-store.d.ts +139 -0
  55. package/dist/src/parse/tree-store.js +236 -0
  56. package/dist/src/parse/tree-store.js.map +1 -0
  57. package/dist/src/platform/dependency-rule.d.ts +27 -0
  58. package/dist/src/platform/dependency-rule.js +21 -0
  59. package/dist/src/platform/dependency-rule.js.map +1 -0
  60. package/dist/src/platform/deps.d.ts +86 -0
  61. package/dist/src/platform/deps.js +304 -0
  62. package/dist/src/platform/deps.js.map +1 -0
  63. package/dist/src/platform/php-facts.d.ts +49 -0
  64. package/dist/src/platform/php-facts.js +67 -0
  65. package/dist/src/platform/php-facts.js.map +1 -0
  66. package/dist/src/platform/runtime-version.d.ts +78 -0
  67. package/dist/src/platform/runtime-version.js +573 -0
  68. package/dist/src/platform/runtime-version.js.map +1 -0
  69. package/dist/src/report/colors.d.ts +50 -0
  70. package/dist/src/report/colors.js +97 -0
  71. package/dist/src/report/colors.js.map +1 -0
  72. package/dist/src/report/coverage-table.d.ts +90 -0
  73. package/dist/src/report/coverage-table.js +291 -0
  74. package/dist/src/report/coverage-table.js.map +1 -0
  75. package/dist/src/report/html-report.d.ts +66 -0
  76. package/dist/src/report/html-report.js +489 -0
  77. package/dist/src/report/html-report.js.map +1 -0
  78. package/dist/src/report/human.d.ts +44 -0
  79. package/dist/src/report/human.js +575 -0
  80. package/dist/src/report/human.js.map +1 -0
  81. package/dist/src/report/json.d.ts +24 -0
  82. package/dist/src/report/json.js +178 -0
  83. package/dist/src/report/json.js.map +1 -0
  84. package/dist/src/report/mark.d.ts +17 -0
  85. package/dist/src/report/mark.js +39 -0
  86. package/dist/src/report/mark.js.map +1 -0
  87. package/dist/src/report/pricing.d.ts +33 -0
  88. package/dist/src/report/pricing.js +343 -0
  89. package/dist/src/report/pricing.js.map +1 -0
  90. package/dist/src/report/sarif.d.ts +39 -0
  91. package/dist/src/report/sarif.js +219 -0
  92. package/dist/src/report/sarif.js.map +1 -0
  93. package/dist/src/report/site.d.ts +87 -0
  94. package/dist/src/report/site.js +742 -0
  95. package/dist/src/report/site.js.map +1 -0
  96. package/dist/src/rules/code-injection.d.ts +47 -0
  97. package/dist/src/rules/code-injection.js +326 -0
  98. package/dist/src/rules/code-injection.js.map +1 -0
  99. package/dist/src/rules/command-injection.d.ts +30 -0
  100. package/dist/src/rules/command-injection.js +286 -0
  101. package/dist/src/rules/command-injection.js.map +1 -0
  102. package/dist/src/rules/contract.d.ts +198 -0
  103. package/dist/src/rules/contract.js +39 -0
  104. package/dist/src/rules/contract.js.map +1 -0
  105. package/dist/src/rules/format-string.d.ts +46 -0
  106. package/dist/src/rules/format-string.js +146 -0
  107. package/dist/src/rules/format-string.js.map +1 -0
  108. package/dist/src/rules/hardcoded-secret.d.ts +38 -0
  109. package/dist/src/rules/hardcoded-secret.js +440 -0
  110. package/dist/src/rules/hardcoded-secret.js.map +1 -0
  111. package/dist/src/rules/lib/guards.d.ts +168 -0
  112. package/dist/src/rules/lib/guards.js +1179 -0
  113. package/dist/src/rules/lib/guards.js.map +1 -0
  114. package/dist/src/rules/lib/html-safety.d.ts +75 -0
  115. package/dist/src/rules/lib/html-safety.js +755 -0
  116. package/dist/src/rules/lib/html-safety.js.map +1 -0
  117. package/dist/src/rules/lib/local-build.d.ts +59 -0
  118. package/dist/src/rules/lib/local-build.js +320 -0
  119. package/dist/src/rules/lib/local-build.js.map +1 -0
  120. package/dist/src/rules/lib/strings.d.ts +208 -0
  121. package/dist/src/rules/lib/strings.js +1970 -0
  122. package/dist/src/rules/lib/strings.js.map +1 -0
