break-anything 0.1.0 → 0.2.0

package/src/report.js

@@ -1,4 +1,7 @@
-// 人类可读报告(终端)。不依赖任何第三方 UI 库。
+// Human-readable terminal reports. No third-party UI deps.
+// English by default; set BRK_LANG=zh for Chinese labels.
+
+const LANG = (process.env.BRK_LANG || "en").toLowerCase().startsWith("zh") ? "zh" : "en";
 
 const C = {
   reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
@@ -6,55 +9,114 @@ const C = {
 };
 
 const SEV_COLOR = { CRITICAL: C.red, HIGH: C.red, MEDIUM: C.yellow, LOW: C.cyan, UNKNOWN: C.gray };
-const REACH_LABEL = {
-  imported: "reachable(已被引用)",
-  direct: "direct(直接依赖)",
-  transitive: "transitive(传递依赖)",
-  unknown: "—",
-};
 
-export function renderHuman(result, { color = true } = {}) {
-  const c = color ? C : new Proxy({}, { get: () => "" });
+const T = {
+  en: {
+    depsTitle: "Break Anything · dependency scan",
+    depsTarget: (t, n, s) => `target ${t}  ·  ${n} packages scanned  ·  ${s}`,
+    depsClean: "✓ No matching vulnerabilities in the OSV database.",
+    cleanNote: "  Note: this means \"none found\", not \"safe\".",
+    reach: { imported: "reachable", direct: "direct dep", transitive: "transitive", unknown: "—" },
+    epss: (v) => (v != null ? `EPSS ${(v * 100).toFixed(1)}%` : "EPSS —"),
+    fix: (v) => `fix → ${v}`,
+    noFix: "no fix available",
+    summary: "summary",
+    findings: "findings",
+    reachable: "reachable",
+    skipped: (n) => `(${n} packages failed to query, skipped)`,
+    heuristic: "Reachability is a heuristic (is it imported), not proof the vulnerable code runs.",
+    secretsTitle: "Break Anything · secret scan",
+    secretsTarget: (t, on) => `target ${t}  ·  history scan ${on ? "on" : "off"}`,
+    secretsClean: "✓ No leaked secrets found.",
+    history: "git history",
+    inHistory: "in history",
+    rotate: "Secrets in history may still be live even after deletion — rotate them, don't just delete the commit.",
+    imageTitle: "Break Anything · image scan",
+    imageClean: "✓ No known vulnerabilities in the image.",
+    more: (n) => `… ${n} more, use --json for the full list`,
+    fixable: "fixable",
+    sastTitle: "Break Anything · static code scan",
+    sastClean: "✓ No issues found by the static-analysis rules.",
+  },
+  zh: {
+    depsTitle: "Break Anything · 依赖扫描",
+    depsTarget: (t, n, s) => `目标 ${t}  ·  已扫 ${n} 个包  ·  ${s}`,
+    depsClean: "✓ 未在已知漏洞库(OSV)中发现匹配的漏洞。",
+    cleanNote: "  注意:这表示\"未发现\",不等于\"安全\"。",
+    reach: { imported: "可达(已被引用)", direct: "直接依赖", transitive: "传递依赖", unknown: "—" },
+    epss: (v) => (v != null ? `EPSS ${(v * 100).toFixed(1)}%` : "EPSS —"),
+    fix: (v) => `修复 → ${v}`,
+    noFix: "无修复版本",
+    summary: "小结",
+    findings: "条",
+    reachable: "可达",
+    skipped: (n) => `(${n} 个包查询失败,已跳过)`,
+    heuristic: "可达性为启发式(判断是否被引用),非漏洞函数被调用的证明。",
+    secretsTitle: "Break Anything · 密钥扫描",
+    secretsTarget: (t, on) => `目标 ${t}  ·  历史扫描 ${on ? "开" : "关"}`,
+    secretsClean: "✓ 未发现疑似泄露的密钥。",
+    history: "git 历史",
+    inHistory: "历史中",
+    rotate: "历史里的密钥即使已删除也可能仍然有效 —— 请轮换(rotate),不要只删提交。",
+    imageTitle: "Break Anything · 镜像扫描",
+    imageClean: "✓ 未在镜像中发现已知漏洞。",
+    more: (n) => `… 还有 ${n} 条,用 --json 查看全部`,
+    fixable: "可修复",
+    sastTitle: "Break Anything · 静态代码扫描",
+    sastClean: "✓ 静态分析规则未发现问题。",
+  },
+}[LANG];
+
+function palette(color) {
+  return color ? C : new Proxy({}, { get: () => "" });
+}
+
+export function renderHuman(result, { color = true, top } = {}) {
+  const c = palette(color);
   const lines = [];
 
