coverme-scanner 1.0.0

package/src/report/generator.ts

@@ -0,0 +1,382 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import puppeteer from 'puppeteer';
+import type { ScanResult, ConsensusFinding, Severity } from '../types.js';
+
+interface ReportData {
+  projectName: string;
+  scanDate: string;
+  scoreGrade: string;
+  scoreValue: number;
+  criticalCount: number;
+  highCount: number;
+  mediumCount: number;
+  lowCount: number;
+  infoCount: number;
+  executiveSummary: string;
+  criticalFindings: ConsensusFinding[];
+  highFindings: ConsensusFinding[];
+  mediumFindings: ConsensusFinding[];
+  lowFindings: ConsensusFinding[];
+  falsePositives: Array<{ id: string; title: string; file?: string; rejectionReason: string }>;
+  falsePositiveCount: number;
+  lowInfoCount: number;
+  positiveObservations: string[];
+  scanDuration: string;
+  agentCount: number;
+}
+
+export function calculateScore(result: ScanResult): { grade: string; value: number } {
+  // Scoring: Start at 100, subtract based on findings
+  // Critical: -15 each
+  // High: -8 each
+  // Medium: -3 each
+  // Low: -1 each
+  // Info: 0
+
+  let score = 100;
+  score -= result.summary.critical * 15;
+  score -= result.summary.high * 8;
+  score -= result.summary.medium * 3;
+  score -= result.summary.low * 1;
+
+  score = Math.max(0, Math.min(100, score));
+
+  let grade: string;
+  if (score >= 90) grade = 'a';
+  else if (score >= 80) grade = 'b';
+  else if (score >= 70) grade = 'c';
+  else if (score >= 60) grade = 'd';
+  else grade = 'f';
+
+  return { grade, value: score };
+}
+
+export function generateExecutiveSummary(result: ScanResult): string {
+  const total = result.summary.total;
+  const critical = result.summary.critical;
+  const high = result.summary.high;
+
+  if (critical > 0) {
+    return `This scan identified ${total} security and quality findings, including ${critical} critical issue${critical > 1 ? 's' : ''} that require immediate attention. ${high > 0 ? `Additionally, ${high} high-priority issues were found that should be addressed soon.` : ''} The codebase requires immediate remediation before production deployment.`;
+  }
+
+  if (high > 0) {
+    return `This scan identified ${total} findings, with ${high} high-priority issue${high > 1 ? 's' : ''} that should be addressed in the near term. No critical vulnerabilities were detected, but the high-priority findings could pose security risks if left unaddressed.`;
+  }
+
+  if (total > 0) {
+    return `This scan identified ${total} findings, primarily medium and low priority items. No critical or high-severity issues were detected. The codebase demonstrates reasonable security practices with room for improvement in the areas noted below.`;
+  }
+
+  return `Excellent! This scan found no significant security or quality issues. The codebase demonstrates strong security practices and code quality. Continue maintaining these standards.`;
+}
+
+function escapeHtml(text: string): string {
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
+function renderFindings(findings: ConsensusFinding[], template: string): string {
+  if (!findings || findings.length === 0) return '';
+
+  return findings.map(f => {
+    let html = template;
+    html = html.replace(/\{\{id\}\}/g, escapeHtml(f.id));
+    html = html.replace(/\{\{title\}\}/g, escapeHtml(f.title));
+    html = html.replace(/\{\{file\}\}/g, escapeHtml(f.file || 'N/A'));
+    html = html.replace(/\{\{line\}\}/g, String(f.line || ''));
+    html = html.replace(/\{\{confidence\}\}/g, String(f.confidence || 0));
+    html = html.replace(/\{\{description\}\}/g, escapeHtml(f.description));
+    html = html.replace(/\{\{category\}\}/g, escapeHtml(f.category));
+    html = html.replace(/\{\{cwe\}\}/g, escapeHtml(f.cwe || 'N/A'));
