@ulisesgascon/openjs-cna-tools 1.0.0-alpha.3 → 1.0.0-alpha.4

package/README.md

@@ -252,6 +252,32 @@ const { blocked, results } = await publishRecords(entries, {
 })
 ```
 
+### HackerOne weaknesses
+
+HackerOne's REST API reports a finding's weakness as HackerOne's own numeric
+`weakness_id`, not as a CWE number (weakness 26 is "Improper Access Control",
+CWE-284). The taxonomy is shared by every program, so the mapping ships with
+the package as data:
+
+```js
+import { hackerOneWeakness, hackerOneWeaknessProblemType } from '@ulisesgascon/openjs-cna-tools/hackerone'
+
+hackerOneWeakness(26)
+// { cwe: 'CWE-284', name: 'Improper Access Control - Generic' }
+hackerOneWeakness(75)
+// { cwe: null, name: 'Privilege Escalation' }   (a CAPEC entry on HackerOne's side)
+hackerOneWeakness(999999)
+// null                                          (unknown id)
+
+// Ready-made problemTypes[] entry, or null when there is no CWE to put on the record.
+hackerOneWeaknessProblemType(26)
+```
+
+`lib/hackerone/weaknesses.json` is regenerated with
+`node scripts/build-hackerone-weaknesses.js <dump.json>` from the GraphQL
+response the HackerOne web app loads for a report's weakness picker; the
+script documents the shape it expects.
+
 ### Record helpers
 
 Converters only know their own source. The parts of a record that are about
@@ -260,13 +286,14 @@ hardcodes the OpenJS CNA org id, the generator string or the CVSS block
 layout:
 
 ```js
-import { buildCvssMetric, buildProblemType, buildRecordEnvelope } from '@ulisesgascon/openjs-cna-tools/record'
+import { buildCvssMetric, buildDescription, buildProblemType, buildRecordEnvelope } from '@ulisesgascon/openjs-cna-tools/record'
 
 const record = buildRecordEnvelope({
   cveId: 'CVE-2026-0001',
   cna: {
     title: '…',
-    descriptions: [{ lang: 'en', value: '…' }],
+    // plain text in `value`; the Markdown, if any, kept in supportingMedia
+    descriptions: [buildDescription('A flaw in `dns.resolve()` allows **remote** attackers …')],
     affected: [/* … */],
     references: [/* … */],
     // id normalised to CWE-<number>; description is the name, or the id

package/lib/convert/ghsa.js

@@ -24,7 +24,7 @@
 // shape-translation logic is testable without touching the network.
 
 import { USER_AGENT } from '../client.js'
-import { buildCvssMetric, buildProblemType, buildRecordEnvelope } from '../record.js'
+import { buildCvssMetric, buildDescription, buildProblemType, buildRecordEnvelope } from '../record.js'
 import { OPENJS_CNA_ORG_ID } from '../review/schema.js'
 import { parseVersionRange } from './version-range.js'
 
@@ -149,63 +149,15 @@ function stripReferencesSection (md) {
   return refIdx >= 0 ? normalized.slice(0, refIdx).trimEnd() : normalized
 }
 