   if (!result.ok) {
     lines.push(`${c.yellow}${result.message}${c.reset}`);
-    lines.push(`${c.gray}目标:${result.target}${c.reset}`);
+    lines.push(`${c.gray}${result.target}${c.reset}`);
     return lines.join("\n");
   }
 
   const srcDesc = result.sources.map((s) => `${s.ecosystem}:${s.packages}`).join("  ");
-  lines.push(`${c.bold}Break Anything · 依赖扫描${c.reset}`);
-  lines.push(`${c.gray}目标 ${result.target}  ·  已扫 ${result.scanned} 个包  ·  来源 ${srcDesc}${c.reset}`);
+  lines.push(`${c.bold}${T.depsTitle}${c.reset}`);
+  lines.push(`${c.gray}${T.depsTarget(result.target, result.scanned, srcDesc)}${c.reset}`);
   lines.push("");
 
   if (!result.findings.length) {
-    lines.push(`${c.green}✓ 未在已知漏洞库(OSV)中发现匹配的漏洞。${c.reset}`);
-    lines.push(`${c.gray}  注意:这表示"未发现",不等于"安全"。${c.reset}`);
+    lines.push(`${c.green}${T.depsClean}${c.reset}`);
+    lines.push(`${c.gray}${T.cleanNote}${c.reset}`);
     return lines.join("\n");
   }
 
-  for (const f of result.findings) {
+  const shown = top && result.findings.length > top ? result.findings.slice(0, top) : result.findings;
+  for (const f of shown) {
     const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
     const idLabel = f.cve || f.id;
-    const epss = f.epss != null ? `EPSS ${(f.epss * 100).toFixed(1)}%` : "EPSS —";
-    const fix = f.fixedVersions.length ? `${c.green}修复→ ${f.fixedVersions.join(", ")}${c.reset}` : `${c.red}无修复版本${c.reset}`;
+    const fix = f.fixedVersions.length
+      ? `${c.green}${T.fix(f.fixedVersions.join(", "))}${c.reset}`
+      : `${c.red}${T.noFix}${c.reset}`;
     lines.push(`${sev} ${c.bold}${f.package}@${f.version}${c.reset} ${c.gray}(${f.ecosystem})${c.reset}`);
-    lines.push(`  ${c.cyan}${idLabel}${c.reset}  ·  ${REACH_LABEL[f.reachability]}  ·  ${epss}  ·  ${fix}`);
+    lines.push(`  ${c.cyan}${idLabel}${c.reset}  ·  ${T.reach[f.reachability]}  ·  ${T.epss(f.epss)}  ·  ${fix}`);
     if (f.summary) lines.push(`  ${c.gray}${f.summary.replace(/\s+/g, " ").slice(0, 120)}${c.reset}`);
     lines.push("");
   }
+  if (shown.length < result.findings.length) {
+    lines.push(`${c.gray}${T.more(result.findings.length - shown.length)}${c.reset}`);
+    lines.push("");
+  }
 
   const s = result.summary;
   const sevParts = Object.entries(s.bySeverity)
     .sort((a, b) => sevOrder(b[0]) - sevOrder(a[0]))
     .map(([k, v]) => `${k} ${v}`)
     .join("  ");
-  lines.push(`${c.bold}小结${c.reset} 共 ${s.total} 条  ·  可达(已引用) ${s.reachable} 条  ·  ${sevParts}`);
-  if (result.errors?.length) {
-    lines.push(`${c.gray}（${result.errors.length} 个包查询失败,已跳过）${c.reset}`);
-  }
-  lines.push(`${c.gray}可达性为启发式(判断是否被引用),非漏洞函数被调用的证明。${c.reset}`);
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${s.reachable} ${T.reachable}  ·  ${sevParts}`);
+  if (result.errors?.length) lines.push(`${c.gray}${T.skipped(result.errors.length)}${c.reset}`);
+  lines.push(`${c.gray}${T.heuristic}${c.reset}`);
   return lines.join("\n");
 }
 