  123. package/dist/src/rules/path-traversal.d.ts +33 -0
  124. package/dist/src/rules/path-traversal.js +96 -0
  125. package/dist/src/rules/path-traversal.js.map +1 -0
  126. package/dist/src/rules/registry.d.ts +19 -0
  127. package/dist/src/rules/registry.js +77 -0
  128. package/dist/src/rules/registry.js.map +1 -0
  129. package/dist/src/rules/sql-injection.d.ts +36 -0
  130. package/dist/src/rules/sql-injection.js +299 -0
  131. package/dist/src/rules/sql-injection.js.map +1 -0
  132. package/dist/src/rules/ssrf.d.ts +39 -0
  133. package/dist/src/rules/ssrf.js +111 -0
  134. package/dist/src/rules/ssrf.js.map +1 -0
  135. package/dist/src/rules/unbounded-copy.d.ts +37 -0
  136. package/dist/src/rules/unbounded-copy.js +147 -0
  137. package/dist/src/rules/unbounded-copy.js.map +1 -0
  138. package/dist/src/rules/unsafe-deserialization.d.ts +43 -0
  139. package/dist/src/rules/unsafe-deserialization.js +276 -0
  140. package/dist/src/rules/unsafe-deserialization.js.map +1 -0
  141. package/dist/src/rules/weak-hash.d.ts +37 -0
  142. package/dist/src/rules/weak-hash.js +197 -0
  143. package/dist/src/rules/weak-hash.js.map +1 -0
  144. package/dist/src/rules/xss.d.ts +38 -0
  145. package/dist/src/rules/xss.js +527 -0
  146. package/dist/src/rules/xss.js.map +1 -0
  147. package/dist/src/taint/content-type.d.ts +19 -0
  148. package/dist/src/taint/content-type.js +20 -0
  149. package/dist/src/taint/content-type.js.map +1 -0
  150. package/dist/src/taint/dictionaries.d.ts +23 -0
  151. package/dist/src/taint/dictionaries.js +1778 -0
  152. package/dist/src/taint/dictionaries.js.map +1 -0
  153. package/dist/src/taint/fold.d.ts +59 -0
  154. package/dist/src/taint/fold.js +1177 -0
  155. package/dist/src/taint/fold.js.map +1 -0
  156. package/dist/src/taint/java-scope.d.ts +61 -0
  157. package/dist/src/taint/java-scope.js +212 -0
  158. package/dist/src/taint/java-scope.js.map +1 -0
  159. package/dist/src/taint/local-map.d.ts +79 -0
  160. package/dist/src/taint/local-map.js +603 -0
  161. package/dist/src/taint/local-map.js.map +1 -0
  162. package/dist/src/taint/project.d.ts +172 -0
  163. package/dist/src/taint/project.js +617 -0
  164. package/dist/src/taint/project.js.map +1 -0
  165. package/dist/src/taint/tracer.d.ts +265 -0
  166. package/dist/src/taint/tracer.js +3817 -0
  167. package/dist/src/taint/tracer.js.map +1 -0
  168. package/dist/src/taint/types.d.ts +484 -0
  169. package/dist/src/taint/types.js +47 -0
  170. package/dist/src/taint/types.js.map +1 -0
  171. package/dist/src/taint/visibility.d.ts +25 -0
  172. package/dist/src/taint/visibility.js +96 -0
  173. package/dist/src/taint/visibility.js.map +1 -0
  174. package/docs/examples/defuse.json +20 -0
  175. package/docs/examples/dvwa-urls.json +14 -0
  176. package/docs/examples/github-code-scanning.yml +54 -0
  177. package/docs/examples/tiny.js +4 -0
  178. package/package.json +73 -4
  179. package/src/cli.ts +747 -0
  180. package/src/core/analyze.ts +1072 -0
  181. package/src/core/coverage.ts +269 -0
  182. package/src/core/finding.ts +311 -0
  183. package/src/core/licence.ts +61 -0
  184. package/src/core/paths.ts +59 -0
  185. package/src/core/score.ts +353 -0
  186. package/src/dast/targets.ts +121 -0
  187. package/src/dast/zap.ts +246 -0
  188. package/src/engine/scan.ts +200 -0
  189. package/src/engine/shapes.ts +348 -0
  190. package/src/engine/walk.ts +196 -0
  191. package/src/parse/astDump.ts +85 -0
  192. package/src/parse/languages.ts +232 -0
  193. package/src/parse/location.ts +44 -0
  194. package/src/parse/node-grammars.ts +41 -0
  195. package/src/parse/parser.ts +262 -0
  196. package/src/parse/tree-store.ts +301 -0
