@vltpkg/query 1.0.0-rc.31 → 1.0.0-rc.33

package/src/pseudo/license.ts

@@ -0,0 +1,134 @@
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type LicenseKinds =
+  | 'unlicensed'
+  | 'misc'
+  | 'restricted'
+  | 'ambiguous'
+  | 'copyleft'
+  | 'unknown'
+  | 'none'
+  | 'exception'
+  | undefined
+
+export type LicenseAlertTypes =
+  | 'explicitlyUnlicensedItem'
+  | 'miscLicenseIssues'
+  | 'nonpermissiveLicense'
+  | 'ambiguousClassifier'
+  | 'copyleftLicense'
+  | 'unidentifiedLicense'
+  | 'noLicenseFound'
+  | 'licenseException'
+  | undefined
+
+const kindsMap = new Map<LicenseKinds, LicenseAlertTypes>([
+  ['unlicensed', 'explicitlyUnlicensedItem'],
+  ['misc', 'miscLicenseIssues'],
+  ['restricted', 'nonpermissiveLicense'],
+  ['ambiguous', 'ambiguousClassifier'],
+  ['copyleft', 'copyleftLicense'],
+  ['unknown', 'unidentifiedLicense'],
+  ['none', 'noLicenseFound'],
+  ['exception', 'licenseException'],
+  [undefined, undefined],
+])
+const kinds = new Set(kindsMap.keys())
+
+export const isLicenseKind = (
+  value?: string,
+): value is LicenseKinds => kinds.has(value as LicenseKinds)
+
+export const asLicenseKind = (value?: string): LicenseKinds => {
+  if (!isLicenseKind(value)) {
+    throw error('Expected a valid license kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): { kind: LicenseKinds } => {
+  let kind: LicenseKinds
+
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    kind = asLicenseKind(
+      removeQuotes(
+        asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+          .value,
+      ),
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    kind = asLicenseKind(
+      asTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value,
+    )
+  }
+
+  return { kind }
+}
+
+export const license = async (state: ParserState) => {
+  assertSecurityArchive(state, 'license')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      // No parameters provided - pseudo state form: match ANY license defined (not 'none')
+      for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id)
+        // Exclude if no report or if it has 'noLicenseFound' alert
+        const exclude =
+          !report?.alerts ||
+          report.alerts.some(alert => alert.type === 'noLicenseFound')
+        if (exclude) {
+          removeNode(state, node)
+        }
+      }
+      removeDanglingEdges(state)
+      return state
+    } else {
+      throw error('Failed to parse :license selector', { cause: err })
+    }
+  }
+
+  const { kind } = internals
+  const alertName = kindsMap.get(kind)
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    const exclude = !report?.alerts.some(
+      alert => alert.type === alertName,
+    )
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/link.ts

@@ -0,0 +1,30 @@
+import { splitDepID } from '@vltpkg/dep-id/browser'
+import type { ParserState } from '../types.ts'
+import { removeNode } from './helpers.ts'
+
+/**
+ * :link Pseudo-Selector, matches only nodes that are file links.
+ *
+ * It filters out any node that is not of type 'file' or nodes of 'file'
+ * type that ends with 'tar.gz' since these are local tarballs.
+ */
+export const link = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    const [type, path] = splitDepID(node.id)
+    if (type !== 'file' || path.endsWith('tar.gz') || path === '.') {
+      removeNode(state, node)
+    }
+  }
+
+  for (const edge of state.partial.edges) {
+    if (
+      !edge.spec.file ||
+      edge.spec.file.endsWith('tar.gz') ||
+      edge.spec.file === '.'
+    ) {
+      state.partial.edges.delete(edge)
+    }
+  }
+
+  return state
+}