@@ -62,24 +124,24 @@ function sevOrder(k) {
   return { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, UNKNOWN: 0 }[k] ?? 0;
 }
 
-// ---- 密钥扫描报告 ----
+// ---- secrets ----
 export function renderSecrets(result, { color = true } = {}) {
-  const c = color ? C : new Proxy({}, { get: () => "" });
+  const c = palette(color);
   const lines = [];
-  lines.push(`${c.bold}Break Anything · 密钥扫描${c.reset}`);
-  lines.push(`${c.gray}目标 ${result.target}  ·  历史扫描 ${result.historyScanned ? "开" : "关"}${c.reset}`);
+  lines.push(`${c.bold}${T.secretsTitle}${c.reset}`);
+  lines.push(`${c.gray}${T.secretsTarget(result.target, result.historyScanned)}${c.reset}`);
   lines.push("");
 
   if (!result.findings.length) {
-    lines.push(`${c.green}✓ 未发现疑似泄露的密钥。${c.reset}`);
-    lines.push(`${c.gray}  注意:这表示"未发现",不等于"没有"。${c.reset}`);
+    lines.push(`${c.green}${T.secretsClean}${c.reset}`);
+    lines.push(`${c.gray}${T.cleanNote}${c.reset}`);
     return lines.join("\n");
   }
 
   for (const f of result.findings) {
     const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
     const loc = f.source === "history"
-      ? `${c.yellow}git 历史${c.reset} ${c.gray}@${f.commit}${c.reset}`
+      ? `${c.yellow}${T.history}${c.reset} ${c.gray}@${f.commit}${c.reset}`
       : `${f.location}${f.line ? `:${f.line}` : ""}`;
     lines.push(`${sev} ${c.bold}${f.rule}${c.reset}`);
     lines.push(`  ${loc}  ·  ${c.gray}${f.match}${c.reset}`);
@@ -87,16 +149,16 @@ export function renderSecrets(result, { color = true } = {}) {
   lines.push("");
   const s = result.summary;
   const parts = Object.entries(s.bySeverity).sort((a, b) => sevOrder(b[0]) - sevOrder(a[0])).map(([k, v]) => `${k} ${v}`).join("  ");
-  lines.push(`${c.bold}小结${c.reset} 共 ${s.total} 条  ·  历史中 ${s.inHistory} 条  ·  ${parts}`);
-  if (s.inHistory) lines.push(`${c.yellow}历史里的密钥即使已删除也可能仍然有效 —— 请轮换(rotate),不要只删提交。${c.reset}`);
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${s.inHistory} ${T.inHistory}  ·  ${parts}`);
+  if (s.inHistory) lines.push(`${c.yellow}${T.rotate}${c.reset}`);
   return lines.join("\n");
 }
 
-// ---- 镜像扫描报告 ----
+// ---- image ----
 export function renderImage(result, { color = true } = {}) {
-  const c = color ? C : new Proxy({}, { get: () => "" });
+  const c = palette(color);
   const lines = [];
-  lines.push(`${c.bold}Break Anything · 镜像扫描${c.reset} ${c.gray}(${result.engine})${c.reset}`);
+  lines.push(`${c.bold}${T.imageTitle}${c.reset} ${c.gray}(${result.engine})${c.reset}`);
 
   if (!result.ok) {
     lines.push("");
@@ -104,21 +166,60 @@ export function renderImage(result, { color = true } = {}) {
     return lines.join("\n");
   }
 