+    html = html.replace(/\{\{code\}\}/g, escapeHtml(f.code || ''));
+    html = html.replace(/\{\{recommendation\}\}/g, escapeHtml(f.recommendation));
+    html = html.replace(/\{\{severity\}\}/g, f.severity);
+    // New fields: why, context, checkBefore
+    html = html.replace(/\{\{why\}\}/g, escapeHtml((f as any).why || ''));
+    html = html.replace(/\{\{context\}\}/g, escapeHtml((f as any).context || ''));
+    html = html.replace(/\{\{checkBefore\}\}/g, escapeHtml((f as any).checkBefore || ''));
+
+    // Handle {{#if why}} blocks
+    if ((f as any).why) {
+      html = html.replace(/\{\{#if why\}\}/g, '').replace(/\{\{\/if\}\}/g, '');
+    } else {
+      html = html.replace(/\{\{#if why\}\}[\s\S]*?\{\{\/if\}\}/g, '');
+    }
+    if ((f as any).context) {
+      html = html.replace(/\{\{#if context\}\}/g, '').replace(/\{\{\/if\}\}/g, '');
+    } else {
+      html = html.replace(/\{\{#if context\}\}[\s\S]*?\{\{\/if\}\}/g, '');
+    }
+    if ((f as any).checkBefore) {
+      html = html.replace(/\{\{#if checkBefore\}\}/g, '').replace(/\{\{\/if\}\}/g, '');
+    } else {
+      html = html.replace(/\{\{#if checkBefore\}\}[\s\S]*?\{\{\/if\}\}/g, '');
+    }
+
+    return html;
+  }).join('\n');
+}
+
+export function renderTemplate(templateHtml: string, data: ReportData): string {
+  let html = templateHtml;
+
+  // Simple replacements
+  html = html.replace(/\{\{projectName\}\}/g, escapeHtml(data.projectName));
+  html = html.replace(/\{\{scanDate\}\}/g, escapeHtml(data.scanDate));
+  html = html.replace(/\{\{scoreGrade\}\}/g, data.scoreGrade);
+  html = html.replace(/\{\{scoreValue\}\}/g, String(data.scoreValue));
+  html = html.replace(/\{\{criticalCount\}\}/g, String(data.criticalCount));
+  html = html.replace(/\{\{highCount\}\}/g, String(data.highCount));
+  html = html.replace(/\{\{mediumCount\}\}/g, String(data.mediumCount));
+  html = html.replace(/\{\{lowCount\}\}/g, String(data.lowCount));
+  html = html.replace(/\{\{infoCount\}\}/g, String(data.infoCount));
+  html = html.replace(/\{\{lowInfoCount\}\}/g, String(data.lowInfoCount));
+  html = html.replace(/\{\{falsePositiveCount\}\}/g, String(data.falsePositiveCount));
+  html = html.replace(/\{\{executiveSummary\}\}/g, escapeHtml(data.executiveSummary));
+  html = html.replace(/\{\{scanDuration\}\}/g, escapeHtml(data.scanDuration));
+  html = html.replace(/\{\{agentCount\}\}/g, String(data.agentCount));
+
+  // Extract finding template from HTML
+  const findingTemplateMatch = html.match(/<div class="finding">[\s\S]*?<\/div>\s*<\/div>\s*<\/div>/);
+  const findingTemplate = findingTemplateMatch ? findingTemplateMatch[0] : '';
+
+  // Render each section with {{#each}} blocks
+  // Critical findings
+  const criticalSection = html.match(/\{\{#if criticalFindings\}\}[\s\S]*?\{\{\/if\}\}/);
+  if (criticalSection) {
+    if (data.criticalFindings.length > 0) {
+      let section = criticalSection[0]
+        .replace('{{#if criticalFindings}}', '')
+        .replace('{{/if}}', '');
+      const eachMatch = section.match(/\{\{#each criticalFindings\}\}([\s\S]*?)\{\{\/each\}\}/);
+      if (eachMatch) {
+        const rendered = renderFindings(data.criticalFindings, eachMatch[1]);
+        section = section.replace(eachMatch[0], rendered);
+      }
+      html = html.replace(criticalSection[0], section);
+    } else {
+      html = html.replace(criticalSection[0], '');
+    }
+  }
+
+  // High findings
+  const highSection = html.match(/\{\{#if highFindings\}\}[\s\S]*?\{\{\/if\}\}/);
+  if (highSection) {
+    if (data.highFindings.length > 0) {
+      let section = highSection[0]
+        .replace('{{#if highFindings}}', '')
+        .replace('{{/if}}', '');
+      const eachMatch = section.match(/\{\{#each highFindings\}\}([\s\S]*?)\{\{\/each\}\}/);
+      if (eachMatch) {