  197. package/src/platform/dependency-rule.ts +33 -0
  198. package/src/platform/deps.ts +374 -0
  199. package/src/platform/php-facts.ts +85 -0
  200. package/src/platform/runtime-version.ts +710 -0
  201. package/src/report/colors.ts +107 -0
  202. package/src/report/coverage-table.ts +359 -0
  203. package/src/report/html-report.ts +601 -0
  204. package/src/report/human.ts +811 -0
  205. package/src/report/json.ts +189 -0
  206. package/src/report/mark.ts +47 -0
  207. package/src/report/pricing.ts +374 -0
  208. package/src/report/sarif.ts +235 -0
  209. package/src/report/site.ts +760 -0
  210. package/src/rules/code-injection.ts +346 -0
  211. package/src/rules/command-injection.ts +296 -0
  212. package/src/rules/contract.ts +220 -0
  213. package/src/rules/format-string.ts +158 -0
  214. package/src/rules/hardcoded-secret.ts +485 -0
  215. package/src/rules/lib/guards.ts +1235 -0
  216. package/src/rules/lib/html-safety.ts +793 -0
  217. package/src/rules/lib/local-build.ts +329 -0
  218. package/src/rules/lib/strings.ts +2034 -0
  219. package/src/rules/path-traversal.ts +101 -0
  220. package/src/rules/registry.ts +90 -0
  221. package/src/rules/sql-injection.ts +311 -0
  222. package/src/rules/ssrf.ts +118 -0
  223. package/src/rules/unbounded-copy.ts +162 -0
  224. package/src/rules/unsafe-deserialization.ts +291 -0
  225. package/src/rules/weak-hash.ts +226 -0
  226. package/src/rules/xss.ts +572 -0
  227. package/src/taint/content-type.ts +20 -0
  228. package/src/taint/dictionaries.ts +1855 -0
  229. package/src/taint/fold.ts +1206 -0
  230. package/src/taint/java-scope.ts +200 -0
  231. package/src/taint/local-map.ts +594 -0
  232. package/src/taint/project.ts +774 -0
  233. package/src/taint/tracer.ts +4298 -0
  234. package/src/taint/types.ts +511 -0
  235. package/src/taint/visibility.ts +100 -0
  236. package/tsconfig.json +61 -0
@@ -0,0 +1,87 @@
1
+ import type { BenchmarkResult, LabelSplitResult } from './coverage-table.js';
2
+ /**
3
+ * THE SITE IS GENERATED, FOR THE SAME REASON THE README BLOCKS ARE.
4
+ * ================================================================
5
+ *
6
+ * A marketing page is the single most likely thing in any project to carry a
7
+ * number the code moved past two months ago. It is written once, in a hurry,
8
+ * by someone who knows the figures by heart - and then it sits there being
9
+ * quietly wrong while the engine improves underneath it.
10
+ *
11
+ * This tool cannot afford that. Its whole claim is that it does not say more
12
+ * than it knows, and a landing page boasting a precision figure the benchmark
13
+ * has since revised would be exactly the failure it sells against.
14
+ *
15
+ * So every figure on the page comes from `docs/benchmark-result.json` and
16
+ * `docs/label-split-result.json`, the rule and language counts come from the
17
+ * registry, and `npm test` fails if `docs/index.html` disagrees with what this
18
+ * function produces. The page cannot be wrong without the build going red.
19
+ *
20
+ * Nothing here is hand-typed except the prose - and the prose makes no
21
+ * quantitative claims at all, which is deliberate rather than lazy.
22
+ *
23
+ *
24
+ * ON THE LOOK.
25
+ * ============
26
+ *
27
+ * ONE ACCENT, AND IT IS THE MARK'S OWN.
28
+ *
29
+ * #792CF7 is not a purple chosen to go with the logo - it is the exact value
30
+ * sampled out of `docs/defuse-mark.png`, and the same value the Instagram
31
+ * carousel uses. An earlier version of this page ran on #9F6BFF, a lighter
32
+ * purple that matched nothing, which is how a brand ends up with three
33
+ * different primaries and no one able to say which is right.
