@westbayberry/dg 2.0.11 → 2.2.0

package/dist/verify/preflight.js

@@ -1,5 +1,5 @@
-import { existsSync, readFileSync } from "node:fs";
-import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { loadUserConfig } from "../config/settings.js";
 import { evaluatePackagePolicy, resolveEffectivePolicy } from "../policy/evaluate.js";
 const LOCKFILE_NAMES = new Set([
@@ -21,6 +21,28 @@ const REMOTE_SPEC_PREFIXES = [
     "ssh://",
     "github:"
 ];
+const MAX_LOCKFILE_BYTES = 64 * 1024 * 1024;
+const NPM_LOCKFILE_NAMES = new Set([
+    "npm-shrinkwrap.json",
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock"
+]);
+const PYPI_LOCKFILE_NAMES = new Set([
+    "Pipfile.lock",
+    "poetry.lock",
+    "requirements.txt",
+    "uv.lock"
+]);
+const DEFAULT_NPM_REGISTRY_HOSTS = ["registry.npmjs.org", "registry.yarnpkg.com"];
+const DEFAULT_PYPI_REGISTRY_HOSTS = ["pypi.org", "files.pythonhosted.org"];
+function readLockfileText(path) {
+    const sizeBytes = statSync(path).size;
+    if (sizeBytes > MAX_LOCKFILE_BYTES) {
+        throw new Error(`lockfile is ${sizeBytes} bytes, above the ${MAX_LOCKFILE_BYTES} byte parse limit`);
+    }
+    return readFileSync(path, "utf8");
+}
 export function isSupportedLockfilePath(target) {
     return LOCKFILE_NAMES.has(basename(target));
 }
@@ -62,7 +84,7 @@ export function verifyLockfile(targetPath, options = {}) {
     }
     let text;
     try {
-        text = readFileSync(absoluteTarget, "utf8");
+        text = readLockfileText(absoluteTarget);
     }
     catch (error) {
         return preflightReport({
@@ -88,7 +110,7 @@ export function parseLockfilePackages(targetPath) {
     const fileName = basename(absoluteTarget);
     let text;
     try {
-        text = readFileSync(absoluteTarget, "utf8");
+        text = readLockfileText(absoluteTarget);
     }
     catch (error) {
         return {
@@ -114,10 +136,67 @@ function createParseContext(fileName, filePath) {
     return {
         fileName,
         filePath,
+        registryHosts: expectedRegistryHosts(fileName, filePath),
         skipped: [],
         errors: []
     };
 }
+function expectedRegistryHosts(fileName, filePath) {
+    const hosts = new Set();
+    if (NPM_LOCKFILE_NAMES.has(fileName)) {
+        for (const host of DEFAULT_NPM_REGISTRY_HOSTS) {
+            hosts.add(host);
+        }
+        for (const host of npmrcRegistryHosts(filePath)) {
+            hosts.add(host);
+        }
+    }
+    else if (PYPI_LOCKFILE_NAMES.has(fileName)) {
+        for (const host of DEFAULT_PYPI_REGISTRY_HOSTS) {
+            hosts.add(host);
+        }
+    }
+    return hosts;
+}
+function npmrcRegistryHosts(lockfilePath) {
+    if (!lockfilePath) {
+        return [];
+    }
+    let text;
+    try {
+        text = readLockfileText(join(dirname(lockfilePath), ".npmrc"));
+    }
+    catch {
+        return [];
+    }
+    const hosts = [];
+    for (const line of text.split(/\r?\n/u)) {
+        const value = /^\s*(?:@[^=\s:]+:)?registry\s*=\s*(\S+)/u.exec(line)?.[1];
+        if (!value) {
+            continue;
+        }
+        try {
+            hosts.push(new URL(value).hostname.toLowerCase());
+        }
+        catch {
+            continue;
+        }
+    }
+    return hosts;
+}
+function untrustedResolvedHost(value, context) {
+    if (context.registryHosts.size === 0 || !/^https?:\/\//iu.test(value)) {
+        return null;
+    }
+    let host;
+    try {
+        host = new URL(value).hostname.toLowerCase();
+    }
+    catch {
+        return value;
+    }
+    return context.registryHosts.has(host) ? null : host;
+}
 function recordSkip(context, name, reason, location) {
     context.skipped.push({ name, reason, location });
 }
@@ -136,7 +215,7 @@ function preflightReport(input) {
         reason: "dg verify command allowlist",
         trustedBy: "user"
     }));
-    const deniedLicenses = new Set((input.options.denyLicenses ?? []).map(normalizeLicense));