+        const rendered = renderFindings(data.highFindings, eachMatch[1]);
+        section = section.replace(eachMatch[0], rendered);
+      }
+      html = html.replace(highSection[0], section);
+    } else {
+      html = html.replace(highSection[0], '');
+    }
+  }
+
+  // Medium findings
+  const mediumSection = html.match(/\{\{#if mediumFindings\}\}[\s\S]*?\{\{\/if\}\}/);
+  if (mediumSection) {
+    if (data.mediumFindings.length > 0) {
+      let section = mediumSection[0]
+        .replace('{{#if mediumFindings}}', '')
+        .replace('{{/if}}', '');
+      const eachMatch = section.match(/\{\{#each mediumFindings\}\}([\s\S]*?)\{\{\/each\}\}/);
+      if (eachMatch) {
+        const rendered = renderFindings(data.mediumFindings, eachMatch[1]);
+        section = section.replace(eachMatch[0], rendered);
+      }
+      html = html.replace(mediumSection[0], section);
+    } else {
+      html = html.replace(mediumSection[0], '');
+    }
+  }
+
+  // Low findings
+  const lowSection = html.match(/\{\{#if lowFindings\}\}[\s\S]*?\{\{\/if\}\}/);
+  if (lowSection) {
+    if (data.lowFindings.length > 0) {
+      let section = lowSection[0]
+        .replace('{{#if lowFindings}}', '')
+        .replace('{{/if}}', '');
+      const eachMatch = section.match(/\{\{#each lowFindings\}\}([\s\S]*?)\{\{\/each\}\}/);
+      if (eachMatch) {
+        const rendered = renderFindings(data.lowFindings, eachMatch[1]);
+        section = section.replace(eachMatch[0], rendered);
+      }
+      html = html.replace(lowSection[0], section);
+    } else {
+      html = html.replace(lowSection[0], '');
+    }
+  }
+
+  // False positives
+  const fpSection = html.match(/\{\{#if falsePositives\}\}[\s\S]*?\{\{\/if\}\}/);
+  if (fpSection) {
+    if (data.falsePositives.length > 0) {
+      let section = fpSection[0]
+        .replace('{{#if falsePositives}}', '')
+        .replace('{{/if}}', '');
+      const eachMatch = section.match(/\{\{#each falsePositives\}\}([\s\S]*?)\{\{\/each\}\}/);
+      if (eachMatch) {
+        const rendered = data.falsePositives.map(fp => {
+          let itemHtml = eachMatch[1];
+          itemHtml = itemHtml.replace(/\{\{id\}\}/g, escapeHtml(fp.id));
+          itemHtml = itemHtml.replace(/\{\{title\}\}/g, escapeHtml(fp.title));
+          itemHtml = itemHtml.replace(/\{\{file\}\}/g, escapeHtml(fp.file || ''));
+          itemHtml = itemHtml.replace(/\{\{rejectionReason\}\}/g, escapeHtml(fp.rejectionReason));
+          return itemHtml;
+        }).join('\n');
+        section = section.replace(eachMatch[0], rendered);
+      }
+      html = html.replace(fpSection[0], section);
+    } else {
+      html = html.replace(fpSection[0], '');
+    }
+  }
+
+  // Positive observations
+  const posSection = html.match(/\{\{#if positiveObservations\}\}[\s\S]*?\{\{\/if\}\}/);
+  if (posSection) {
+    if (data.positiveObservations.length > 0) {
+      let section = posSection[0]
+        .replace('{{#if positiveObservations}}', '')
+        .replace('{{/if}}', '');
+      const eachMatch = section.match(/\{\{#each positiveObservations\}\}([\s\S]*?)\{\{\/each\}\}/);
+      if (eachMatch) {
+        const rendered = data.positiveObservations.map(obs => {
+          return eachMatch[1].replace(/\{\{this\}\}/g, escapeHtml(obs));
+        }).join('\n');
+        section = section.replace(eachMatch[0], rendered);
+      }
+      html = html.replace(posSection[0], section);
+    } else {
+      html = html.replace(posSection[0], '');
+    }
+  }
+
+  return html;
+}
+
+export async function generatePdfReport(
+  result: ScanResult,
+  outputPath: string,
+  falsePositives: Array<{ id: string; title: string; file?: string; rejectionReason: string }> = []
+): Promise<void> {
+  const templatePath = path.join(__dirname, '..', 'templates', 'report.html');
