@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.34
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +10 -6
- package/dist/parser.js +2 -1
- package/dist/pseudo/hostname.js +3 -1
- package/dist/pseudo/malware.d.ts +3 -16
- package/dist/pseudo/malware.js +11 -171
- package/dist/pseudo/scripts.js +1 -1
- package/dist/pseudo/vuln.d.ts +22 -0
- package/dist/pseudo/vuln.js +220 -0
- package/dist/pseudo.js +3 -3
- package/dist/types.d.ts +3 -2
- package/package.json +19 -10
- package/skills/dss-query/REFERENCE.md +123 -0
- package/skills/dss-query/SKILL.md +190 -0
- package/skills/dss-query/evals/README.md +79 -0
- package/skills/dss-query/evals/evals.json +89 -0
- package/skills/dss-query/evals/grade.mjs +480 -0
- package/src/attribute.ts +186 -0
- package/src/combinator.ts +132 -0
- package/src/id.ts +46 -0
- package/src/index.ts +620 -0
- package/src/parser.ts +122 -0
- package/src/pseudo/abandoned.ts +9 -0
- package/src/pseudo/attr.ts +92 -0
- package/src/pseudo/built.ts +19 -0
- package/src/pseudo/confused.ts +29 -0
- package/src/pseudo/cve.ts +93 -0
- package/src/pseudo/cwe.ts +97 -0
- package/src/pseudo/debug.ts +9 -0
- package/src/pseudo/deprecated.ts +9 -0
- package/src/pseudo/dev.ts +18 -0
- package/src/pseudo/diff.ts +90 -0
- package/src/pseudo/dist.ts +144 -0
- package/src/pseudo/dynamic.ts +9 -0
- package/src/pseudo/empty.ts +15 -0
- package/src/pseudo/entropic.ts +9 -0
- package/src/pseudo/env.ts +6 -0
- package/src/pseudo/eval.ts +9 -0
- package/src/pseudo/fs.ts +9 -0
- package/src/pseudo/helpers.ts +106 -0
- package/src/pseudo/host.ts +111 -0
- package/src/pseudo/hostname.ts +156 -0
- package/src/pseudo/license.ts +134 -0
- package/src/pseudo/link.ts +30 -0
- package/src/pseudo/malware.ts +41 -0
- package/src/pseudo/minified.ts +9 -0
- package/src/pseudo/missing.ts +16 -0
- package/src/pseudo/native.ts +9 -0
- package/src/pseudo/network.ts +9 -0
- package/src/pseudo/obfuscated.ts +9 -0
- package/src/pseudo/optional.ts +18 -0
- package/src/pseudo/outdated.ts +305 -0
- package/src/pseudo/overridden.ts +20 -0
- package/src/pseudo/path.ts +146 -0
- package/src/pseudo/peer.ts +18 -0
- package/src/pseudo/prerelease.ts +47 -0
- package/src/pseudo/private.ts +19 -0
- package/src/pseudo/prod.ts +18 -0
- package/src/pseudo/published.ts +248 -0
- package/src/pseudo/registry.ts +29 -0
- package/src/pseudo/root.ts +19 -0
- package/src/pseudo/scanned.ts +20 -0
- package/src/pseudo/score.ts +186 -0
- package/src/pseudo/scripts.ts +54 -0
- package/src/pseudo/semver.ts +320 -0
- package/src/pseudo/severity.ts +231 -0
- package/src/pseudo/shell.ts +9 -0
- package/src/pseudo/shrinkwrap.ts +9 -0
- package/src/pseudo/spec.ts +131 -0
- package/src/pseudo/squat.ts +225 -0
- package/src/pseudo/suspicious.ts +9 -0
- package/src/pseudo/tracker.ts +9 -0
- package/src/pseudo/trivial.ts +9 -0
- package/src/pseudo/type.ts +26 -0
- package/src/pseudo/undesirable.ts +9 -0
- package/src/pseudo/unknown.ts +9 -0
- package/src/pseudo/unmaintained.ts +9 -0
- package/src/pseudo/unpopular.ts +9 -0
- package/src/pseudo/unstable.ts +9 -0
- package/src/pseudo/vuln.ts +273 -0
- package/src/pseudo/workspace.ts +22 -0
- package/src/pseudo.ts +413 -0
- package/src/types.ts +165 -0
- package/tap-snapshots/test/attribute.ts.test.cjs +304 -0
- package/tap-snapshots/test/combinator.ts.test.cjs +333 -0
- package/tap-snapshots/test/id.ts.test.cjs +118 -0
