@sikkuumiii/defuse 0.0.0-stage → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +235 -0
- package/README.md +561 -2
- package/dist/src/cli.d.ts +20 -0
- package/dist/src/cli.js +619 -0
- package/dist/src/cli.js.map +1 -0
- package/dist/src/core/analyze.d.ts +178 -0
- package/dist/src/core/analyze.js +834 -0
- package/dist/src/core/analyze.js.map +1 -0
- package/dist/src/core/coverage.d.ts +87 -0
- package/dist/src/core/coverage.js +181 -0
- package/dist/src/core/coverage.js.map +1 -0
- package/dist/src/core/finding.d.ts +196 -0
- package/dist/src/core/finding.js +178 -0
- package/dist/src/core/finding.js.map +1 -0
- package/dist/src/core/licence.d.ts +50 -0
- package/dist/src/core/licence.js +56 -0
- package/dist/src/core/licence.js.map +1 -0
- package/dist/src/core/paths.d.ts +21 -0
- package/dist/src/core/paths.js +58 -0
- package/dist/src/core/paths.js.map +1 -0
- package/dist/src/core/score.d.ts +137 -0
- package/dist/src/core/score.js +232 -0
- package/dist/src/core/score.js.map +1 -0
- package/dist/src/dast/targets.d.ts +30 -0
- package/dist/src/dast/targets.js +79 -0
- package/dist/src/dast/targets.js.map +1 -0
- package/dist/src/dast/zap.d.ts +42 -0
- package/dist/src/dast/zap.js +184 -0
- package/dist/src/dast/zap.js.map +1 -0
- package/dist/src/engine/scan.d.ts +80 -0
- package/dist/src/engine/scan.js +129 -0
- package/dist/src/engine/scan.js.map +1 -0
- package/dist/src/engine/shapes.d.ts +47 -0
- package/dist/src/engine/shapes.js +328 -0
- package/dist/src/engine/shapes.js.map +1 -0
- package/dist/src/engine/walk.d.ts +60 -0
- package/dist/src/engine/walk.js +156 -0
- package/dist/src/engine/walk.js.map +1 -0
- package/dist/src/parse/astDump.d.ts +31 -0
- package/dist/src/parse/astDump.js +66 -0
- package/dist/src/parse/astDump.js.map +1 -0
- package/dist/src/parse/languages.d.ts +70 -0
- package/dist/src/parse/languages.js +174 -0
- package/dist/src/parse/languages.js.map +1 -0
- package/dist/src/parse/location.d.ts +17 -0
- package/dist/src/parse/location.js +38 -0
- package/dist/src/parse/location.js.map +1 -0
- package/dist/src/parse/node-grammars.d.ts +12 -0
- package/dist/src/parse/node-grammars.js +35 -0
- package/dist/src/parse/node-grammars.js.map +1 -0
- package/dist/src/parse/parser.d.ts +126 -0
- package/dist/src/parse/parser.js +202 -0
- package/dist/src/parse/parser.js.map +1 -0
- package/dist/src/parse/tree-store.d.ts +139 -0
- package/dist/src/parse/tree-store.js +236 -0
- package/dist/src/parse/tree-store.js.map +1 -0
- package/dist/src/platform/dependency-rule.d.ts +27 -0
- package/dist/src/platform/dependency-rule.js +21 -0
- package/dist/src/platform/dependency-rule.js.map +1 -0
- package/dist/src/platform/deps.d.ts +86 -0
- package/dist/src/platform/deps.js +304 -0
- package/dist/src/platform/deps.js.map +1 -0
- package/dist/src/platform/php-facts.d.ts +49 -0
- package/dist/src/platform/php-facts.js +67 -0
- package/dist/src/platform/php-facts.js.map +1 -0
- package/dist/src/platform/runtime-version.d.ts +78 -0
- package/dist/src/platform/runtime-version.js +573 -0
- package/dist/src/platform/runtime-version.js.map +1 -0
- package/dist/src/report/colors.d.ts +50 -0
- package/dist/src/report/colors.js +97 -0
- package/dist/src/report/colors.js.map +1 -0
- package/dist/src/report/coverage-table.d.ts +90 -0
- package/dist/src/report/coverage-table.js +291 -0
- package/dist/src/report/coverage-table.js.map +1 -0
- package/dist/src/report/html-report.d.ts +66 -0
- package/dist/src/report/html-report.js +489 -0
- package/dist/src/report/html-report.js.map +1 -0
- package/dist/src/report/human.d.ts +44 -0
- package/dist/src/report/human.js +575 -0