+    const deniedLicenses = new Set((input.options.denyLicenses ?? []).map(denyListLicenseKey));
     const findings = [];
     for (const observation of input.observations) {
         const packageName = packageDisplayName(observation.identity);
@@ -212,10 +291,10 @@ function parseLockfile(text, context) {
         return parseRequirements(text, context);
     }
     if (name === "Cargo.lock") {
-        return parseCargoLock(text);
+        return parseCargoLock(text, context);
     }
     if (name === "poetry.lock") {
-        return parsePoetryLock(text);
+        return parsePoetryLock(text, context);
     }
     if (name === "uv.lock") {
         return parseUvLock(text, context);
@@ -304,14 +383,25 @@ function parsePackageLock(text, context) {
                 continue;
             }
             const resolvedIsGit = resolved !== null && isUnsafeResolvedUrl(resolved);
+            const resolvedOffRegistry = resolved !== null && untrustedResolvedHost(resolved, context) !== null;
+            // A registry `resolved` URL is how npm actually fetched this entry; it must
+            // be scanned regardless of how a same-named sibling declares the dependency
+            // (a `file:`/`git:` spec elsewhere must not suppress a registry install).
+            // The name-keyed cross-package hint only applies when this entry has no
+            // registry resolved of its own.
+            const resolvedIsRegistry = !!resolved && !resolvedIsGit && !resolvedOffRegistry && !resolved.toLowerCase().startsWith("file:");
             const skipReason = resolvedIsGit
                 ? "git"
                 : resolved?.toLowerCase().startsWith("file:")
                     ? "local"
-                    : specKinds.get(name) ?? null;
+                    : resolvedOffRegistry
+                        ? "direct-url"
+                        : resolvedIsRegistry
+                            ? null
+                            : specKinds.get(name) ?? null;
             if (skipReason) {
                 recordSkip(context, name, skipReason, path);
-                if (!resolvedIsGit) {
+                if (!resolvedIsGit && !resolvedOffRegistry) {
                     continue;
                 }
             }
@@ -324,7 +414,7 @@ function parsePackageLock(text, context) {
                 resolvedUrl: resolved,
                 integrity: stringOrNull(rawPackage.integrity),
                 license: stringOrNull(rawPackage.license)
-            }));
+            }, context));
         }
         return observations;
     }
@@ -333,7 +423,11 @@ function parsePackageLock(text, context) {
     }
     return observations;
 }
-function walkLegacyDependencies(dependencies, observations, seen, context) {
+const MAX_LEGACY_DEPENDENCY_DEPTH = 512;
+function walkLegacyDependencies(dependencies, observations, seen, context, depth = 0) {
+    if (depth > MAX_LEGACY_DEPENDENCY_DEPTH) {
+        return;
+    }
     for (const [name, rawPackage] of Object.entries(dependencies)) {
         if (!isRecord(rawPackage) || rawPackage.bundled === true) {
             continue;
@@ -341,8 +435,13 @@ function walkLegacyDependencies(dependencies, observations, seen, context) {
         const rawVersion = stringOrNull(rawPackage.version);
         const resolved = stringOrNull(rawPackage.resolved);
         const resolvedIsGit = resolved !== null && isUnsafeResolvedUrl(resolved);
+        const resolvedOffRegistry = resolved !== null && untrustedResolvedHost(resolved, context) !== null;
         const versionKind = rawVersion && !rawVersion.startsWith("npm:") ? specSourceKind(rawVersion) : null;
-        const skipReason = resolvedIsGit ? "git" : versionKind;
+        // Prefer the registry `resolved` URL over the version field: an entry npm
+        // fetched from the registry must be scanned even if its `version` reads
+        // file:/git:/workspace: (a contradiction an attacker can craft to hide it).