package/src/pseudo/malware.ts

@@ -0,0 +1,249 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type MalwareKinds =
+  | '0'
+  | '1'
+  | '2'
+  | '3'
+  | 'critical'
+  | 'high'
+  | 'medium'
+  | 'low'
+  | undefined
+
+export type MalwareAlertTypes =
+  'malware' | 'gptMalware' | 'gptSecurity' | 'gptAnomaly' | undefined
+
+export type MalwareComparator = '>' | '<' | '>=' | '<=' | undefined
+
+const kindsMap = new Map<MalwareKinds, MalwareAlertTypes>([
+  ['critical', 'malware'],
+  ['high', 'gptMalware'],
+  ['medium', 'gptSecurity'],
+  ['low', 'gptAnomaly'],
+  ['0', 'malware'],
+  ['1', 'gptMalware'],
+  ['2', 'gptSecurity'],
+  ['3', 'gptAnomaly'],
+])
+
+// Map numerical values to their respective kinds for comparison operations
+const kindLevelMap = new Map<MalwareKinds, number>([
+  ['critical', 0],
+  ['high', 1],
+  ['medium', 2],
+  ['low', 3],
+  ['0', 0],
+  ['1', 1],
+  ['2', 2],
+  ['3', 3],
+])
+
+const kinds = new Set(kindsMap.keys())
+
+export const isMalwareKind = (
+  value?: string,
+): value is MalwareKinds => kinds.has(value as MalwareKinds)
+
+export const asMalwareKind = (value?: string): MalwareKinds => {
+  if (!isMalwareKind(value)) {
+    throw error('Expected a valid malware kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): { kind: MalwareKinds; comparator: MalwareComparator } => {
+  // Handle case where no parameters are provided (parameterless :malware)
+  if (!nodes[0]) {
+    return { kind: undefined, comparator: undefined }
+  }
+
+  const selectorNode = asPostcssNodeWithChildren(nodes[0])
+  if (!selectorNode.nodes[0]) {
+    return { kind: undefined, comparator: undefined }
+  }
+
+  let kindValue = ''
+  let comparator: MalwareComparator = undefined
+  let kind: MalwareKinds
+
+  // Parse the parameter (kind with optional comparator)
+  if (isStringNode(selectorNode.nodes[0])) {
+    kindValue = removeQuotes(
+      asStringNode(selectorNode.nodes[0]).value,
+    )
+  } else if (isTagNode(selectorNode.nodes[0])) {
+    kindValue = asTagNode(selectorNode.nodes[0]).value
+  }
+
+  // Extract comparator if present
+  if (kindValue.startsWith('>=')) {
+    comparator = '>='
+    kindValue = kindValue.substring(2)
+  } else if (kindValue.startsWith('<=')) {
+    comparator = '<='
+    kindValue = kindValue.substring(2)
+  } else if (kindValue.startsWith('>')) {
+    comparator = '>'
+    kindValue = kindValue.substring(1)
+  } else if (kindValue.startsWith('<')) {
+    comparator = '<'
+    kindValue = kindValue.substring(1)
+  }
+
+  // Validate the kind without comparator
+  if (!comparator) {
+    kind = asMalwareKind(kindValue)
+  } else {
+    // For comparisons, just make sure it's a valid numeric value or a valid kind
+    if (isMalwareKind(kindValue)) {
+      kind = kindValue
+    } else {
+      throw error(
+        'Expected a valid malware kind or number between 0-3',
+        {
+          found: kindValue,
+        },
+      )
+    }
+  }
+
+  return { kind, comparator }
+}
+
+/**
+ * :malware Pseudo-Selector, matches nodes with malware alerts.
+ *
+ * Usage:
+ * - :malware - matches malware with severity >= medium (critical, high, medium but not low)
+ * - :malware(critical) - matches specific malware kind
+ * - :malware(>1) - matches malware with severity greater than 1
+ * - :malware(">=medium") - matches malware with severity >= medium
+ */
+export const malware = async (state: ParserState) => {
+  assertSecurityArchive(state, 'malware')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :malware selector', { cause: err })
+  }
+
+  const { kind, comparator } = internals
+  const alertName = comparator ? undefined : kindsMap.get(kind)
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    // Always exclude nodes that don't have security data or alerts
+    if (!report?.alerts || report.alerts.length === 0) {
+      removeNode(state, node)
+    }
+  }
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    let exclude = true
+
+    if (report) {
+      if (kind === undefined && comparator === undefined) {
+        // Parameterless :malware - match malware alerts with severity >= medium (exclude low/gptAnomaly)
+        exclude = !report.alerts.some(
+          alert =>
+            alert.type === 'malware' ||
+            alert.type === 'gptMalware' ||
+            alert.type === 'gptSecurity',
+        )
+      } else if (comparator) {
+        // retrieve the value to compare against
+        const kindLevel = kindLevelMap.get(kind)
+        // the kindLevel value has already been validated at this point
+        // and thus can never return an undefined/falsy value but ts doesn't
+        // know about that, so we have the extra check here
+        /* c8 ignore next - impossible */
+        if (kindLevel == null) break
+
+        // Check each alert to find any that match our comparison criteria
+        for (const alert of report.alerts) {
+          // Get the numerical value of the alert type
+          const alertType = alert.type
+
+          // retrieve a key to the current alert level to be compared against
+          const currentAlertLevelKey = [...kindsMap.entries()].find(
+            ([_, alertValue]) => alertValue === alertType,
+          )?.[0]
+
+          // perform the comparison based on the user-provided kindLevel
+          if (currentAlertLevelKey) {
+            const currentAlertLevel = kindLevelMap.get(
+              currentAlertLevelKey,
+            )
+            /* c8 ignore next - impossible but ts doesn't know */
+            if (currentAlertLevel == null) continue
+
+            switch (comparator) {
+              case '>':
+                if (currentAlertLevel > kindLevel) {
+                  exclude = false
+                }
+                break
+              case '<':
+                if (currentAlertLevel < kindLevel) {
+                  exclude = false
+                }
+                break
+              case '>=':
+                if (currentAlertLevel >= kindLevel) {
+                  exclude = false
+                }
+                break
+              case '<=':
+                if (currentAlertLevel <= kindLevel) {
+                  exclude = false
+                }
+                break
+            }
+
+            // If we've found a match, no need to check other alerts
+            if (!exclude) break
+          }
+        }
+      } else {
+        // Original exact match behavior
+        exclude = !report.alerts.some(
+          alert => alert.type === alertName,
+        )
+      }
+    }
+
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/minified.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **minifiedFile** report alert.
+ */
+export const minified = createSecuritySelectorFilter(
+  'minified',
+  'minifiedFile',
+)

