cve-scanner 0.0.0 → 0.0.2

package/dist/ecosystems/enrichment/CveListCache.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cacheRootDir = cacheRootDir;
+exports.isCacheFresh = isCacheFresh;
+exports.ensureCveListCache = ensureCveListCache;
+const fs_1 = require("fs");
+const https_1 = __importDefault(require("https"));
+const os_1 = require("os");
+const path_1 = require("path");
+const ZipExtractor_1 = require("./ZipExtractor");
+const CVE_LIST_ZIP_URL = 'https://github.com/CVEProject/cvelistV5/archive/refs/heads/main.zip';
+const CACHE_TTL_MS = 12 * 60 * 60 * 1000;
+function cacheRootDir() {
+    return (0, path_1.join)((0, os_1.tmpdir)(), 'cve-scanner-cve-list-cache');
+}
+function extractedRepoDir(cacheRoot) {
+    return (0, path_1.join)(cacheRoot, 'cvelistV5-main');
+}
+function markerFile(cacheRoot) {
+    return (0, path_1.join)(cacheRoot, '.fetched-at');
+}
+/**
+ * Pure (given the marker's mtime as input): is the cache under `cacheRoot`
+ * still within the 12-hour TTL? See specs/80-cve-enrichment.md.
+ */
+function isCacheFresh(cacheRoot, now = Date.now()) {
+    const marker = markerFile(cacheRoot);
+    if (!(0, fs_1.existsSync)(marker) || !(0, fs_1.existsSync)(extractedRepoDir(cacheRoot)))
+        return false;
+    const fetchedAt = Date.parse((0, fs_1.readFileSync)(marker, 'utf8').trim());
+    if (Number.isNaN(fetchedAt))
+        return false;
+    return now - fetchedAt < CACHE_TTL_MS;
+}
+function download(url, destPath, redirectsLeft = 5) {
+    return new Promise((resolveResult, reject) => {
+        https_1.default
+            .get(url, (res) => {
+            const status = res.statusCode ?? 0;
+            if (status >= 300 && status < 400 && res.headers.location) {
+                res.resume();
+                if (redirectsLeft === 0) {
+                    reject(new Error('Too many redirects downloading the CVE List archive.'));
+                    return;
+                }
+                download(res.headers.location, destPath, redirectsLeft - 1).then(resolveResult, reject);
+                return;
+            }
+            if (status !== 200) {
+                res.resume();
+                reject(new Error(`Failed to download the CVE List archive: HTTP ${status}`));
+                return;
+            }
+            const file = (0, fs_1.createWriteStream)(destPath);
+            res.pipe(file);
+            file.on('finish', () => file.close(() => resolveResult()));
+            file.on('error', reject);
+        })
+            .on('error', reject);
+    });
+}
+/**
+ * Downloads and extracts the full CVE List (https://github.com/CVEProject/cvelistV5)
+ * into a 12-hour-TTL local cache, reusing it across runs when still fresh.
+ * Returns the directory to use as --cve-data-dir (the one containing cves/).
+ * See specs/80-cve-enrichment.md.
+ */
+async function ensureCveListCache() {
+    const cacheRoot = cacheRootDir();
+    const repoDir = extractedRepoDir(cacheRoot);
+    if (isCacheFresh(cacheRoot)) {
+        return repoDir;
+    }
+    (0, fs_1.mkdirSync)(cacheRoot, { recursive: true });
+    const zipPath = (0, path_1.join)(cacheRoot, 'cvelistV5-main.zip');
+    console.error('Downloading the full CVE List (https://github.com/CVEProject/cvelistV5) — large, cached for 12 hours...');
+    await download(CVE_LIST_ZIP_URL, zipPath);
+    (0, fs_1.rmSync)(repoDir, { recursive: true, force: true });
+    console.error('Extracting CVE List archive...');
+    await (0, ZipExtractor_1.extractZip)(zipPath, cacheRoot);
+    (0, fs_1.rmSync)(zipPath);
+    (0, fs_1.writeFileSync)(markerFile(cacheRoot), new Date().toISOString());
+    return repoDir;
+}
+//# sourceMappingURL=CveListCache.js.map

