bandit-cli 1.0.0

package/dist/rules/phase3.rules.js

@@ -0,0 +1,261 @@
+// File: src/rules/phase3.rules.ts
+import path from "node:path";
+import { exists, readText } from "../utils/fs.js";
+import { readPackageJson, hasDependency, getDependenciesInWrongScope, } from "../utils/packageJson.js";
+import { scanForLoggingUsage } from "../utils/codeScanner.js";
+// Rule 11: Logging setup detection
+export const ruleLoggingSetup = {
+    id: "logging-setup",
+    title: "Logging setup detected",
+    severity: "warn",
+    async run(ctx) {
+        const pkg = readPackageJson(ctx.packageJsonPath);
+        if (!pkg) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "Could not read package.json.",
+            };
+        }
+        // Check for professional logging libraries
+        const loggingLibs = ["pino", "winston", "bunyan", "log4js"];
+        const detected = loggingLibs.filter((lib) => hasDependency(pkg, lib, true));
+        if (detected.length === 0) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "fail",
+                details: "No professional logging library detected.",
+                suggestion: "Install a production-grade logger: `npm install pino` or `npm install winston`",
+            };
+        }
+        // Optional: Check if logging is actually used in code
+        const srcPath = path.join(ctx.projectPath, "src");
+        if (exists(srcPath)) {
+            const isUsed = await scanForLoggingUsage(srcPath, detected);
+            if (!isUsed) {
+                return {
+                    id: this.id,
+                    title: this.title,
+                    severity: this.severity,
+                    status: "fail",
+                    details: `Logging library installed (${detected.join(", ")}) but not imported/used in code.`,
+                    suggestion: `Import and use ${detected[0]} in your application code.`,
+                };
+            }
+        }
+        return {
+            id: this.id,
+            title: this.title,
+            severity: this.severity,
+            status: "pass",
+            details: `Detected logging: ${detected.join(", ")}`,
+        };
+    },
+};
+// Rule 12: Environment variable validation
+export const ruleEnvValidation = {
+    id: "env-validation",
+    title: "Environment variable validation",
+    severity: "warn",
+    async run(ctx) {
+        const pkg = readPackageJson(ctx.packageJsonPath);
+        if (!pkg) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "Could not read package.json.",
+            };
+        }
+        // Check for env validation libraries
+        const envValidationLibs = ["zod", "joi", "envsafe", "dotenv-safe", "yup"];
+        const detected = envValidationLibs.filter((lib) => hasDependency(pkg, lib, true));
+        if (detected.length === 0) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "fail",
+                details: "No environment variable validation library detected.",
+                suggestion: "Add env validation to prevent runtime crashes:\n\t\t`npm install zod` and validate process.env at startup",
+            };
+        }
+        return {
+            id: this.id,
+            title: this.title,
+            severity: this.severity,
+            status: "pass",
+            details: `Detected env validation: ${detected.join(", ")}`,
+        };
+    },
+};
+// Rule 13: Database setup detection
+export const ruleDatabaseSetup = {
+    id: "database-setup",
+    title: "Database setup detected",
+    severity: "info",
+    async run(ctx) {
+        const pkg = readPackageJson(ctx.packageJsonPath);
+        if (!pkg) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "Could not read package.json.",
+            };
+        }
+        // Check for ORMs and database clients
+        const databases = [
+            { name: "Prisma", pkg: "@prisma/client" },
+            { name: "TypeORM", pkg: "typeorm" },
+            { name: "Drizzle", pkg: "drizzle-orm" },
+            { name: "Mongoose", pkg: "mongoose" },
+            { name: "Sequelize", pkg: "sequelize" },
+            { name: "Knex", pkg: "knex" },
+            { name: "PostgreSQL (pg)", pkg: "pg" },
+            { name: "MySQL", pkg: "mysql2" },
+        ];