34
+ *
35
+ * The ground (#262626), the raised surface (#2C2C2C), the white (#F5F5F5) and
36
+ * the muted text (#A8A8A8) are all measured out of the carousel for the same
37
+ * reason. The site and the social page are now one thing.
38
+ *
39
+ * PROVEN VERSUS GUESSED IS CARRIED BY VALUE AND SHAPE, NOT BY HUE.
40
+ *
41
+ * This replaces an ice/rose temperature split, and the replacement is better
42
+ * rather than merely different. Any hue pair - green/amber, blue/pink - fails
43
+ * for someone: red-green colour blindness is the most common kind there is,
44
+ * and every one of them dies in a grayscale print. So the distinction is now
45
+ * carried three ways at once, none of which is colour:
46
+ *
47
+ * flow-verified solid filled dot white text solid border
48
+ * signature-based hollow ring muted text dashed border
49
+ *
50
+ * Filled against hollow. Bright against dim. Unbroken against broken. That
51
+ * survives grayscale, every form of colour blindness, and a bad monitor - and
52
+ * it reads as what it means, because a proof is substantial and a guess is an
53
+ * outline. Purple stays a brand colour and never becomes a status colour,
54
+ * which is the mistake that made the previous palette need four accents.
55
+ *
56
+ * GLASS, HONESTLY.
57
+ *
58
+ * Surfaces are translucent over the grid, so the panels read as laid on the
59
+ * page rather than cut into it. Every one also declares a solid base colour
60
+ * underneath, because `backdrop-filter` is the first thing to be switched off
61
+ * on a locked-down machine and a panel that becomes unreadable without it is
62
+ * a decoration pretending to be a layout.
63
+ *
64
+ * MOTION EARNS ITS PLACE ONCE.
65
+ *
66
+ * The trace on the proof section draws itself, source to sink, one hop at a
67
+ * time. That animation IS the product. The glow sweep and the pulsing halos
68
+ * that used to be here were not - they were the house style of every generated
69
+ * landing page on the internet, and they have been removed. Everything that
70
+ * remains is disabled under `prefers-reduced-motion`.
71
+ */
72
+ export declare const esc: (s: string) => string;
73
+ /** The install line, in one place - the hero prints it and the button copies it. */
74
+ export declare const INSTALL_COMMAND = "npx github:Sikkuumi/Defuse scan .";
75
+ /**
76
+ * WHAT EVERY PAGE OF THE SITE SHARES - the fonts, the colours, the base type,
77
+ * the glass surface, the navigation bar and the footer - so the landing page
78
+ * and the pricing page cannot drift apart in the brand they wear.
79
+ */
80
+ export declare const BASE_CSS = " /*\n * THE FONTS ARE SERVED FROM THIS ORIGIN. THE PAGE CALLS NOBODY.\n *\n * This used to be a stylesheet link to fonts.googleapis.com, which meant the\n * homepage of a security tool made a request to a third party before it had\n * drawn anything - handing that third party the visitor's IP address and\n * user agent on the way. The people most likely to open devtools on this\n * page are exactly the people who would notice, and they would be right to.\n *\n * Six files, about 100KB, latin subsets only. Both families are SIL Open\n * Font License 1.1, which permits redistribution and requires the licence to\n * travel with the files - hence docs/fonts/LICENSE-*.txt, which are served\n * alongside rather than being a gesture.\n *\n * font-display:swap draws the text immediately in the fallback and repaints\n * when the real face arrives. The alternative, block, hides the heading until\n * the font loads, and a blank hero is a worse failure than a brief reflow.