@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.34

package/src/parser.ts

@@ -0,0 +1,122 @@
+import postcssSelectorParser from 'postcss-selector-parser'
+import {
+  asSelectorNode,
+  isCombinatorNode,
+  isPseudoNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import type { Pseudo, Root } from 'postcss-selector-parser'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+/**
+ * Escapes forward slashes in specific patterns matching @scoped/name paths
+ * This will allow usage of unescaped forward slashes necessary for scoped
+ * package names in the id selector.
+ */
+export const escapeScopedNamesSlashes = (query: string): string =>
+  query.replace(
+    /(#@(\w|-|\.)+)\//gm,
+    (_, scope: string) => `${scope}\\/`,
+  )
+
+export const escapeDots = (query: string): string =>
+  query.replaceAll('.', '\\.')
+
+export const unescapeDots = (query: string): string =>
+  query.replaceAll('\\.', '.')
+
+const pseudoCleanUpNeeded = new Set([
+  ':published',
+  ':score',
+  ':severity',
+  ':sev',
+  ':squat',
+  ':semver',
+  ':v',
+  ':vuln',
+  ':vulnerable',
+  ':path',
+])
+
+const hasParamsToEscape = (node: Pseudo) =>
+  pseudoCleanUpNeeded.has(node.value)
+
+/**
+ * Parses a CSS selector string into an AST
+ * Handles escaping of forward slashes in specific patterns
+ */
+export const parse = (query: string): Root => {
+  const escapedQuery = escapeDots(escapeScopedNamesSlashes(query))
+  const transformAst = (root: Root) => {
+    root.walk((node: PostcssNode) => {
+      // clean up the escaped dots
+      if (node.value && typeof node.value === 'string') {
+        node.value = unescapeDots(node.value)
+      }
+      if (isPseudoNode(node) && hasParamsToEscape(node)) {
+        // these are pseudo nodes that should only take strings as
+        // parameters, so in this preparse step we clean up anything
+        // that was recognized as a postcss node and transform that
+        // into something that can be most likely parsed as a string
+        for (const n of node.nodes) {
+          // the parameters have a selector node that wraps them up
+          const selector = asSelectorNode(n)
+          selector.nodes.forEach((currentNode, index, arr) => {
+            // get the next node, we'll update it later
+            const nextNode = arr[index + 1]
+            // if the current node is a combinator node, we'll need to
+            // escape it, we do so by removing the node entirely and
+            // updating the contents of the next node with its value
+            if (
+              isCombinatorNode(currentNode) &&
+              isTagNode(nextNode)
+            ) {
+              nextNode.value = `${currentNode.spaces.before}${currentNode.value}${currentNode.spaces.after}${nextNode.value}`
+              // make sure to also update the source position
+              // references, those are used by the syntax highlighter
+              if (
+                nextNode.source?.start?.line &&
+                currentNode.source?.start?.line
+              ) {
+                nextNode.source.start.line =
+                  currentNode.source.start.line
+              }
+              if (
+                nextNode.source?.start?.column &&
+                currentNode.source?.start?.column
+              ) {
+                nextNode.source.start.column =
+                  currentNode.source.start.column
+              }
+              // removes the current node from the selector node
+              arr.splice(index, 1)
+            }
+          })
+          // after removing combinator nodes, if we end up with multiple
+          // tags in the selector node, we need to smush them together
+          selector.nodes.reduce((acc, currentNode) => {
+            if (currentNode === acc) return acc
+            acc.value = `${acc.value}${currentNode.spaces.before}${currentNode.value}${currentNode.spaces.after}`
+            // make sure to also update the source position refs
+            if (
+              currentNode.source?.end?.line &&
+              acc.source?.end?.line
+            ) {
+              acc.source.end.line = currentNode.source.end.line
+            }
+            if (
+              currentNode.source?.end?.column &&
+              acc.source?.end?.column
+            ) {
+              acc.source.end.column = currentNode.source.end.column
+            }
+            return acc
+          }, selector.first)
+          // the selector wrapper node should have a single node
+          selector.nodes.length = 1
+        }
+      }
+    })
+  }
+  return postcssSelectorParser(transformAst).astSync(escapedQuery)
+}

package/src/pseudo/abandoned.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **missingAuthor** report alert.
+ */
+export const abandoned = createSecuritySelectorFilter(
+  'abandoned',
+  'missingAuthor',
+)