- package/tap-snapshots/test/parser.ts.test.cjs +344 -0
- package/tap-snapshots/test/pseudo/abandoned.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/attr.ts.test.cjs +161 -0
- package/tap-snapshots/test/pseudo/built.ts.test.cjs +70 -0
- package/tap-snapshots/test/pseudo/confused.ts.test.cjs +32 -0
- package/tap-snapshots/test/pseudo/cve.ts.test.cjs +49 -0
- package/tap-snapshots/test/pseudo/cwe.ts.test.cjs +49 -0
- package/tap-snapshots/test/pseudo/debug.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/deprecated.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/dist.ts.test.cjs +30 -0
- package/tap-snapshots/test/pseudo/dynamic.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/empty.ts.test.cjs +50 -0
- package/tap-snapshots/test/pseudo/entropic.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/env.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/eval.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/fs.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/helpers.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/hostname.ts.test.cjs +148 -0
- package/tap-snapshots/test/pseudo/license.ts.test.cjs +41 -0
- package/tap-snapshots/test/pseudo/link.ts.test.cjs +36 -0
- package/tap-snapshots/test/pseudo/malware.ts.test.cjs +22 -0
- package/tap-snapshots/test/pseudo/minified.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/missing.ts.test.cjs +30 -0
- package/tap-snapshots/test/pseudo/native.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/network.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/obfuscated.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/outdated.ts.test.cjs +130 -0
- package/tap-snapshots/test/pseudo/overridden.ts.test.cjs +75 -0
- package/tap-snapshots/test/pseudo/prerelease.ts.test.cjs +101 -0
- package/tap-snapshots/test/pseudo/private.ts.test.cjs +38 -0
- package/tap-snapshots/test/pseudo/published.ts.test.cjs +171 -0
- package/tap-snapshots/test/pseudo/registry.ts.test.cjs +68 -0
- package/tap-snapshots/test/pseudo/root.ts.test.cjs +24 -0
- package/tap-snapshots/test/pseudo/scanned.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/score.ts.test.cjs +239 -0
- package/tap-snapshots/test/pseudo/scripts.ts.test.cjs +61 -0
- package/tap-snapshots/test/pseudo/semver.ts.test.cjs +575 -0
- package/tap-snapshots/test/pseudo/severity.ts.test.cjs +95 -0
- package/tap-snapshots/test/pseudo/shell.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/shrinkwrap.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/spec.ts.test.cjs +148 -0
- package/tap-snapshots/test/pseudo/squat.ts.test.cjs +129 -0
- package/tap-snapshots/test/pseudo/suspicious.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/tracker.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/trivial.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/type.ts.test.cjs +51 -0
- package/tap-snapshots/test/pseudo/undesirable.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/unknown.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/unmaintained.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/unpopular.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/unstable.ts.test.cjs +18 -0
- package/tap-snapshots/test/pseudo/vuln.ts.test.cjs +208 -0
- package/tap-snapshots/test/pseudo/vulnerable.ts.test.cjs +20 -0
- package/tap-snapshots/test/pseudo/workspace.ts.test.cjs +19 -0
- package/tap-snapshots/test/pseudo.ts.test.cjs +1247 -0
