@vaultcompass/vault-guard-core 1.4.4 → 1.4.5

package/dist/scan-output.d.ts

@@ -62,9 +62,24 @@ export interface FormatOptions {
     /**
      * Base directory to render `file` paths relative to.
      * Defaults to `process.cwd()`. Files outside this root are kept absolute.
-     * Pass `null` to skip relativization entirely.
+     * Pass `null` to skip relativization for `formatJson`'s `file` paths and
+     * for SARIF when no {@link scanRoot} is given either. A `scanRoot` still
+     * relativizes SARIF `artifactLocation.uri` (and diagnostic ctx) against
+     * itself in that case, so `cwd: null` does not skip SARIF relativization
+     * on its own.
      */
     cwd?: string | null;
+    /**
+     * Directory actually being scanned (the scan target), when it differs from
+     * {@link cwd}. SARIF only: `artifactLocation.uri` is relativized against
+     * this instead of `cwd`, so a finding outside the process cwd but inside the
+     * scan target still gets a relative uri. Defaults to `cwd`.
+     *
+     * `formatJson` ignores this field. Its `file` paths stay cwd-relative,
+     * because they are what the terminal output and the baseline fingerprints
+     * are keyed on.
+     */
+    scanRoot?: string;
     /** Non-fatal diagnostics to include in structured output. */
     diagnostics?: Diagnostic[];
     /** Scan timing / coverage stats for JSON and SARIF `runs[].properties`. */