+        const detected = databases.filter((db) => hasDependency(pkg, db.pkg, true));
+        if (detected.length === 0) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "fail",
+                details: "No database ORM or client detected.",
+                suggestion: "Most backends need a database. Consider Prisma, TypeORM, or a database client.",
+            };
+        }
+        // Check for migration setup (Prisma specific)
+        const hasMigrations = detected.some((db) => db.name === "Prisma") &&
+            exists(path.join(ctx.projectPath, "prisma", "migrations"));
+        const migrationInfo = hasMigrations ? " (with migrations)" : "";
+        return {
+            id: this.id,
+            title: this.title,
+            severity: this.severity,
+            status: "pass",
+            details: `Detected database: ${detected.map((db) => db.name).join(", ")}${migrationInfo}`,
+        };
+    },
+};
+// Rule 14: TypeScript strict mode check
+export const ruleTypeScriptStrict = {
+    id: "typescript-strict",
+    title: "TypeScript strict mode enabled",
+    severity: "warn",
+    async run(ctx) {
+        const tsconfigPath = path.join(ctx.projectPath, "tsconfig.json");
+        if (!exists(tsconfigPath)) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "tsconfig.json not found (not a TypeScript project).",
+            };
+        }
+        const content = readText(tsconfigPath);
+        if (!content) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "Could not read tsconfig.json.",
+            };
+        }
+        let tsconfig;
+        try {
+            // Remove comments for JSON parsing (basic approach)
+            const jsonContent = content.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, "");
+            tsconfig = JSON.parse(jsonContent);
+        }
+        catch {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "Could not parse tsconfig.json.",
+            };
+        }
+        const compilerOptions = tsconfig.compilerOptions || {};
+        const isStrict = compilerOptions.strict === true;
+        if (!isStrict) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "fail",
+                details: "TypeScript strict mode is not enabled.",
+                suggestion: 'Enable strict mode in tsconfig.json: set "strict": true in compilerOptions',
+            };
+        }
+        return {
+            id: this.id,
+            title: this.title,
+            severity: this.severity,
+            status: "pass",
+            details: "TypeScript strict mode is enabled.",
+        };
+    },
+};
+// Rule 15: Production dependencies audit
+export const ruleProductionDeps = {
+    id: "production-deps-audit",
+    title: "Production dependencies audit",
+    severity: "error",
+    async run(ctx) {
+        const pkg = readPackageJson(ctx.packageJsonPath);
+        if (!pkg) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "skip",
+                details: "Could not read package.json.",
+            };
+        }
+        // Dev tools that should NOT be in production dependencies
+        const devToolPatterns = [
+            "nodemon",
+            "ts-node",
+            "tsx",
+            "@types/",
+            "eslint",
+            "prettier",
+            "jest",
+            "vitest",
+            "mocha",
+            "chai",
+            "@testing-library",
+            "webpack-dev-server",
+            "vite",
+        ];
+        const wrongDeps = getDependenciesInWrongScope(pkg, devToolPatterns);
+        if (wrongDeps.length === 0) {
+            return {
+                id: this.id,
+                title: this.title,
+                severity: this.severity,
+                status: "pass",
+                details: "No dev tools found in production dependencies.",
+            };
+        }
+        return {
+            id: this.id,
+            title: this.title,
+            severity: this.severity,
+            status: "fail",
+            details: `Dev tools found in dependencies (should be in devDependencies): ${wrongDeps.join(", ")}`,
+            suggestion: `Move to devDependencies: ${wrongDeps.map((dep) => `npm install -D ${dep}`).join(" && ")}`,
+        };
+    },
+};