- package/test/attribute.ts +266 -0
- package/test/combinator.ts +168 -0
- package/test/fixtures/graph.ts +999 -0
- package/test/fixtures/selector.ts +103 -0
- package/test/fixtures/types.ts +7 -0
- package/test/id.ts +102 -0
- package/test/index.ts +1000 -0
- package/test/parser.ts +117 -0
- package/test/pseudo/abandoned.ts +98 -0
- package/test/pseudo/attr.ts +298 -0
- package/test/pseudo/built.ts +214 -0
- package/test/pseudo/confused.ts +160 -0
- package/test/pseudo/cve.ts +249 -0
- package/test/pseudo/cwe.ts +255 -0
- package/test/pseudo/debug.ts +98 -0
- package/test/pseudo/deprecated.ts +98 -0
- package/test/pseudo/dev.ts +61 -0
- package/test/pseudo/diff.ts +417 -0
- package/test/pseudo/dist.ts +215 -0
- package/test/pseudo/dynamic.ts +98 -0
- package/test/pseudo/empty.ts +108 -0
- package/test/pseudo/entropic.ts +101 -0
- package/test/pseudo/env.ts +98 -0
- package/test/pseudo/eval.ts +98 -0
- package/test/pseudo/fs.ts +98 -0
- package/test/pseudo/helpers.ts +370 -0
- package/test/pseudo/host-context.ts +276 -0
- package/test/pseudo/hostname.ts +314 -0
- package/test/pseudo/license.ts +265 -0
- package/test/pseudo/link.ts +94 -0
- package/test/pseudo/malware.ts +184 -0
- package/test/pseudo/minified.ts +98 -0
- package/test/pseudo/missing.ts +111 -0
- package/test/pseudo/native.ts +98 -0
- package/test/pseudo/network.ts +98 -0
- package/test/pseudo/obfuscated.ts +98 -0
- package/test/pseudo/optional.ts +73 -0
- package/test/pseudo/outdated.ts +331 -0
- package/test/pseudo/overridden.ts +317 -0
- package/test/pseudo/path.ts +680 -0
- package/test/pseudo/peer.ts +101 -0
- package/test/pseudo/prerelease.ts +279 -0
- package/test/pseudo/private.ts +108 -0
- package/test/pseudo/prod.ts +61 -0
- package/test/pseudo/published.ts +557 -0
- package/test/pseudo/registry.ts +122 -0
- package/test/pseudo/root.ts +66 -0
- package/test/pseudo/scanned.ts +78 -0
- package/test/pseudo/score.ts +591 -0
- package/test/pseudo/scripts.ts +294 -0
- package/test/pseudo/semver.ts +822 -0
- package/test/pseudo/severity.ts +310 -0
- package/test/pseudo/shell.ts +98 -0
- package/test/pseudo/shrinkwrap.ts +98 -0
- package/test/pseudo/spec.ts +525 -0
- package/test/pseudo/squat.ts +565 -0
- package/test/pseudo/suspicious.ts +98 -0
- package/test/pseudo/tracker.ts +98 -0
- package/test/pseudo/trivial.ts +98 -0
- package/test/pseudo/type.ts +105 -0
- package/test/pseudo/undesirable.ts +98 -0
- package/test/pseudo/unknown.ts +98 -0
- package/test/pseudo/unmaintained.ts +98 -0
- package/test/pseudo/unpopular.ts +98 -0
- package/test/pseudo/unstable.ts +98 -0
- package/test/pseudo/vuln.ts +625 -0
- package/test/pseudo/vulnerable.ts +137 -0
- package/test/pseudo/workspace.ts +111 -0
- package/test/pseudo.ts +558 -0
- package/tsconfig.json +3 -0
- package/tsconfig.publish.json +19 -0
- package/tsconfig.publish.tsbuildinfo +1 -0
- package/typedoc.mjs +2 -0
- package/dist/pseudo/vulnerable.d.ts +0 -8
- package/dist/pseudo/vulnerable.js +0 -17
|
@@ -0,0 +1,132 @@
|
|
|
1
|
+
import { asCombinatorNode } from '@vltpkg/dss-parser'
|
|
2
|
+
import { error } from '@vltpkg/error-cause'
|
|
3
|
+
import type { EdgeLike, NodeLike } from '@vltpkg/types'
|
|
4
|
+
import type { ParserState, ParserFn } from './types.ts'
|
|
5
|
+
|
|
6
|
+
/**
|
|
7
|
+
* Returns a new set of nodes, containing all direct dependencies
|
|
8
|
+
* of the current list of nodes used.