- package/dist/src/report/human.js.map +1 -0
- package/dist/src/report/json.d.ts +24 -0
- package/dist/src/report/json.js +178 -0
- package/dist/src/report/json.js.map +1 -0
- package/dist/src/report/mark.d.ts +17 -0
- package/dist/src/report/mark.js +39 -0
- package/dist/src/report/mark.js.map +1 -0
- package/dist/src/report/pricing.d.ts +33 -0
- package/dist/src/report/pricing.js +343 -0
- package/dist/src/report/pricing.js.map +1 -0
- package/dist/src/report/sarif.d.ts +39 -0
- package/dist/src/report/sarif.js +219 -0
- package/dist/src/report/sarif.js.map +1 -0
- package/dist/src/report/site.d.ts +87 -0
- package/dist/src/report/site.js +742 -0
- package/dist/src/report/site.js.map +1 -0
- package/dist/src/rules/code-injection.d.ts +47 -0
- package/dist/src/rules/code-injection.js +326 -0
- package/dist/src/rules/code-injection.js.map +1 -0
- package/dist/src/rules/command-injection.d.ts +30 -0
- package/dist/src/rules/command-injection.js +286 -0
- package/dist/src/rules/command-injection.js.map +1 -0
- package/dist/src/rules/contract.d.ts +198 -0
- package/dist/src/rules/contract.js +39 -0
- package/dist/src/rules/contract.js.map +1 -0
- package/dist/src/rules/format-string.d.ts +46 -0
- package/dist/src/rules/format-string.js +146 -0
- package/dist/src/rules/format-string.js.map +1 -0
- package/dist/src/rules/hardcoded-secret.d.ts +38 -0
- package/dist/src/rules/hardcoded-secret.js +440 -0
- package/dist/src/rules/hardcoded-secret.js.map +1 -0
- package/dist/src/rules/lib/guards.d.ts +168 -0
- package/dist/src/rules/lib/guards.js +1179 -0
- package/dist/src/rules/lib/guards.js.map +1 -0
- package/dist/src/rules/lib/html-safety.d.ts +75 -0
- package/dist/src/rules/lib/html-safety.js +755 -0
- package/dist/src/rules/lib/html-safety.js.map +1 -0
- package/dist/src/rules/lib/local-build.d.ts +59 -0
- package/dist/src/rules/lib/local-build.js +320 -0
- package/dist/src/rules/lib/local-build.js.map +1 -0
- package/dist/src/rules/lib/strings.d.ts +208 -0
- package/dist/src/rules/lib/strings.js +1970 -0
- package/dist/src/rules/lib/strings.js.map +1 -0
- package/dist/src/rules/path-traversal.d.ts +33 -0
- package/dist/src/rules/path-traversal.js +96 -0
- package/dist/src/rules/path-traversal.js.map +1 -0
- package/dist/src/rules/registry.d.ts +19 -0
- package/dist/src/rules/registry.js +77 -0
- package/dist/src/rules/registry.js.map +1 -0
- package/dist/src/rules/sql-injection.d.ts +36 -0
- package/dist/src/rules/sql-injection.js +299 -0
- package/dist/src/rules/sql-injection.js.map +1 -0
- package/dist/src/rules/ssrf.d.ts +39 -0
- package/dist/src/rules/ssrf.js +111 -0
- package/dist/src/rules/ssrf.js.map +1 -0
- package/dist/src/rules/unbounded-copy.d.ts +37 -0
- package/dist/src/rules/unbounded-copy.js +147 -0
- package/dist/src/rules/unbounded-copy.js.map +1 -0
- package/dist/src/rules/unsafe-deserialization.d.ts +43 -0
- package/dist/src/rules/unsafe-deserialization.js +276 -0
- package/dist/src/rules/unsafe-deserialization.js.map +1 -0
- package/dist/src/rules/weak-hash.d.ts +37 -0
- package/dist/src/rules/weak-hash.js +197 -0
- package/dist/src/rules/weak-hash.js.map +1 -0
- package/dist/src/rules/xss.d.ts +38 -0
- package/dist/src/rules/xss.js +527 -0
- package/dist/src/rules/xss.js.map +1 -0
- package/dist/src/taint/content-type.d.ts +19 -0
- package/dist/src/taint/content-type.js +20 -0
- package/dist/src/taint/content-type.js.map +1 -0
- package/dist/src/taint/dictionaries.d.ts +23 -0
- package/dist/src/taint/dictionaries.js +1778 -0
- package/dist/src/taint/dictionaries.js.map +1 -0
- package/dist/src/taint/fold.d.ts +59 -0
- package/dist/src/taint/fold.js +1177 -0