-// Strip Markdown formatting down to readable plain text. Generic — no
-// hard-coded section names beyond the References block (which is dropped
-// upstream by stripReferencesSection because cna.references[] is its
-// structured home). Headers become "Label:" lines (matches the published
-// OpenJS CVE convention), emphasis/code/links collapse to their text
-// content, list bullets drop the bullet marker, blockquote markers drop.
-function stripMarkdown (md) {
-  if (typeof md !== 'string') return ''
-  // Normalize line endings — GitHub serves CRLF, every regex below uses
-  // `\n` as the line boundary.
-  let text = md.replace(/\r\n/g, '\n').replace(/\r/g, '\n')
-  // Headers → "Label:" (any ATX heading, level 1–6, generic). We use
-  // [ \t]* (not \s*) for leading/trailing whitespace so we don't eat the
-  // preceding/following blank lines — those are what visually separate
-  // the heading label from neighboring paragraphs.
-  text = text.replace(/^[ \t]*#{1,6}[ \t]+(.+?)[ \t]*$/gm, '$1:')
-  // **bold** / __bold__ / *italic* / _italic_ → inner text
-  text = text.replace(/\*\*(.+?)\*\*/g, '$1')
-  text = text.replace(/__(.+?)__/g, '$1')
-  text = text.replace(/(?<![*\w])\*(?!\s)(.+?)(?<!\s)\*(?![*\w])/g, '$1')
-  text = text.replace(/(?<![_\w])_(?!\s)(.+?)(?<!\s)_(?![_\w])/g, '$1')
-  // `inline code` → inner text
-  text = text.replace(/`(.+?)`/g, '$1')
-  // [link](url) → link
-  text = text.replace(/\[(.+?)\]\([^)]+\)/g, '$1')
-  // Bullet / ordered-list markers at line start → strip the marker
-  text = text.replace(/^\s*(?:[-*+]|\d+\.)\s+/gm, '')
-  // Blockquote markers
-  text = text.replace(/^\s*>\s?/gm, '')
-  // Collapse 3+ blank lines to a single blank line.
-  text = text.replace(/\n{3,}/g, '\n\n')
-  return text.trim()
-}
-
 function buildDescriptions (advisory) {
-  // GHSA advisory descriptions are authored in Markdown. MITRE's
-  // descriptions[0].value field is plain-text in every published OpenJS
-  // CVE on record, so we strip the Markdown for the value and put the
-  // (de-duplicated) original Markdown into supportingMedia[0]. The
-  // References block is removed from both representations because its
+  // GHSA advisory descriptions are authored in Markdown; buildDescription
+  // puts the plain text in `value` and keeps the Markdown in
+  // supportingMedia. The References block is removed first because its
   // URLs already live in cna.references[] as structured data.
   const original = (advisory.description ?? '').trim() || (advisory.summary ?? '').trim()
   if (!original) return []
-  const raw = stripReferencesSection(original).trim()
-  if (!raw) return []
-  const plain = stripMarkdown(raw) || raw
-  const description = {
-    lang: 'en',
-    value: plain
-  }
-  // Only attach supportingMedia when the raw Markdown still carries
-  // formatting after the References strip. If plain === raw the markdown
-  // form has nothing extra to offer.
-  if (raw !== plain) {
-    description.supportingMedia = [{ type: 'text/markdown', base64: false, value: raw }]
-  }
-  return [description]
+  const description = buildDescription(stripReferencesSection(original))
+  return description ? [description] : []
 }
 
 function buildAffected (advisory) {

package/lib/hackerone/index.js

@@ -0,0 +1,42 @@
+// HackerOne weakness ids -> CWE.
+//
+// HackerOne identifies a report's weakness by its own numeric id, which is
+// what its REST API exposes as `weakness_id` and what projects end up
+// storing. It is not a CWE number: weakness 26 is "Improper Access Control"
+// (CWE-284), 48 is "Uncontrolled Resource Consumption" (CWE-400). The CWE
+// is a separate attribute of the weakness, and HackerOne's taxonomy is the
+// same for every program, so the mapping ships here as data
+// (./weaknesses.json, regenerated with scripts/build-hackerone-weaknesses.js).
+
+import { createRequire } from 'node:module'
+import { buildProblemType } from '../record.js'
+
+const require = createRequire(import.meta.url)
+const { weaknesses, _generated: generated } = require('./weaknesses.json')
+
+export const HACKERONE_WEAKNESSES_GENERATED = generated
+
+/**
+ * Look a HackerOne weakness id up. Accepts a number or a string.
+ *
+ * Returns `{ cwe, name }` where `cwe` is `CWE-<number>` or `null` for a
+ * weakness HackerOne maps to no CWE (CAPEC entries), or `null` when the id
+ * is unknown.
+ */
+export function hackerOneWeakness (id) {
+  const key = String(id ?? '').trim()
+  if (!/^\d+$/.test(key)) return null
+  const entry = weaknesses[key]
+  return entry ? { cwe: entry.cwe, name: entry.name } : null
+}
+
+/**
+ * The `problemTypes[]` entry for a HackerOne weakness id, or `null` when
+ * the id is unknown or has no CWE. The CWE name on the record is
+ * HackerOne's weakness name.
+ */
+export function hackerOneWeaknessProblemType (id) {
+  const entry = hackerOneWeakness(id)
+  if (!entry?.cwe) return null
+  return buildProblemType({ cweId: entry.cwe, name: entry.name })
+}