package/dist/utils/codeScanner.js

@@ -0,0 +1,66 @@
+// File: src/utils/codeScanner.ts
+import { readText } from "./fs.js";
+import fg from "fast-glob";
+/**
+ * Scans source files for Express global error handler pattern:
+ * app.use((err, req, res, next) => ...)
+ */
+export async function scanForErrorHandler(srcPath) {
+    // Search for .ts and .js files in src/
+    const files = await fg(["**/*.ts", "**/*.js"], {
+        cwd: srcPath,
+        absolute: true,
+        ignore: ["node_modules", "dist", "build"],
+    });
+    // Pattern to detect error handler middleware (4 params with err as first)
+    // Look for variations:
+    // - app.use((err, req, res, next) =>
+    // - app.use(function(err, req, res, next)
+    // - (err, req, res, next) => with error handling inside
+    const errorHandlerPatterns = [
+        /app\.use\s*\(\s*\(\s*err\s*,\s*req\s*,\s*res\s*,\s*next\s*\)/i,
+        /app\.use\s*\(\s*function\s*\(\s*err\s*,\s*req\s*,\s*res\s*,\s*next\s*\)/i,
+        /app\.use\s*\(\s*async\s*\(\s*err\s*,\s*req\s*,\s*res\s*,\s*next\s*\)/i,
+    ];
+    for (const file of files) {
+        const content = readText(file);
+        if (!content)
+            continue;
+        // Check if any error handler pattern is found
+        for (const pattern of errorHandlerPatterns) {
+            if (pattern.test(content)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Scans source files to check if any of the logging libraries are imported/used
+ */
+export async function scanForLoggingUsage(srcPath, loggingLibs) {
+    // Search for .ts and .js files in src/
+    const files = await fg(["**/*.ts", "**/*.js"], {
+        cwd: srcPath,
+        absolute: true,
+        ignore: ["node_modules", "dist", "build"],
+    });
+    // Create import patterns for each logging library
+    // e.g., import pino from 'pino', require('winston'), etc.
+    const importPatterns = loggingLibs.flatMap((lib) => [
+        new RegExp(`import\\s+.*from\\s+['"]${lib}['"]`, "i"),
+        new RegExp(`require\\s*\\(\\s*['"]${lib}['"]\\s*\\)`, "i"),
+    ]);
+    for (const file of files) {
+        const content = readText(file);
+        if (!content)
+            continue;
+        // Check if any import pattern is found
+        for (const pattern of importPatterns) {
+            if (pattern.test(content)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}

package/dist/utils/fs.js

@@ -0,0 +1,13 @@
+// File: src/utils/fs.ts
+import fs from "node:fs";
+export function exists(filePath) {
+    return fs.existsSync(filePath);
+}
+export function readText(filePath) {
+    try {
+        return fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}

package/dist/utils/packageJson.js

@@ -0,0 +1,54 @@
+// File: src/utils/packageJson.ts
+import { readText } from "./fs.js";
+export function readPackageJson(packageJsonPath) {
+    const txt = readText(packageJsonPath);
+    if (!txt)
+        return null;
+    try {
+        return JSON.parse(txt);
+    }
+    catch {
+        return null;
+    }
+}
+export function hasScript(pkg, name) {
+    return Boolean(pkg?.scripts?.[name]);
+}
+export function hasDependency(pkg, name, checkDev = false) {
+    const inDeps = Boolean(pkg?.dependencies?.[name]);
+    const inDevDeps = checkDev ? Boolean(pkg?.devDependencies?.[name]) : false;
+    return inDeps || inDevDeps;
+}
+export function detectFramework(pkg) {
+    if (hasDependency(pkg, "express"))
+        return "express";
+    if (hasDependency(pkg, "fastify"))
+        return "fastify";
+    if (hasDependency(pkg, "@nestjs/core"))
+        return "nest";
+    if (hasDependency(pkg, "hono"))
+        return "hono";
+    return "unknown";
+}
+export function hasAnyDependency(pkg, names, checkDev = false) {
+    return names.some((name) => hasDependency(pkg, name, checkDev));
+}
+export function getDependenciesInWrongScope(pkg, devToolPatterns) {
+    const prodDeps = pkg?.dependencies || {};
+    const wrongDeps = [];
+    for (const dep of Object.keys(prodDeps)) {
+        // Check if this dependency matches any dev tool pattern
+        const isDevTool = devToolPatterns.some((pattern) => {
+            if (pattern.endsWith("/")) {
+                // Pattern like "@types/" - check if dep starts with it
+                return dep.startsWith(pattern);
+            }
+            // Exact match
+            return dep === pattern;
+        });
+        if (isDevTool) {
+            wrongDeps.push(dep);
+        }
+    }
+    return wrongDeps;
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "bandit-cli",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js",
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "type": "module",
+  "bin": {
+    "bandit": "./dist/index.js"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.5.1",
+    "chalk": "^5.6.2",
+    "commander": "^14.0.3",
+    "fast-glob": "^3.3.3",
+    "js-yaml": "^4.1.1",
+    "ora": "^9.2.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.2.0",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3"
+  }
+}