+  const templateHtml = fs.readFileSync(templatePath, 'utf-8');
+
+  const { grade, value } = calculateScore(result);
+
+  const criticalFindings = result.findings.filter(f => f.severity === 'critical');
+  const highFindings = result.findings.filter(f => f.severity === 'high');
+  const mediumFindings = result.findings.filter(f => f.severity === 'medium');
+  const lowFindings = result.findings.filter(f => f.severity === 'low' || f.severity === 'info');
+
+  const data: ReportData = {
+    projectName: result.projectName,
+    scanDate: new Date(result.scanDate).toLocaleDateString('en-US', {
+      year: 'numeric',
+      month: 'long',
+      day: 'numeric'
+    }),
+    scoreGrade: grade,
+    scoreValue: value,
+    criticalCount: result.summary.critical,
+    highCount: result.summary.high,
+    mediumCount: result.summary.medium,
+    lowCount: result.summary.low,
+    infoCount: result.summary.info,
+    executiveSummary: generateExecutiveSummary(result),
+    criticalFindings,
+    highFindings,
+    mediumFindings,
+    lowFindings,
+    falsePositives,
+    falsePositiveCount: falsePositives.length,
+    lowInfoCount: result.summary.low + result.summary.info,
+    positiveObservations: result.positiveObservations,
+    scanDuration: `${Math.round(result.scanDuration / 1000)}s`,
+    agentCount: result.agentsUsed.length
+  };
+
+  const renderedHtml = renderTemplate(templateHtml, data);
+
+  // Generate PDF using Puppeteer
+  const browser = await puppeteer.launch({
+    headless: true,
+    args: ['--no-sandbox', '--disable-setuid-sandbox']
+  });
+
+  const page = await browser.newPage();
+  await page.setContent(renderedHtml, { waitUntil: 'networkidle0' });
+
+  await page.pdf({
+    path: outputPath,
+    format: 'A4',
+    margin: { top: '20mm', right: '20mm', bottom: '20mm', left: '20mm' },
+    printBackground: true,
+    preferCSSPageSize: true
+  });
+
+  await browser.close();
+
+  console.log(`PDF report generated: ${outputPath}`);
+}
+
+export async function generateHtmlReport(
+  result: ScanResult,
+  outputPath: string,
+  falsePositives: Array<{ id: string; title: string; file?: string; rejectionReason: string }> = []
+): Promise<void> {
+  const templatePath = path.join(__dirname, '..', 'templates', 'report.html');
+  const templateHtml = fs.readFileSync(templatePath, 'utf-8');
+
+  const { grade, value } = calculateScore(result);
+
+  const criticalFindings = result.findings.filter(f => f.severity === 'critical');
+  const highFindings = result.findings.filter(f => f.severity === 'high');
+  const mediumFindings = result.findings.filter(f => f.severity === 'medium');
+  const lowFindings = result.findings.filter(f => f.severity === 'low' || f.severity === 'info');
+
+  const data: ReportData = {
+    projectName: result.projectName,
+    scanDate: new Date(result.scanDate).toLocaleDateString('en-US', {
+      year: 'numeric',
+      month: 'long',
+      day: 'numeric'
+    }),
+    scoreGrade: grade,
+    scoreValue: value,
+    criticalCount: result.summary.critical,
+    highCount: result.summary.high,
+    mediumCount: result.summary.medium,
+    lowCount: result.summary.low,
+    infoCount: result.summary.info,
+    executiveSummary: generateExecutiveSummary(result),
+    criticalFindings,
+    highFindings,
+    mediumFindings,
+    lowFindings,
+    falsePositives,
+    falsePositiveCount: falsePositives.length,
+    lowInfoCount: result.summary.low + result.summary.info,
+    positiveObservations: result.positiveObservations,
+    scanDuration: `${Math.round(result.scanDuration / 1000)}s`,
+    agentCount: result.agentsUsed.length
+  };
+
+  const renderedHtml = renderTemplate(templateHtml, data);
+
+  fs.writeFileSync(outputPath, renderedHtml);
+  console.log(`HTML report generated: ${outputPath}`);
+}