+        const resolvedIsRegistry = resolved !== null && !resolvedIsGit && !resolvedOffRegistry && !resolved.toLowerCase().startsWith("file:");
+        const skipReason = resolvedIsGit ? "git" : resolvedOffRegistry ? "direct-url" : resolvedIsRegistry ? null : versionKind;
         const alias = npmAliasVersion(rawVersion);
         const resolvedName = alias?.name ?? name;
         const version = alias?.version ?? rawVersion;
@@ -350,7 +449,7 @@ function walkLegacyDependencies(dependencies, observations, seen, context) {
         if (skipReason) {
             recordSkip(context, resolvedName, skipReason, name);
         }
-        if (!seen.has(key) && (!skipReason || resolvedIsGit)) {
+        if (!seen.has(key) && (!skipReason || resolvedIsGit || resolvedOffRegistry)) {
             seen.add(key);
             observations.push(lockfileObservation({
                 ecosystem: "npm",
@@ -361,10 +460,10 @@ function walkLegacyDependencies(dependencies, observations, seen, context) {
                 resolvedUrl: resolved,
                 integrity: stringOrNull(rawPackage.integrity),
                 license: stringOrNull(rawPackage.license)
-            }));
+            }, context));
         }
         if (isRecord(rawPackage.dependencies)) {
-            walkLegacyDependencies(rawPackage.dependencies, observations, seen, context);
+            walkLegacyDependencies(rawPackage.dependencies, observations, seen, context, depth + 1);
         }
     }
 }
@@ -394,10 +493,14 @@ function parseYarnLock(text, context) {
         const requested = header.split(",")[0]?.trim().replace(/^"|"$/gu, "") ?? header;
         const name = packageNameFromYarnDescriptor(requested);
         const resolved = quotedValue(lines, "resolved");
-        const skipReason = specSourceKind(yarnDescriptorSpec(requested));
+        const resolution = quotedValue(lines, "resolution");
+        const skipReason = specSourceKind(yarnDescriptorSpec(requested))
+            ?? (resolution ? specSourceKind(yarnDescriptorSpec(resolution)) : null);
+        const resolvedUnsafe = resolved !== null
+            && (isUnsafeResolvedUrl(resolved) || untrustedResolvedHost(resolved, context) !== null);
         if (skipReason) {
             recordSkip(context, name ?? requested, skipReason, requested);
-            if (!(resolved && isUnsafeResolvedUrl(resolved))) {
+            if (!resolvedUnsafe) {
                 continue;
             }
         }
@@ -414,7 +517,7 @@ function parseYarnLock(text, context) {
             resolvedUrl: resolved,
             integrity: quotedValue(lines, "integrity") ?? quotedValue(lines, "checksum"),
             license: null
-        }));
+        }, context));
     }
     return observations;
 }
@@ -425,7 +528,7 @@ function parsePnpmLock(text, context) {
     let current = null;
     const flush = () => {
         if (current) {
-            observations.push(lockfileObservation(current));
+            observations.push(lockfileObservation(current, context));
             current = null;
         }
     };
@@ -590,6 +693,33 @@ function collectRequirements(text, baseDir, state, context, observations) {
         }
         const hash = /--hash=([A-Za-z0-9:_-]+)/u.exec(line)?.[1] ?? null;
         const requirement = line.replace(/\s*--hash=[^\s]+/gu, "").trim();
+        const directReference = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?\s*@\s*([^;\s]+)/u.exec(requirement);
+        if (directReference?.[1] && directReference[2]) {
+            const referenceName = directReference[1];
+            const referenceUrl = directReference[2];
+            const referenceKind = specSourceKind(referenceUrl);
+            if (referenceKind === "local" || /^\.{0,2}\//u.test(referenceUrl)) {
+                recordSkip(context, referenceName, "local", line);
+                continue;
+            }
+            recordSkip(context, referenceName, referenceKind ?? "direct-url", line);
+            observations.push(packageObservation({
+                ecosystem: "pypi",
+                name: referenceName,
+                version: null,
+                requested: line,
+                sourceKind: "lockfile-url-fallback",
+                resolvedUrl: referenceUrl,
+                integrity: hash,
+                license: null
+            }, "block", {
+                id: "unverified-lockfile-url",
+                title: "Unverified lockfile URL",
+                message: "lockfile resolved artifact uses a direct URL or git source that requires proxy hash verification",
+                location: line
+            }));
+            continue;
+        }