package/src/pseudo/attr.ts

@@ -0,0 +1,92 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asAttributeNode,
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+} from '@vltpkg/dss-parser'
+import {
+  attributeSelectorsMap,
+  filterAttributes,
+} from '../attribute.ts'
+import { removeQuotes } from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type AttrInternals = {
+  attribute: string
+  insensitive: boolean
+  operator?: string
+  value?: string
+  properties: string[]
+}
+
+/**
+ * Parses the internal / nested selectors of a `:attr` selector.
+ */
+export const parseInternals = (
+  nodes: PostcssNode[],
+): AttrInternals => {
+  // the last part is the attribute selector
+  const attributeSelector = asAttributeNode(
+    asPostcssNodeWithChildren(nodes.pop()).nodes[0],
+  )
+  // all preppending selectors are naming nested properties
+  const properties: string[] = []
+  for (const selector of nodes) {
+    const selectorNode = asPostcssNodeWithChildren(selector).nodes[0]
+    // Handle both quoted string and tag nodes
+    if (isStringNode(selectorNode)) {
+      properties.push(removeQuotes(asStringNode(selectorNode).value))
+    } else {
+      properties.push(asTagNode(selectorNode).value)
+    }
+  }
+  // include the attribute selector as the last part of the property lookup
+  properties.push(attributeSelector.attribute)
+
+  return {
+    attribute: attributeSelector.attribute,
+    insensitive: attributeSelector.insensitive || false,
+    operator: attributeSelector.operator,
+    value: attributeSelector.value,
+    properties,
+  }
+}
+
+/**
+ * :attr Pseudo-Selector, allows for retrieving nodes based on nested
+ * properties of the `package.json` metadata.
+ */
+export const attr = async (state: ParserState) => {
+  // Parses and retrieves the values for the nested selectors
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    throw error('Failed to parse :attr selector', {
+      cause: err,
+    })
+  }
+
+  // reuses the attribute selector logic to filter the nodes
+  const comparator =
+    internals.operator ?
+      attributeSelectorsMap.get(internals.operator)
+    : undefined
+  const value = internals.value || ''
+  const propertyName = internals.attribute
+  const insensitive = internals.insensitive
+  const prefixProperties = internals.properties
+  return filterAttributes(
+    state,
+    comparator,
+    value,
+    propertyName,
+    insensitive,
+    prefixProperties,
+  )
+}

package/src/pseudo/built.ts

@@ -0,0 +1,19 @@
+import type { ParserState } from '../types.ts'
+import { removeNode, removeDanglingEdges } from './helpers.ts'
+
+/**
+ * :built Pseudo-Selector will only match packages that have
+ * a `buildState` property set to 'built', indicating they have
+ * been successfully built during the reify process.
+ */
+export const built = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    if (node.buildState !== 'built') {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/confused.ts

@@ -0,0 +1,29 @@
+import type { ParserState } from '../types.js'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+} from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **manifestConfusion** report alert.
+ * Also includes any node that has been marked as **confused**.
+ */
+export const confused = async (state: ParserState) => {
+  assertSecurityArchive(state, 'confused')
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    const exclude =
+      !node.confused &&
+      !report?.alerts.some(
+        alert => alert.type === 'manifestConfusion',
+      )
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+  return state
+}

package/src/pseudo/cve.ts

@@ -0,0 +1,93 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type CveInternals = {
+  cveId: string | undefined
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): CveInternals => {
+  if (!nodes[0]) {
+    return { cveId: undefined }
+  }
+
+  const selectorNode = asPostcssNodeWithChildren(nodes[0])
+  if (!selectorNode.nodes[0]) {
+    return { cveId: undefined }
+  }
+
+  let cveId = ''
+
+  if (isStringNode(selectorNode.nodes[0])) {
+    cveId = removeQuotes(asStringNode(selectorNode.nodes[0]).value)
+  } else if (isTagNode(selectorNode.nodes[0])) {
+    cveId = asTagNode(selectorNode.nodes[0]).value
+  }
+
+  /* c8 ignore start - unreachable via normal parser */
+  if (!cveId) {
+    throw error('Expected a CVE ID', {
+      found: selectorNode.nodes[0],
+    })
+  }
+  /* c8 ignore stop */
+
+  return { cveId }
+}
+
+/**
+ * Filters out any node that does not have a CVE alert.
+ *
+ * Usage:
+ * - :cve - matches any package with at least one CVE alert
+ * - :cve(CVE-2023-1234) - matches only the specific CVE ID
+ */
+export const cve = async (state: ParserState) => {
+  assertSecurityArchive(state, 'cve')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) /* c8 ignore start */ {
+    throw error('Failed to parse :cve selector', { cause: err })
+  } /* c8 ignore stop */
+
+  const { cveId } = internals
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    let exclude: boolean
+    if (cveId === undefined) {
+      exclude = !report?.alerts.some(alert => alert.props?.cveId)
+    } else {
+      exclude = !report?.alerts.some(
+        alert =>
+          alert.props?.cveId?.trim().toLowerCase() ===
+          cveId.trim().toLowerCase(),
+      )
+    }
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/cwe.ts