- package/dist/src/taint/fold.js.map +1 -0
- package/dist/src/taint/java-scope.d.ts +61 -0
- package/dist/src/taint/java-scope.js +212 -0
- package/dist/src/taint/java-scope.js.map +1 -0
- package/dist/src/taint/local-map.d.ts +79 -0
- package/dist/src/taint/local-map.js +603 -0
- package/dist/src/taint/local-map.js.map +1 -0
- package/dist/src/taint/project.d.ts +172 -0
- package/dist/src/taint/project.js +617 -0
- package/dist/src/taint/project.js.map +1 -0
- package/dist/src/taint/tracer.d.ts +265 -0
- package/dist/src/taint/tracer.js +3817 -0
- package/dist/src/taint/tracer.js.map +1 -0
- package/dist/src/taint/types.d.ts +484 -0
- package/dist/src/taint/types.js +47 -0
- package/dist/src/taint/types.js.map +1 -0
- package/dist/src/taint/visibility.d.ts +25 -0
- package/dist/src/taint/visibility.js +96 -0
- package/dist/src/taint/visibility.js.map +1 -0
- package/docs/examples/defuse.json +20 -0
- package/docs/examples/dvwa-urls.json +14 -0
- package/docs/examples/github-code-scanning.yml +54 -0
- package/docs/examples/tiny.js +4 -0
- package/package.json +73 -4
- package/src/cli.ts +747 -0
- package/src/core/analyze.ts +1072 -0
- package/src/core/coverage.ts +269 -0
- package/src/core/finding.ts +311 -0
- package/src/core/licence.ts +61 -0
- package/src/core/paths.ts +59 -0
- package/src/core/score.ts +353 -0
- package/src/dast/targets.ts +121 -0
- package/src/dast/zap.ts +246 -0
- package/src/engine/scan.ts +200 -0
- package/src/engine/shapes.ts +348 -0
- package/src/engine/walk.ts +196 -0
- package/src/parse/astDump.ts +85 -0
- package/src/parse/languages.ts +232 -0
- package/src/parse/location.ts +44 -0
- package/src/parse/node-grammars.ts +41 -0
- package/src/parse/parser.ts +262 -0
- package/src/parse/tree-store.ts +301 -0
- package/src/platform/dependency-rule.ts +33 -0
- package/src/platform/deps.ts +374 -0
- package/src/platform/php-facts.ts +85 -0
- package/src/platform/runtime-version.ts +710 -0
- package/src/report/colors.ts +107 -0
- package/src/report/coverage-table.ts +359 -0
- package/src/report/html-report.ts +601 -0
- package/src/report/human.ts +811 -0
- package/src/report/json.ts +189 -0
- package/src/report/mark.ts +47 -0
- package/src/report/pricing.ts +374 -0
- package/src/report/sarif.ts +235 -0
- package/src/report/site.ts +760 -0
- package/src/rules/code-injection.ts +346 -0
- package/src/rules/command-injection.ts +296 -0
- package/src/rules/contract.ts +220 -0
- package/src/rules/format-string.ts +158 -0
- package/src/rules/hardcoded-secret.ts +485 -0
- package/src/rules/lib/guards.ts +1235 -0
- package/src/rules/lib/html-safety.ts +793 -0
- package/src/rules/lib/local-build.ts +329 -0
- package/src/rules/lib/strings.ts +2034 -0
- package/src/rules/path-traversal.ts +101 -0
- package/src/rules/registry.ts +90 -0
- package/src/rules/sql-injection.ts +311 -0
- package/src/rules/ssrf.ts +118 -0
- package/src/rules/unbounded-copy.ts +162 -0
- package/src/rules/unsafe-deserialization.ts +291 -0
- package/src/rules/weak-hash.ts +226 -0
- package/src/rules/xss.ts +572 -0
- package/src/taint/content-type.ts +20 -0
- package/src/taint/dictionaries.ts +1855 -0
- package/src/taint/fold.ts +1206 -0
- package/src/taint/java-scope.ts +200 -0
- package/src/taint/local-map.ts +594 -0
- package/src/taint/project.ts +774 -0
- package/src/taint/tracer.ts +4298 -0
- package/src/taint/types.ts +511 -0
- package/src/taint/visibility.ts +100 -0
- package/tsconfig.json +61 -0
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
import type { BenchmarkResult, LabelSplitResult } from './coverage-table.js';
|
|
2
|
+
/**
|
|
3
|
+
* THE SITE IS GENERATED, FOR THE SAME REASON THE README BLOCKS ARE.