-  lines.push(`${c.gray}目标 ${result.target}${c.reset}`);
+  lines.push(`${c.gray}${result.target}${c.reset}`);
   lines.push("");
   if (!result.findings.length) {
-    lines.push(`${c.green}✓ 未在镜像中发现已知漏洞。${c.reset}`);
+    lines.push(`${c.green}${T.imageClean}${c.reset}`);
     return lines.join("\n");
   }
   for (const f of result.findings.slice(0, 40)) {
     const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
-    const fix = f.fixedVersions.length ? `${c.green}修复→ ${f.fixedVersions.join(", ")}${c.reset}` : `${c.red}无修复${c.reset}`;
+    const fix = f.fixedVersions.length ? `${c.green}${T.fix(f.fixedVersions.join(", "))}${c.reset}` : `${c.red}${T.noFix}${c.reset}`;
     lines.push(`${sev} ${c.bold}${f.package}@${f.version}${c.reset} ${c.cyan}${f.cve || f.id}${c.reset}  ${fix}  ${c.gray}[${f.class}]${c.reset}`);
   }
-  if (result.findings.length > 40) lines.push(`${c.gray}… 还有 ${result.findings.length - 40} 条,用 --json 查看全部${c.reset}`);
+  if (result.findings.length > 40) lines.push(`${c.gray}${T.more(result.findings.length - 40)}${c.reset}`);
   lines.push("");
   const s = result.summary;
   const parts = Object.entries(s.bySeverity).sort((a, b) => sevOrder(b[0]) - sevOrder(a[0])).map(([k, v]) => `${k} ${v}`).join("  ");
-  lines.push(`${c.bold}小结${c.reset} 共 ${s.total} 条  ·  可修复 ${s.fixable} 条  ·  ${parts}`);
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${s.fixable} ${T.fixable}  ·  ${parts}`);
+  return lines.join("\n");
+}
+
+// ---- SAST ----
+export function renderSast(result, { color = true, top } = {}) {
+  const c = palette(color);
+  const lines = [];
+  lines.push(`${c.bold}${T.sastTitle}${c.reset} ${c.gray}(${result.engine})${c.reset}`);
+
+  if (!result.ok) {
+    lines.push("");
+    lines.push(`${c.yellow}${result.message}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  lines.push(`${c.gray}${result.target}${c.reset}`);
+  lines.push("");
+  if (!result.findings.length) {
+    lines.push(`${c.green}${T.sastClean}${c.reset}`);
+    return lines.join("\n");
+  }
+
+  const shown = top && result.findings.length > top ? result.findings.slice(0, top) : result.findings;
+  for (const f of shown) {
+    const sev = `${SEV_COLOR[f.severity] || ""}${f.severity.padEnd(8)}${c.reset}`;
+    const tags = [f.cwe[0], f.owasp[0]].filter(Boolean).join(" · ");
+    lines.push(`${sev} ${c.bold}${f.rule}${c.reset} ${c.gray}${tags}${c.reset}`);
+    lines.push(`  ${c.cyan}${f.location}${c.reset}  ${c.gray}${f.message.slice(0, 100)}${c.reset}`);
+    if (f.snippet) lines.push(`  ${c.gray}${f.snippet.slice(0, 90)}${c.reset}`);
+    lines.push("");
+  }
+  if (shown.length < result.findings.length) {
+    lines.push(`${c.gray}${T.more(result.findings.length - shown.length)}${c.reset}`);
+    lines.push("");
+  }
+
+  const s = result.summary;
+  const parts = Object.entries(s.bySeverity).sort((a, b) => sevOrder(b[0]) - sevOrder(a[0])).map(([k, v]) => `${k} ${v}`).join("  ");
+  lines.push(`${c.bold}${T.summary}${c.reset} ${s.total} ${T.findings}  ·  ${parts}`);
   return lines.join("\n");
 }