         const match = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?(?:\s*={2,3}\s*([^;\s]+))?/u.exec(requirement);
         if (!match?.[1]) {
             observations.push(blockedUnknownSpec(line));
@@ -609,7 +739,7 @@ function collectRequirements(text, baseDir, state, context, observations) {
             resolvedUrl: null,
             integrity: hash,
             license: null
-        }));
+        }, context));
     }
 }
 function followRequirementInclude(target, baseDir, state, context, observations) {
@@ -628,7 +758,7 @@ function followRequirementInclude(target, baseDir, state, context, observations)
     state.visited.add(includePath);
     let text;
     try {
-        text = readFileSync(includePath, "utf8");
+        text = readLockfileText(includePath);
     }
     catch (error) {
         recordParseError(context, target, error);
@@ -652,27 +782,46 @@ function joinRequirementContinuations(lines) {
     }
     return joined;
 }
-function parseCargoLock(text) {
-    return lockBlocks(text, "[[package]]").map((block) => {
-        const name = tomlString(block, "name") ?? "unknown";
+function parseCargoLock(text, context) {
+    const observations = [];
+    for (const block of lockBlocks(text, "[[package]]")) {
+        const name = tomlString(block, "name");
+        if (!name) {
+            continue;
+        }
         const version = tomlString(block, "version");
-        return lockfileObservation({
+        const source = tomlString(block, "source");
+        if (source === null) {
+            recordSkip(context, name, "local", `${name}@${version ?? "unknown"}`);
+            continue;
+        }
+        observations.push(lockfileObservation({
             ecosystem: "cargo",
             name,
             version,
             requested: `${name}@${version ?? "unknown"}`,
             sourceKind: "lockfile",
-            resolvedUrl: tomlString(block, "source"),
+            resolvedUrl: source,
             integrity: tomlString(block, "checksum"),
             license: null
-        });
-    }).filter((observation) => observation.identity.name !== "unknown");
+        }, context));
+    }
+    return observations;
 }
-function parsePoetryLock(text) {
-    return lockBlocks(text, "[[package]]").map((block) => {
-        const name = tomlString(block, "name") ?? "unknown";
+function parsePoetryLock(text, context) {
+    const observations = [];
+    for (const block of lockBlocks(text, "[[package]]")) {
+        const name = tomlString(block, "name");
+        if (!name) {
+            continue;
+        }
         const version = tomlString(block, "version");
-        return lockfileObservation({
+        const skipReason = poetrySourceSkipReason(block);
+        if (skipReason) {
+            recordSkip(context, name, skipReason, `${name}${version ? `==${version}` : ""}`);
+            continue;
+        }
+        observations.push(lockfileObservation({
             ecosystem: "pypi",
             name,
             version,
@@ -681,8 +830,26 @@ function parsePoetryLock(text) {
             resolvedUrl: null,
             integrity: /hash\s*=\s*"([^"]+)"/u.exec(block)?.[1] ?? null,
             license: tomlString(block, "license")
-        });
-    }).filter((observation) => observation.identity.name !== "unknown");
+        }, context));
+    }
+    return observations;
+}
+function poetrySourceSkipReason(block) {
+    const sourceTable = /\[package\.source\]([\s\S]*?)(?=\n\[|$)/u.exec(block)?.[1];
+    if (sourceTable === undefined) {
+        return null;
+    }
+    const type = /\btype\s*=\s*"([^"]+)"/u.exec(sourceTable)?.[1];
+    if (type === "git") {
+        return "git";
+    }
+    if (type === "url") {
+        return "direct-url";
+    }
+    if (type === "directory" || type === "file") {
+        return "local";
+    }
+    return null;
 }
 function parseUvLock(text, context) {
     const observations = [];
@@ -707,7 +874,7 @@ function parseUvLock(text, context) {
             resolvedUrl: null,
             integrity: /hash\s*=\s*"([^"]+)"/u.exec(block)?.[1] ?? null,
             license: null
-        }));
+        }, context));
     }
     return observations;
 }
@@ -744,24 +911,41 @@ function parsePipfileLock(text, context) {
     }
     return ["default", "develop"].flatMap((section) => {
         const packages = isRecord(parsed[section]) ? parsed[section] : {};
-        return Object.entries(packages).map(([name, rawPackage]) => {
+        return Object.entries(packages).flatMap(([name, rawPackage]) => {
             const record = isRecord(rawPackage) ? rawPackage : {};
             const version = stringOrNull(record.version)?.replace(/^==/u, "") ?? null;
+            const skipReason = pipfileSourceSkipReason(record);