|
|
4
|
+
* ================================================================
|
|
5
|
+
*
|
|
6
|
+
* A marketing page is the single most likely thing in any project to carry a
|
|
7
|
+
* number the code moved past two months ago. It is written once, in a hurry,
|
|
8
|
+
* by someone who knows the figures by heart - and then it sits there being
|
|
9
|
+
* quietly wrong while the engine improves underneath it.
|
|
10
|
+
*
|
|
11
|
+
* This tool cannot afford that. Its whole claim is that it does not say more
|
|
12
|
+
* than it knows, and a landing page boasting a precision figure the benchmark
|
|
13
|
+
* has since revised would be exactly the failure it sells against.
|
|
14
|
+
*
|
|
15
|
+
* So every figure on the page comes from `docs/benchmark-result.json` and
|
|
16
|
+
* `docs/label-split-result.json`, the rule and language counts come from the
|
|
17
|
+
* registry, and `npm test` fails if `docs/index.html` disagrees with what this
|
|
18
|
+
* function produces. The page cannot be wrong without the build going red.
|
|
19
|
+
*
|
|
20
|
+
* Nothing here is hand-typed except the prose - and the prose makes no
|
|
21
|
+
* quantitative claims at all, which is deliberate rather than lazy.
|
|
22
|
+
*
|
|
23
|
+
*
|
|
24
|
+
* ON THE LOOK.
|
|
25
|
+
* ============
|
|
26
|
+
*
|
|
27
|
+
* ONE ACCENT, AND IT IS THE MARK'S OWN.
|
|
28
|
+
*
|
|
29
|
+
* #792CF7 is not a purple chosen to go with the logo - it is the exact value
|
|
30
|
+
* sampled out of `docs/defuse-mark.png`, and the same value the Instagram
|
|
31
|
+
* carousel uses. An earlier version of this page ran on #9F6BFF, a lighter
|
|
32
|
+
* purple that matched nothing, which is how a brand ends up with three
|
|
33
|
+
* different primaries and no one able to say which is right.
|
|
34
|
+
*
|
|
35
|
+
* The ground (#262626), the raised surface (#2C2C2C), the white (#F5F5F5) and
|
|
36
|
+
* the muted text (#A8A8A8) are all measured out of the carousel for the same
|
|
37
|
+
* reason. The site and the social page are now one thing.
|
|
38
|
+
*
|
|
39
|
+
* PROVEN VERSUS GUESSED IS CARRIED BY VALUE AND SHAPE, NOT BY HUE.
|
|
40
|
+
*
|
|
41
|
+
* This replaces an ice/rose temperature split, and the replacement is better
|
|
42
|
+
* rather than merely different. Any hue pair - green/amber, blue/pink - fails
|
|
43
|
+
* for someone: red-green colour blindness is the most common kind there is,
|
|
44
|
+
* and every one of them dies in a grayscale print. So the distinction is now
|
|
45
|
+
* carried three ways at once, none of which is colour:
|
|
46
|
+
*
|
|
47
|
+
* flow-verified solid filled dot white text solid border
|
|
48
|
+
* signature-based hollow ring muted text dashed border
|
|
49
|
+
*
|
|
50
|
+
* Filled against hollow. Bright against dim. Unbroken against broken. That
|
|
51
|
+
* survives grayscale, every form of colour blindness, and a bad monitor - and
|
|
52
|
+
* it reads as what it means, because a proof is substantial and a guess is an
|
|
53
|
+
* outline. Purple stays a brand colour and never becomes a status colour,
|
|
54
|
+
* which is the mistake that made the previous palette need four accents.