|
|
9
|
+
*
|
|
10
|
+
* ref: https://developer.mozilla.org/en-US/docs/Web/CSS/Child_combinator
|
|
11
|
+
*/
|
|
12
|
+
const childCombinator = async (state: ParserState) => {
|
|
13
|
+
const traverse = new Set(state.partial.nodes)
|
|
14
|
+
state.partial.edges.clear()
|
|
15
|
+
state.partial.nodes.clear()
|
|
16
|
+
|
|
17
|
+
// visit direct children of the current list of nodes
|
|
18
|
+
// collecting refs to these children and the edges that
|
|
19
|
+
// connected them.
|
|
20
|
+
for (const node of traverse) {
|
|
21
|
+
for (const edge of node.edgesOut.values()) {
|
|
22
|
+
if (edge.to) {
|
|
23
|
+
state.partial.edges.add(edge)
|
|
24
|
+
state.partial.nodes.add(edge.to)
|
|
25
|
+
}
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
|
|
29
|
+
return state
|
|
30
|
+
}
|
|
31
|
+
|
|
32
|
+
/**
|
|
33
|
+
* Returns a new set of nodes, containing nodes that are also children
|
|
34
|
+
* of all parent nodes to the current list of nodes used.
|
|
35
|
+
*
|
|
36
|
+
* Note: The subsequent-sibling comparator has a behavior that is
|
|
37
|
+
* somehow approximative of that of its css counterpart, given that
|
|
38
|
+
* in the context of dependency graphs the order of appearance is
|
|
39
|
+
* not necessarily controlled by the end user. The approach for
|
|
40
|
+
* this comparator is to match all siblings of a node.
|
|
41
|
+
*
|
|
42
|
+
* ref: https://developer.mozilla.org/en-US/docs/Web/CSS/Subsequent-sibling_combinator
|
|
43
|
+
*/
|
|
44
|
+
const subsequentSiblingCombinator = async (state: ParserState) => {
|
|
45
|
+
const traverse = new Set(state.partial.nodes)
|
|
46
|
+
state.partial.edges.clear()
|
|
47
|
+
state.partial.nodes.clear()
|
|
48
|
+
|
|
49
|
+
// visits direct parents of the current list of node and then
|
|
50
|
+
// visit their children, collecting refs to all children and edges
|
|
51
|
+
// that are not in the original list of nodes.
|
|
52
|
+
for (const node of traverse) {
|
|
53
|
+
for (const edge of node.edgesIn) {
|
|
54
|
+
const parents: IterableIterator<EdgeLike> =
|
|
55
|
+
edge.from.edgesOut.values()
|
|
56
|
+
for (const edge of parents) {
|
|
57
|
+
if (edge.to && edge.to !== node) {
|
|
58
|
+
state.partial.edges.add(edge)
|
|
59
|
+
state.partial.nodes.add(edge.to)
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
}
|
|
63
|
+
}
|
|
64
|
+
|
|
65
|
+
return state
|
|
66
|
+
}
|
|
67
|
+
|
|
68
|
+
/**
|
|
69
|
+
* Returns a new set of nodes containing all nodes that are descendents
|
|
70
|
+
* to items in the current list of nodes.