+            if (skipReason) {
+                recordSkip(context, name, skipReason, `${name}${version ? `==${version}` : ""}`);
+                return [];
+            }
             const hashes = Array.isArray(record.hashes) ? record.hashes.filter((hash) => typeof hash === "string") : [];
-            return lockfileObservation({
-                ecosystem: "pypi",
-                name,
-                version,
-                requested: `${name}${version ? `==${version}` : ""}`,
-                sourceKind: "lockfile",
-                resolvedUrl: null,
-                integrity: hashes[0] ?? null,
-                license: null
-            });
+            return [lockfileObservation({
+                    ecosystem: "pypi",
+                    name,
+                    version,
+                    requested: `${name}${version ? `==${version}` : ""}`,
+                    sourceKind: "lockfile",
+                    resolvedUrl: null,
+                    integrity: hashes[0] ?? null,
+                    license: null
+                }, context)];
         });
     });
 }
-function lockfileObservation(identity) {
+function pipfileSourceSkipReason(record) {
+    if (typeof record.git === "string") {
+        return "git";
+    }
+    if (typeof record.file === "string") {
+        return "direct-url";
+    }
+    if (record.editable === true || typeof record.path === "string") {
+        return "local";
+    }
+    return null;
+}
+function lockfileObservation(identity, context) {
     if (identity.resolvedUrl && isUnsafeResolvedUrl(identity.resolvedUrl)) {
         return packageObservation(identity, "block", {
             id: "unverified-lockfile-url",
@@ -770,6 +954,15 @@ function lockfileObservation(identity) {
             location: identity.requested
         });
     }
+    const untrustedHost = identity.resolvedUrl ? untrustedResolvedHost(identity.resolvedUrl, context) : null;
+    if (untrustedHost !== null) {
+        return packageObservation(identity, "block", {
+            id: "untrusted-registry-host",
+            title: "Untrusted lockfile registry host",
+            message: `${packageDisplayName(identity)} resolves from '${untrustedHost}', which is not an expected registry host for this lockfile`,
+            location: identity.requested
+        });
+    }
     const integrityFinding = integrityPolicyFinding(identity);
     if (integrityFinding) {
         return packageObservation(identity, "warn", integrityFinding);
@@ -788,7 +981,7 @@ function integrityPolicyFinding(identity) {
     };
 }
 function deniedLicenseFinding(identity, deniedLicenses) {
-    if (!identity.license || !deniedLicenses.has(normalizeLicense(identity.license))) {
+    if (!identity.license || !deniedLicenses.has(denyListLicenseKey(identity.license))) {
         return null;
     }
     return {
@@ -956,7 +1149,7 @@ function stringOrNull(value) {
 function stripQuotes(value) {
     return value.replace(/^["']|["']$/gu, "");
 }
-function normalizeLicense(value) {
+function denyListLicenseKey(value) {
     return value.trim().toLowerCase();
 }
 function displayPath(root, path) {

package/dist/verify/render.js

@@ -1,4 +1,6 @@
 import { createTheme } from "../presentation/theme.js";
+import { packagePageUrl } from "../presentation/package-page.js";
+import { sanitizeDeep } from "../security/sanitize.js";
 const STATUS_ROLE = {
     pass: "pass",
     warn: "warn",
@@ -14,7 +16,8 @@ const STATUS_ACTION = {
     error: "block"
 };
 export function renderVerifyText(report, theme = createTheme(false), verbose = false) {
-    return verbose ? renderVerifyVerbose(report, theme) : renderVerifyCompact(report, theme);
+    const safe = sanitizeDeep(report);
+    return verbose ? renderVerifyVerbose(safe, theme) : renderVerifyCompact(safe, theme);
 }
 function renderVerifyCompact(report, theme) {
     const badge = report.status === "error" ? theme.paint("block", "✘ ERROR") : theme.badge(STATUS_ACTION[report.status]);
@@ -30,8 +33,19 @@ function renderVerifyCompact(report, theme) {
     for (const error of report.errors) {
         lines.push(`  ${theme.paint("block", "✘")} ${error}`);
     }
+    const page = packageReportUrl(report);
+    if (page) {
+        lines.push(theme.paint("muted", `  → ${page}`));
+    }
     return `${lines.join("\n")}\n`;
 }
+function packageReportUrl(report) {
+    if (report.packages.length !== 1) {
+        return null;
+    }
+    const identity = report.packages[0];
+    return packagePageUrl(identity.ecosystem, identity.name);
+}
 function targetLabel(report) {
     if (report.packages.length === 1) {
         const identity = report.packages[0];