|
|
55
|
+
*
|
|
56
|
+
* GLASS, HONESTLY.
|
|
57
|
+
*
|
|
58
|
+
* Surfaces are translucent over the grid, so the panels read as laid on the
|
|
59
|
+
* page rather than cut into it. Every one also declares a solid base colour
|
|
60
|
+
* underneath, because `backdrop-filter` is the first thing to be switched off
|
|
61
|
+
* on a locked-down machine and a panel that becomes unreadable without it is
|
|
62
|
+
* a decoration pretending to be a layout.
|
|
63
|
+
*
|
|
64
|
+
* MOTION EARNS ITS PLACE ONCE.
|
|
65
|
+
*
|
|
66
|
+
* The trace on the proof section draws itself, source to sink, one hop at a
|
|
67
|
+
* time. That animation IS the product. The glow sweep and the pulsing halos
|
|
68
|
+
* that used to be here were not - they were the house style of every generated
|
|
69
|
+
* landing page on the internet, and they have been removed. Everything that
|
|
70
|
+
* remains is disabled under `prefers-reduced-motion`.
|
|
71
|
+
*/
|
|
72
|
+
export declare const esc: (s: string) => string;
|
|
73
|
+
/** The install line, in one place - the hero prints it and the button copies it. */
|
|
74
|
+
export declare const INSTALL_COMMAND = "npx github:Sikkuumi/Defuse scan .";
|
|
75
|
+
/**
|
|
76
|
+
* WHAT EVERY PAGE OF THE SITE SHARES - the fonts, the colours, the base type,
|
|
77
|
+
* the glass surface, the navigation bar and the footer - so the landing page
|
|
78
|
+
* and the pricing page cannot drift apart in the brand they wear.
|
|
79
|
+
*/
|
|
80
|
+
export declare const BASE_CSS = " /*\n * THE FONTS ARE SERVED FROM THIS ORIGIN. THE PAGE CALLS NOBODY.\n *\n * This used to be a stylesheet link to fonts.googleapis.com, which meant the\n * homepage of a security tool made a request to a third party before it had\n * drawn anything - handing that third party the visitor's IP address and\n * user agent on the way. The people most likely to open devtools on this\n * page are exactly the people who would notice, and they would be right to.\n *\n * Six files, about 100KB, latin subsets only. Both families are SIL Open\n * Font License 1.1, which permits redistribution and requires the licence to\n * travel with the files - hence docs/fonts/LICENSE-*.txt, which are served\n * alongside rather than being a gesture.\n *\n * font-display:swap draws the text immediately in the fallback and repaints\n * when the real face arrives. The alternative, block, hides the heading until\n * the font loads, and a blank hero is a worse failure than a brief reflow.\n */\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-300-normal.woff2\") format(\"woff2\");font-weight:300;font-style:normal;font-display:swap}\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-400-normal.woff2\") format(\"woff2\");font-weight:400;font-style:normal;font-display:swap}\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-500-normal.woff2\") format(\"woff2\");font-weight:500;font-style:normal;font-display:swap}\n @font-face{font-family:\"Space Grotesk\";src:url(\"fonts/space-grotesk-latin-700-normal.woff2\") format(\"woff2\");font-weight:700;font-style:normal;font-display:swap}\n @font-face{font-family:\"IBM Plex Mono\";src:url(\"fonts/ibm-plex-mono-latin-400-normal.woff2\") format(\"woff2\");font-weight:400;font-style:normal;font-display:swap}\n @font-face{font-family:\"IBM Plex Mono\";src:url(\"fonts/ibm-plex-mono-latin-500-normal.woff2\") format(\"woff2\");font-weight:500;font-style:normal;font-display:swap}\n\n :root{\n /* Ground and