package/dist/scan-output.js

@@ -37,24 +37,103 @@ function isWindowsStylePath(p) {
  * SARIF spec requires this even when the scanner itself runs on Windows,
  * where `path.relative` returns backslash-separated paths).
  *
+ * The base is the scan root (the directory actually being scanned), not the
+ * process cwd. Scanning an out-of-tree target from somewhere else used to
+ * leave every uri absolute, which published the developer's home directory
+ * and OS username to whoever reads the Code Scanning upload.
+ *
+ * A file genuinely outside the scan root still stays absolute rather than
+ * becoming a `../..` traversal: SARIF relative references are resolved
+ * against `%SRCROOT%`, so a traversal out of it is not a legal uri, and there
+ * is no other root to express such a path against. In practice this only
+ * happens for a path a caller injected from outside the scan, since every
+ * file the scanner itself walks is under the target it was given -- and a
+ * non-absolute `file` is resolved against cwd below before that check runs,
+ * so a literal `..` traversal segment never reaches the returned uri either.
+ *
  * Picks `path.win32` when either side of the comparison looks like a
  * Windows-style path, so this is correct both when the process itself runs
  * on Windows (native `path` is already `path.win32`) and when a
  * Windows-style path is normalized on a POSIX host (tests, or a SARIF file
  * produced elsewhere and re-normalized).
  */
-function toSarifArtifactUri(file, cwd) {
-    if (cwd === null)
+function toSarifArtifactUri(file, cwd, scanRoot) {
+    if (cwd === null && scanRoot === undefined)
         return file.split('\\').join('/');
-    const base = cwd ?? process.cwd();
-    const impl = isWindowsStylePath(file) || isWindowsStylePath(base) ? path_1.default.win32 : path_1.default;
-    if (!impl.isAbsolute(file))
-        return file.split('\\').join('/');
-    const rel = impl.relative(base, file);
+    const anchor = cwd ?? process.cwd();
+    const impl = isWindowsStylePath(file) || isWindowsStylePath(anchor) ? path_1.default.win32 : path_1.default;
+    const abs = impl.isAbsolute(file) ? file : impl.resolve(anchor, file);
+    const base = resolveSarifBase(anchor, scanRoot, impl);
+    const rel = impl.relative(base, abs);
     if (rel.startsWith('..') || impl.isAbsolute(rel))
-        return file.split('\\').join('/');
+        return abs.split('\\').join('/');
     return (rel || '.').split('\\').join('/');
 }
+/**
+ * The effective SARIF `%SRCROOT%` base. `scanRoot` is honored only when it
+ * is genuinely outside `cwd`: a scan root nested inside cwd (or equal to
+ * it) must not narrow `%SRCROOT%` to a subdirectory, because GitHub Code
+ * Scanning (and any other SARIF consumer) resolves `%SRCROOT%` from its own
+ * knowledge of the checkout, not from this uri -- a uri relative to a
+ * subdirectory would then name a different file entirely. Mirrors
+ * `resolveScanRoot` in `packages/cli/src/utils/scan-utils.ts`, which applies
+ * the same rule when it derives `scanRoot` from the CLI's scan target in the
+ * first place.
+ */
+function resolveSarifBase(cwd, scanRoot, impl) {
+    if (scanRoot === undefined)
+        return cwd;
+    const rel = impl.relative(cwd, scanRoot);
+    if (rel === '' || (!rel.startsWith('..') && !impl.isAbsolute(rel)))
+        return cwd;
+    return scanRoot;
+}
+/**
+ * Diagnostic `ctx` reaches SARIF notifications as `JSON.stringify(d.ctx)`
+ * (see `formatSarif` above), and some diagnostic sources (`fs.permission_denied`,
+ * `file.read_error`) carry the scanned directory or file as an absolute path,
+ * plus a `detail` field that is `String(error)` -- Node's own fs error text
+ * often bakes that same absolute path in (e.g. "EACCES: permission denied,
+ * scandir '/abs/dir'"). Both leak exactly what `artifactLocation.uri`
+ * exists to avoid leaking, so ctx gets the same relativize-or-keep-absolute
+ * treatment before it is stringified into a notification: any absolute-path
+ * ctx value (`dir`, `path`, `file`, or any other field shaped that way) is
+ * run through {@link toSarifArtifactUri}, and any other string value has
+ * literal occurrences of the base directory stripped out.
+ */
+function sanitizeDiagnosticCtxForSarif(ctx, cwd, scanRoot) {
+    if (cwd === null && scanRoot === undefined)
+        return ctx;
+    const anchor = cwd ?? process.cwd();
+    const base = resolveSarifBase(anchor, scanRoot, path_1.default);
+    const out = {};
+    for (const [key, value] of Object.entries(ctx)) {
+        if (typeof value !== 'string') {
+            out[key] = value;
+        }
+        else if (path_1.default.isAbsolute(value)) {
+            out[key] = toSarifArtifactUri(value, cwd, scanRoot);
+        }
+        else {
+            out[key] = stripSarifBasePath(value, base);
+        }
+    }
+    return out;
+}
+/**
+ * Removes literal occurrences of the SARIF base directory from a free-form
+ * string (diagnostic `detail`, which is `String(error)` and can embed the
+ * scanned path inside Node's own message text). This is not a full
+ * relative-path rewrite of the string, just enough to keep the base
+ * directory out of the document, matching what `artifactLocation.uri` does
+ * for the path fields themselves.
+ */
+function stripSarifBasePath(text, base) {
+    if (!text.includes(base))
+        return text;
+    const withTrailingSep = base.endsWith(path_1.default.sep) ? base : base + path_1.default.sep;
+    return text.split(withTrailingSep).join('').split(base).join('.');
+}
 function formatJson(results, opts = {}) {
     const fpCwd = opts.cwd === undefined ? process.cwd() : opts.cwd;
     const output = {
@@ -112,7 +191,10 @@ function formatSarif(results, opts = {}) {
         locations: [
             {
                 physicalLocation: {
-                    artifactLocation: { uri: toSarifArtifactUri(file, opts.cwd), uriBaseId: '%SRCROOT%' },
+                    artifactLocation: {
+                        uri: toSarifArtifactUri(file, opts.cwd, opts.scanRoot),
+                        uriBaseId: '%SRCROOT%',
+                    },
                     region: {
                         startLine: m.line,
                         startColumn: m.column + 1,
@@ -133,7 +215,9 @@ function formatSarif(results, opts = {}) {
         ? opts.diagnostics.map(d => ({
             id: d.code,
             level: d.severity === 'error' ? 'error' : 'warning',
-            message: { text: `${d.code}: ${JSON.stringify(d.ctx)}` },
+            message: {
+                text: `${d.code}: ${JSON.stringify(sanitizeDiagnosticCtxForSarif(d.ctx, opts.cwd, opts.scanRoot))}`,
+            },
         }))
         : undefined;
     const runProps = opts.run !== undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-core",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",