package/src/sast.js

@@ -0,0 +1,128 @@
+import { spawn } from "node:child_process";
+
+// 静态代码分析(SAST):封装 Semgrep。装了 semgrep 就能用,没装给安装提示。
+// 把 Semgrep 的 JSON 归一化成 Break Anything 统一的发现结构。
+// 默认规则集 p/security-audit(首次运行会从 Semgrep registry 拉取并缓存,需联网)。
+
+export async function scanSast(path, { config = "p/security-audit" } = {}) {
+  const semgrep = await which("semgrep");
+  if (!semgrep) {
+    return {
+      target: path,
+      ok: false,
+      engine: "semgrep",
+      message:
+        "未找到 semgrep。SAST 依赖 Semgrep。安装:\n" +
+        "  pipx install semgrep   (或 brew install semgrep)\n" +
+        "  文档:https://semgrep.dev/docs/getting-started/",
+      findings: [],
+      summary: { total: 0, bySeverity: {} },
+    };
+  }
+
+  let raw;
+  try {
+    raw = await run(semgrep, ["--json", "--quiet", "--config", config, "--timeout", "0", path]);
+  } catch (err) {
+    return {
+      target: path,
+      ok: false,
+      engine: "semgrep",
+      message: `semgrep 执行失败:${err instanceof Error ? err.message : String(err)}`,
+      findings: [],
+      summary: { total: 0, bySeverity: {} },
+    };
+  }
+  return normalizeSemgrep(raw, path);
+}
+
+// 导出以便单测:把 semgrep JSON 文本归一化
+export function normalizeSemgrep(rawJson, target) {
+  let data;
+  try { data = typeof rawJson === "string" ? JSON.parse(rawJson) : rawJson; }
+  catch { return { target, ok: false, engine: "semgrep", message: "无法解析 semgrep 输出", findings: [], summary: { total: 0, bySeverity: {} } }; }
+
+  const findings = [];
+  for (const r of data.results || []) {
+    const sev = mapSeverity(r.extra?.severity);
+    const meta = r.extra?.metadata || {};
+    findings.push({
+      rule: shortRule(r.check_id),
+      id: r.check_id,
+      severity: sev,
+      location: `${r.path}:${r.start?.line ?? "?"}`,
+      message: (r.extra?.message || "").replace(/\s+/g, " ").trim(),
+      cwe: toArray(meta.cwe),
+      owasp: toArray(meta.owasp),
+      confidence: meta.confidence || null,
+      snippet: (r.extra?.lines || "").trim().slice(0, 200),
+      references: toArray(meta.references).slice(0, 3),
+    });
+  }
+  findings.sort((a, b) => sevRank(b.severity) - sevRank(a.severity));
+
+  return {
+    target,
+    ok: true,
+    engine: "semgrep",
+    scanned: data.paths?.scanned?.length ?? undefined,
+    errors: (data.errors || []).length,
+    findings,
+    summary: { total: findings.length, bySeverity: countBy(findings, "severity") },
+  };
+}
+
+// Semgrep: ERROR / WARNING / INFO → 我们的严重度
+function mapSeverity(s) {
+  switch ((s || "").toUpperCase()) {
+    case "ERROR": return "HIGH";
+    case "WARNING": return "MEDIUM";
+    case "INFO": return "LOW";
+    default: return "UNKNOWN";
+  }
+}
+
+function shortRule(id) {
+  if (!id) return "rule";
+  const parts = id.split(".");
+  return parts.slice(-2).join(".");
+}
+
+function toArray(v) {
+  if (v == null) return [];
+  return Array.isArray(v) ? v : [v];
+}
+
+function which(cmd) {
+  return new Promise((resolve) => {
+    const p = spawn(process.platform === "win32" ? "where" : "which", [cmd], { stdio: ["ignore", "pipe", "ignore"] });
+    let out = "";
+    p.stdout.on("data", (d) => (out += d));
+    p.on("close", (code) => resolve(code === 0 ? out.trim().split("\n")[0] : null));
+    p.on("error", () => resolve(null));
+  });
+}
+
+function run(cmd, args) {
+  return new Promise((resolve, reject) => {
+    const p = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let out = "";
+    let err = "";
+    p.stdout.on("data", (d) => (out += d));
+    p.stderr.on("data", (d) => (err += d));
+    p.on("close", (code) => {
+      // semgrep: 0 = 无发现, 1 = 有发现, 其它 = 错误
+      if (code === 0 || code === 1 || out.trim().startsWith("{")) resolve(out);
+      else reject(new Error(err.trim().slice(0, 300) || `exit ${code}`));
+    });
+    p.on("error", reject);
+  });
+}
+
+const SEV = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, UNKNOWN: 0 };
+function sevRank(s) { return SEV[s] ?? 0; }
+function countBy(arr, key) {
+  const m = {};
+  for (const x of arr) m[x[key]] = (m[x[key]] || 0) + 1;
+  return m;
+}