surfaces, sampled from the Instagram carousel. */\n --bg:#262626; --panel:#2C2C2C; --raised:#2F2F2F;\n --white:#F5F5F5; --mute:#A8A8A8; --faint:#6E6E6E;\n /* One accent, three tints. #792CF7 is the mark's own value; the lighter two\n exist only so that text on this ground clears contrast - 792CF7 sits at\n 3.4:1, which is fine for a 40px heading and not fine for a 14px line. */\n --brand:#792CF7; --brand-lift:#9153F7; --brand-soft:#A87BFF;\n --line:rgba(245,245,245,.10); --hair:rgba(245,245,245,.06);\n --glass:rgba(245,245,245,.035);\n }\n *{box-sizing:border-box;margin:0;padding:0}\n html{scroll-behavior:smooth}\n body{\n background:var(--bg); color:var(--white);\n font-family:\"Space Grotesk\",system-ui,sans-serif; font-weight:400; line-height:1.6;\n -webkit-font-smoothing:antialiased; overflow-x:hidden;\n /* The 34px grid from the carousel, at the faintest weight that still reads. */\n background-image:\n linear-gradient(rgba(245,245,245,.020) 1px,transparent 1px),\n linear-gradient(90deg,rgba(245,245,245,.020) 1px,transparent 1px);\n background-size:34px 34px;\n }\n .wrap{max-width:1140px;margin:0 auto;padding:0 28px}\n a{color:var(--brand-soft);text-decoration:none;transition:color 200ms ease}\n a:hover{color:var(--white)}\n .mono,code{font-family:\"IBM Plex Mono\",ui-monospace,monospace}\n .kicker{font-family:\"IBM Plex Mono\",monospace;font-size:12px;letter-spacing:2.6px;text-transform:uppercase;color:var(--faint)}\n h1,h2,h3{font-weight:700;letter-spacing:-.9px;line-height:1.06}\n h2{font-size:clamp(32px,4.6vw,52px);margin:18px 0 0}\n p{color:var(--mute);max-width:66ch}\n section{padding:clamp(60px,8vw,104px) 0;border-top:1px solid var(--hair);position:relative}\n\n /* ---------- glass ---------- */\n /* Every glass surface names --panel first, so the layout survives with\n backdrop-filter switched off or unsupported. */\n .glass{\n background:var(--panel); background:linear-gradient(180deg,var(--glass),rgba(245,245,245,.012)),var(--panel);\n -webkit-backdrop-filter:blur(16px) saturate(118%); backdrop-filter:blur(16px) saturate(118%);\n border:1px solid var(--line); border-radius:16px;\n }\n\n";
|
|
81
|
+
export declare const NAV_CSS = " nav{position:relative;display:flex;align-items:center;gap:18px;padding:26px 0}\n nav img{width:29px;height:auto}\n .word{font-weight:700;font-size:25px;letter-spacing:-.6px;color:var(--brand-lift)}\n .navlinks{display:none;gap:30px;margin-left:26px}\n .navlinks a{font-size:14px;color:var(--mute)}\n .navlinks a:hover{color:var(--white)}\n @media(min-width:880px){.navlinks{display:flex}}\n .ghbtn{margin-left:auto;font-family:\"IBM Plex Mono\",monospace;font-size:13px;color:var(--white);border:1px solid var(--line);border-radius:999px;padding:10px 19px;transition:background 220ms ease,border-color 220ms ease}\n .ghbtn:hover{background:var(--glass);border-color:var(--brand-lift);color:var(--white)}\n\n";
|
|
82
|
+
export declare const FOOTER_CSS = " footer{border-top:1px solid var(--hair);padding:46px 0 70px;display:flex;flex-wrap:wrap;gap:18px;align-items:center;justify-content:space-between}\n";
|
|
83
|
+
/** The navigation bar, the same on every page; `page` decides where the section links point. */
|
|
84
|
+
export declare function siteNav(page: 'home' | 'pricing'): string;
|
|
85
|
+
/** The footer, the same on every page. */
|
|
86
|
+
export declare function siteFooter(): string;
|
|
87
|
+
export declare function renderSite(benchmark: BenchmarkResult, split: LabelSplitResult): string;
|