@@ -0,0 +1,97 @@
+import { error } from '@vltpkg/error-cause'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type CweInternals = {
+  cweId: string | undefined
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): CweInternals => {
+  if (!nodes[0]) {
+    return { cweId: undefined }
+  }
+
+  const selectorNode = asPostcssNodeWithChildren(nodes[0])
+  if (!selectorNode.nodes[0]) {
+    return { cweId: undefined }
+  }
+
+  let cweId = ''
+
+  if (isStringNode(selectorNode.nodes[0])) {
+    cweId = removeQuotes(asStringNode(selectorNode.nodes[0]).value)
+  } else if (isTagNode(selectorNode.nodes[0])) {
+    cweId = asTagNode(selectorNode.nodes[0]).value
+  }
+
+  /* c8 ignore start - unreachable via normal parser */
+  if (!cweId) {
+    throw error('Expected a CWE ID', {
+      found: selectorNode.nodes[0],
+    })
+  }
+  /* c8 ignore stop */
+
+  return { cweId }
+}
+
+/**
+ * Filters out any node that does not have a CWE alert.
+ *
+ * Usage:
+ * - :cwe - matches any package with at least one CWE alert
+ * - :cwe(CWE-79) - matches only the specific CWE ID
+ */
+export const cwe = async (state: ParserState) => {
+  assertSecurityArchive(state, 'cwe')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) /* c8 ignore start */ {
+    throw error('Failed to parse :cwe selector', { cause: err })
+  } /* c8 ignore stop */
+
+  const { cweId } = internals
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    let exclude: boolean
+    if (cweId === undefined) {
+      exclude = !report?.alerts.some(
+        alert => alert.props?.cwes && alert.props.cwes.length > 0,
+      )
+    } else {
+      exclude = !report?.alerts.some(alert =>
+        alert.props?.cwes?.some(
+          cwe =>
+            cwe.id.trim().toLowerCase() ===
+            cweId.trim().toLowerCase(),
+        ),
+      )
+    }
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/debug.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **debugAccess** report alert.
+ */
+export const debug = createSecuritySelectorFilter(
+  'debug',
+  'debugAccess',
+)

package/src/pseudo/deprecated.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **deprecated** report alert.
+ */
+export const deprecated = createSecuritySelectorFilter(
+  'deprecated',
+  'deprecated',
+)

package/src/pseudo/dev.ts

@@ -0,0 +1,18 @@
+import type { ParserState } from '../types.ts'
+import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
+
+/**
+ * :dev Pseudo-Selector will only match devDependencies.
+ */
+export const dev = async (state: ParserState) => {
+  // filter edges that don't have type 'dev'
+  for (const edge of state.partial.edges) {
+    if (edge.type !== 'dev') {
+      removeEdge(state, edge)
+    }
+  }
+
+  removeUnlinkedNodes(state)
+
+  return state
+}

package/src/pseudo/diff.ts

@@ -0,0 +1,90 @@
+import { error } from '@vltpkg/error-cause'
+import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
+import { removeDanglingEdges, removeNode } from './helpers.ts'
+import { parseInternals } from './spec.ts'
+import type { ParserState } from '../types.ts'
+
+/**
+ * Given a set of changed file paths and a package location
+ * (relative to the project root), returns true if any changed
+ * file belongs to that package.
+ */
+export const packageHasChanges = (
+  changedFiles: Set<string>,
+  packageLocation: string,
+): boolean => {
+  // Normalize the package location — remove leading './'
+  const normalized =
+    packageLocation.startsWith('./') ?
+      packageLocation.slice(2)
+    : packageLocation
+
+  // Root package — check if any file at root level changed
+  // (not inside a subdirectory that is another package)
+  if (!normalized || normalized === '.') {
+    // Any changed file means the root package changed
+    return changedFiles.size > 0
+  }
+
+  // Check if any changed file starts with the package path
+  for (const file of changedFiles) {
+    if (file === normalized || file.startsWith(normalized + '/')) {
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * :diff(<commitish>) Pseudo-Selector, matches only nodes
+ * whose files have changed between the current state and
+ * the specified commitish reference.
+ *
+ * Requires a `diffFiles` provider to be set on the
+ * {@link ParserState}. The provider is a callback that
+ * takes a commitish string and returns a Set of changed
+ * file paths relative to the project root.
+ *
+ * When called with no argument, defaults to HEAD (uncommitted changes).
+ *
+ * Examples:
+ * - :diff() — packages with uncommitted changes (defaults to HEAD)
+ * - :diff(main) — packages changed since main branch
+ * - :diff(HEAD~1) — packages changed since last commit
+ * - :diff("v1.0.0") — packages changed since tag v1.0.0
+ */
+export const diff = async (state: ParserState) => {
+  const currentNodes = asPostcssNodeWithChildren(state.current).nodes
+  const hasArg =
+    currentNodes.length > 0 &&
+    asPostcssNodeWithChildren(currentNodes[0]).nodes.length > 0
+
+  let commitish = 'HEAD'
+  if (hasArg) {
+    try {
+      commitish = parseInternals(currentNodes).specValue
+    } catch (err) {
+      throw error('Failed to parse :diff selector', {
+        cause: err,
+      })
+    }
+  }
+
+  if (!state.diffFiles) {
+    throw error('The :diff() selector requires a diffFiles provider')
+  }
+
+  const changedFiles = state.diffFiles(commitish)
+
+  for (const node of state.partial.nodes) {
+    /* c8 ignore next -- location is always set on real nodes */
+    const location = node.location ?? ''
+    if (!packageHasChanges(changedFiles, location)) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}