package/src/pseudo/missing.ts

@@ -0,0 +1,16 @@
+import type { ParserState } from '../types.ts'
+
+/**
+ * :missing Pseudo-Selector, matches only edges that are not linked to any node.
+ * It filters out any edges that have a 'to' property, keeping only dangling edges
+ * and clears all nodes from the result.
+ */
+export const missing = async (state: ParserState) => {
+  for (const edge of state.partial.edges) {
+    if (edge.to) {
+      state.partial.edges.delete(edge)
+    }
+  }
+  state.partial.nodes.clear()
+  return state
+}

package/src/pseudo/native.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **hasNativeCode** report alert.
+ */
+export const nativeParser = createSecuritySelectorFilter(
+  'native',
+  'hasNativeCode',
+)

package/src/pseudo/network.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **networkAccess** report alert.
+ */
+export const network = createSecuritySelectorFilter(
+  'network',
+  'networkAccess',
+)

package/src/pseudo/obfuscated.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have an **obfuscatedFile** report alert.
+ */
+export const obfuscated = createSecuritySelectorFilter(
+  'obfuscated',
+  'obfuscatedFile',
+)

package/src/pseudo/optional.ts

@@ -0,0 +1,18 @@
+import type { ParserState } from '../types.ts'
+import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
+
+/**
+ * :optional Pseudo-Selector will only match optional dependencies.
+ */
+export const optional = async (state: ParserState) => {
+  // filter edges that aren't marked as optional
+  for (const edge of state.partial.edges) {
+    if (!edge.optional) {
+      removeEdge(state, edge)
+    }
+  }
+
+  removeUnlinkedNodes(state)
+
+  return state
+}