|
|
71
|
+
*
|
|
72
|
+
* ref: https://developer.mozilla.org/en-US/docs/Web/CSS/Descendant_combinator
|
|
73
|
+
*/
|
|
74
|
+
const descendentCombinator = async (state: ParserState) => {
|
|
75
|
+
// spaces between tags selectors are a noop
|
|
76
|
+
if (state.prev?.type === 'tag' || state.next?.type === 'tag') {
|
|
77
|
+
return state
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
const traverse = new Set<NodeLike>(state.partial.nodes)
|
|
81
|
+
state.partial.edges.clear()
|
|
82
|
+
state.partial.nodes.clear()
|
|
83
|
+
|
|
84
|
+
// breadth-first traversal of the graph, starting from the current
|
|
85
|
+
// list of nodes, collecting all nodes and edges along the way
|
|
86
|
+
for (const node of traverse) {
|
|
87
|
+
const children = new Set<NodeLike>()
|
|
88
|
+
for (const edge of node.edgesOut.values()) {
|
|
89
|
+
if (edge.to) {
|
|
90
|
+
children.add(edge.to)
|
|
91
|
+
state.partial.edges.add(edge)
|
|
92
|
+
state.partial.nodes.add(edge.to)
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
for (const child of children) {
|
|
96
|
+
traverse.add(child)
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
|
|
100
|
+
return state
|
|
101
|
+
}
|
|
102
|
+
|
|
103
|
+
const combinatorSelectors = {
|
|
104
|
+
'>': childCombinator,
|
|
105
|
+
'~': subsequentSiblingCombinator,
|
|
106
|
+
' ': descendentCombinator,
|
|
107
|
+
}
|
|
108
|
+
|
|
109
|
+
const combinatorSelectorsMap = new Map<string, ParserFn>(
|
|
110
|
+
Object.entries(combinatorSelectors),
|
|
111
|
+
)
|
|
112
|
+
|
|
113
|
+
/**
|
|
114
|
+
* Parse css-style combinators, e.g: `>`, `~` and ` `
|
|
115
|
+
*/
|
|
116
|
+
export const combinator = async (state: ParserState) => {
|
|
117
|
+
await state.cancellable()
|
|
118
|
+
|
|
119
|
+
const curr = asCombinatorNode(state.current)
|
|
120
|
+
const parserFn =
|
|
121
|
+
curr.value && combinatorSelectorsMap.get(curr.value)
|
|
122
|
+
if (!parserFn) {
|
|
123
|
+
if (state.loose) {
|
|
124
|
+
return state
|
|
125
|
+
}
|
|
126
|
+
|
|
127
|
+
throw error(`Unsupported combinator: ${state.current.value}`, {
|
|
128
|
+
found: state.current,
|
|
129
|
+
})
|
|
130
|
+
}
|
|
131
|
+
return parserFn(state)
|
|
132
|
+
}
|
package/src/id.ts
ADDED
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
import { asIdentifierNode } from '@vltpkg/dss-parser'
|
|
2
|
+
import { error } from '@vltpkg/error-cause'
|
|
3
|
+
import type { ParserState } from './types.ts'
|
|
4
|
+
|
|
5
|
+
/**
|
|
6
|
+
* Parse ids, e.g: `#foo`
|
|
7
|
+
*/
|
|
8
|
+
export const id = async (
|
|
9
|
+
state: ParserState,
|
|
10
|
+
): Promise<ParserState> => {
|
|
11
|
+
const { value } = asIdentifierNode(state.current)
|
|
12
|
+
|
|
13
|
+
/* c8 ignore start - should not be possible */
|
|
14
|
+
if (!value) {
|
|
15
|
+
throw error('Missing identifier name')
|
|
16
|
+
}
|
|
17
|
+
/* c8 ignore stop */
|
|
18
|
+
|
|
19
|
+
// Filter out any edges and their linked
|
|
20
|
+
// nodes if they don't match the id value
|
|
21
|
+
for (const edge of state.partial.edges) {
|
|
22
|
+
if (edge.name !== value) {
|
|
23
|
+
state.partial.edges.delete(edge)
|
|
24
|
+
if (edge.to) {
|
|
25
|
+
state.partial.nodes.delete(edge.to)
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
}
|
|
29
|
+
|
|
30
|
+
// Filter out importer nodes, this extra step is needed
|
|
31
|
+
// to filter out nodes that have no edges linking to them
|
|
32
|
+
for (const node of state.partial.nodes) {
|
|
33
|
+
if (
|
|
34
|
+
node.edgesIn.size === 0 &&
|
|
35
|
+
node.name !== value &&
|
|
36
|
+
state.partial.nodes.has(node)
|
|
37
|
+
) {
|
|
38
|
+
state.partial.nodes.delete(node)
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
|
|
42
|
+
// Increment the idCounter for specificity
|
|
43
|
+
state.specificity.idCounter += 1
|
|
44
|
+
|
|
45
|
+
return state
|
|
46
|
+
}
|