\n */\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-300-normal.woff2\") format(\"woff2\");font-weight:300;font-style:normal;font-display:swap}\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-400-normal.woff2\") format(\"woff2\");font-weight:400;font-style:normal;font-display:swap}\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-500-normal.woff2\") format(\"woff2\");font-weight:500;font-style:normal;font-display:swap}\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-700-normal.woff2\") format(\"woff2\");font-weight:700;font-style:normal;font-display:swap}\n @font-face{font-family:\"IBM Plex Mono\";src:url(\"fonts/ibm-plex-mono-latin-400-normal.woff2\") format(\"woff2\");font-weight:400;font-style:normal;font-display:swap}\n @font-face{font-family:\"IBM Plex Mono\";src:url(\"fonts/ibm-plex-mono-latin-500-normal.woff2\") format(\"woff2\");font-weight:500;font-style:normal;font-display:swap}\n\n :root{\n /* Ground and surfaces, sampled from the Instagram carousel. */\n --bg:#262626; --panel:#2C2C2C; --raised:#2F2F2F;\n --white:#F5F5F5; --mute:#A8A8A8; --faint:#6E6E6E;\n /* One accent, three tints. #792CF7 is the mark's own value; the lighter two\n exist only so that text on this ground clears contrast - 792CF7 sits at\n 3.4:1, which is fine for a 40px heading and not fine for a 14px line. */\n --brand:#792CF7; --brand-lift:#9153F7; --brand-soft:#A87BFF;\n --line:rgba(245,245,245,.10); --hair:rgba(245,245,245,.06);\n --glass:rgba(245,245,245,.035);\n }\n *{box-sizing:border-box;margin:0;padding:0}\n html{scroll-behavior:smooth}\n body{\n background:var(--bg); color:var(--white);\n font-family:\"Space Grotesk\",system-ui,sans-serif; font-weight:400; line-height:1.6;\n -webkit-font-smoothing:antialiased; overflow-x:hidden;\n /* The 34px grid from the carousel, at the faintest weight that still reads. */\n background-image:\n linear-gradient(rgba(245,245,245,.020) 1px,transparent 1px),\n linear-gradient(90deg,rgba(245,245,245,.020) 1px,transparent 1px);\n background-size:34px 34px;\n }\n .wrap{max-width:1140px;margin:0 auto;padding:0 28px}\n a{color:var(--brand-soft);text-decoration:none;transition:color 200ms ease}\n a:hover{color:var(--white)}\n .mono,code{font-family:\"IBM Plex Mono\",ui-monospace,monospace}\n .kicker{font-family:\"IBM Plex Mono\",monospace;font-size:12px;letter-spacing:2.6px;text-transform:uppercase;color:var(--faint)}\n h1,h2,h3{font-weight:700;letter-spacing:-.9px;line-height:1.06}\n h2{font-size:clamp(32px,4.6vw,52px);margin:18px 0 0}\n p{color:var(--mute);max-width:66ch}\n section{padding:clamp(60px,8vw,104px) 0;border-top:1px solid var(--hair);position:relative}\n\n /* ---------- glass ---------- */\n /* Every glass surface names --panel first, so the layout survives with\n backdrop-filter switched off or unsupported. */\n .glass{\n background:var(--panel); background:linear-gradient(180deg,var(--glass),rgba(245,245,245,.012)),var(--panel);\n -webkit-backdrop-filter:blur(16px) saturate(118%); backdrop-filter:blur(16px) saturate(118%);\n border:1px solid var(--line); border-radius:16px;\n }\n\n";
81
+ export declare const NAV_CSS = " nav{position:relative;display:flex;align-items:center;gap:18px;padding:26px 0}\n nav img{width:29px;height:auto}\n .word{font-weight:700;font-size:25px;letter-spacing:-.6px;color:var(--brand-lift)}\n .navlinks{display:none;gap:30px;margin-left:26px}\n .navlinks a{font-size:14px;color:var(--mute)}\n .navlinks a:hover{color:var(--white)}\n @media(min-width:880px){.navlinks{display:flex}}\n .ghbtn{margin-left:auto;font-family:\"IBM Plex Mono\",monospace;font-size:13px;color:var(--white);border:1px solid var(--line);border-radius:999px;padding:10px 19px;transition:background 220ms ease,border-color 220ms ease}\n .ghbtn:hover{background:var(--glass);border-color:var(--brand-lift);color:var(--white)}\n\n";
82
+ export declare const FOOTER_CSS = " footer{border-top:1px solid var(--hair);padding:46px 0 70px;display:flex;flex-wrap:wrap;gap:18px;align-items:center;justify-content:space-between}\n";
83
+ /** The navigation bar, the same on every page; `page` decides where the section links point. */
84
+ export declare function siteNav(page: 'home' | 'pricing'): string;
85
+ /** The footer, the same on every page. */
86
+ export declare function siteFooter(): string;
87
+ export declare function renderSite(benchmark: BenchmarkResult, split: LabelSplitResult): string;