@ulisesgascon/openjs-cna-tools 1.0.0-alpha.3 → 1.0.0-alpha.4

package/lib/record.js

@@ -1,8 +1,9 @@
 // Helpers for the parts of a v5.2 CVE Record that are about the record
-// format rather than about where the data came from: the CVSS metric block
-// and the record envelope. Converters (GHSA here, release trackers in
-// downstream projects) build the container fields they know about and use
-// these so the format-level details are written once.
+// format rather than about where the data came from: the description, the
+// CVSS metric block, the problem type and the record envelope. Converters
+// (GHSA here, release trackers in downstream projects) build the container
+// fields they know about and use these so the format-level details are
+// written once.
 
 import { USER_AGENT } from './client.js'
 import { calculateBaseScore, severityFromScore } from './cvss.js'
@@ -12,6 +13,55 @@ import { OPENJS_CNA_ORG_ID } from './review/schema.js'
 // published by the OpenJS CNA carries today.
 export const DATA_VERSION = '5.2'
 
+/**
+ * Strip Markdown formatting down to readable plain text. Generic: headers
+ * become "Label:" lines (the published OpenJS CVE convention), emphasis,
+ * code spans and links collapse to their text, list bullets and blockquote
+ * markers drop, line endings normalise to `\n`.
+ */
+export function stripMarkdown (md) {
+  if (typeof md !== 'string') return ''
+  let text = md.replace(/\r\n/g, '\n').replace(/\r/g, '\n')
+  // Headers → "Label:" (any ATX heading, level 1–6). [ \t]* rather than
+  // \s* so the blank lines around the heading survive.
+  text = text.replace(/^[ \t]*#{1,6}[ \t]+(.+?)[ \t]*$/gm, '$1:')
+  // **bold** / __bold__ / *italic* / _italic_ → inner text
+  text = text.replace(/\*\*(.+?)\*\*/g, '$1')
+  text = text.replace(/__(.+?)__/g, '$1')
+  text = text.replace(/(?<![*\w])\*(?!\s)(.+?)(?<!\s)\*(?![*\w])/g, '$1')
+  text = text.replace(/(?<![_\w])_(?!\s)(.+?)(?<!\s)_(?![_\w])/g, '$1')
+  // `inline code` → inner text
+  text = text.replace(/`(.+?)`/g, '$1')
+  // [link](url) → link
+  text = text.replace(/\[(.+?)\]\([^)]+\)/g, '$1')
+  // Bullet / ordered-list markers at line start → strip the marker
+  text = text.replace(/^\s*(?:[-*+]|\d+\.)\s+/gm, '')
+  // Blockquote markers
+  text = text.replace(/^\s*>\s?/gm, '')
+  // Collapse 3+ blank lines to a single blank line.
+  text = text.replace(/\n{3,}/g, '\n\n')
+  return text.trim()
+}
+
+/**
+ * Build one `descriptions[]` entry from text that may carry Markdown.
+ *
+ * MITRE's `value` is plain text (NVD and cve.org show it verbatim), so the
+ * Markdown is stripped for `value` and the original is kept in
+ * `supportingMedia` as `text/markdown`, only when the two differ. Returns
+ * `null` for empty input so callers can leave `descriptions` out.
+ */
+export function buildDescription (text, { lang = 'en' } = {}) {
+  const raw = String(text ?? '').replace(/\r\n/g, '\n').replace(/\r/g, '\n').trim()
+  if (!raw) return null
+  const plain = stripMarkdown(raw) || raw
+  const description = { lang, value: plain }
+  if (raw !== plain) {
+    description.supportingMedia = [{ type: 'text/markdown', base64: false, value: raw }]
+  }
+  return description
+}
+
 // Metric block key per CVSS version prefix. v2 is not emitted by anything
 // the foundation publishes, so it is left out on purpose.
 const METRIC_KEYS = new Map([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ulisesgascon/openjs-cna-tools",
-  "version": "1.0.0-alpha.3",
+  "version": "1.0.0-alpha.4",
   "description": "EXPERIMENTAL fork of the OpenJS Foundation CNA tools: CLI and library for the OpenJS CNA API",
   "type": "module",
   "license": "MIT",
@@ -21,7 +21,8 @@
     "./convert": "./lib/convert/ghsa.js",
     "./cvss": "./lib/cvss.js",
     "./record": "./lib/record.js",
-    "./batch": "./lib/batch.js"
+    "./batch": "./lib/batch.js",
+    "./hackerone": "./lib/hackerone/index.js"
   },
   "files": [
     "bin/",