package/dist/ecosystems/enrichment/CveListCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CveListCache.js","sourceRoot":"","sources":["../../../src/ecosystems/enrichment/CveListCache.ts"],"names":[],"mappings":";;;;;;;;AAAA,2BAOY;AACZ,kDAA0B;AAC1B,2BAA4B;AAC5B,+BAA4B;AAC5B,iDAA4C;AAE5C,MAAM,gBAAgB,GACpB,qEAAqE,CAAC;AACxE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;IACE,OAAO,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,4BAA4B,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO,IAAA,WAAI,EAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB;IACnC,OAAO,IAAA,WAAI,EAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,sBACE,SAAiB,EACjB,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,IAAA,eAAU,EAAC,MAAM,CAAC,IAAI,CAAC,IAAA,eAAU,EAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IAEf,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,OAAO,GAAG,GAAG,SAAS,GAAG,YAAY,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CACf,GAAW,EACX,QAAgB,EAChB,aAAa,GAAG,CAAC;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,eAAK;aACF,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YAEnC,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;oBACxB,MAAM,CACJ,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAClE,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,IAAI,CAC9D,aAAa,EACb,MAAM,CACP,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,CACJ,IAAI,KAAK,CACP,iDAAiD,MAAM,EAAE,CAC1D,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,IAAA,sBAAiB,EAAC,QAAQ,CAAC,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK;IACV,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAA,cAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAEtD,OAAO,CAAC,KAAK,CACX,yGAAyG,CAC1G,CAAC;IACF,MAAM,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAE1C,IAAA,WAAM,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChD,MAAM,IAAA,yBAAU,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACrC,IAAA,WAAM,EAAC,OAAO,CAAC,CAAC;IAEhB,IAAA,kBAAa,EAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/ecosystems/enrichment/CveListCache.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ecosystems/enrichment/CveListCache.test.js

@@ -0,0 +1,49 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const CveListCache_1 = require("./CveListCache");
+function makeFreshCache(fetchedAtIso) {
+    const cacheRoot = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-cache-test-'));
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(cacheRoot, 'cvelistV5-main'), { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(cacheRoot, '.fetched-at'), fetchedAtIso);
+    return cacheRoot;
+}
+(0, node_test_1.test)('is fresh when fetched just now', () => {
+    const cacheRoot = makeFreshCache(new Date().toISOString());
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot), true);
+});
+(0, node_test_1.test)('is fresh when fetched 11 hours ago', () => {
+    const elevenHoursAgo = new Date(Date.now() - 11 * 60 * 60 * 1000).toISOString();
+    const cacheRoot = makeFreshCache(elevenHoursAgo);
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot), true);
+});
+(0, node_test_1.test)('is stale when fetched 13 hours ago', () => {
+    const thirteenHoursAgo = new Date(Date.now() - 13 * 60 * 60 * 1000).toISOString();
+    const cacheRoot = makeFreshCache(thirteenHoursAgo);
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot), false);
+});
+(0, node_test_1.test)('is stale when there is no cache at all', () => {
+    const cacheRoot = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-cache-test-'));
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot), false);
+});
+(0, node_test_1.test)('is stale when the marker exists but the extracted repo dir does not', () => {
+    const cacheRoot = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-cache-test-'));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(cacheRoot, '.fetched-at'), new Date().toISOString());
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot), false);
+});
+(0, node_test_1.test)('accepts an explicit "now" for deterministic testing', () => {
+    const fetchedAt = new Date('2026-01-01T00:00:00.000Z').toISOString();
+    const cacheRoot = makeFreshCache(fetchedAt);
+    const justUnderTtl = new Date('2026-01-01T11:59:00.000Z').getTime();
+    const justOverTtl = new Date('2026-01-01T12:01:00.000Z').getTime();
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot, justUnderTtl), true);
+    strict_1.default.equal((0, CveListCache_1.isCacheFresh)(cacheRoot, justOverTtl), false);
+});
+//# sourceMappingURL=CveListCache.test.js.map

package/dist/ecosystems/enrichment/CveListCache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CveListCache.test.js","sourceRoot":"","sources":["../../../src/ecosystems/enrichment/CveListCache.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,qCAAgE;AAChE,qCAAiC;AACjC,yCAAiC;AACjC,yCAAiC;AACjC,iDAA8C;AAE9C,SAAS,cAAc,CAAC,YAAoB;IAC1C,MAAM,SAAS,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACzE,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,IAAA,gBAAI,EAAC,gCAAgC,EAAE,GAAG,EAAE;IAC1C,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,MAAM,cAAc,GAAG,IAAI,IAAI,CAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACjC,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,SAAS,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACjC,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,SAAS,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IACnD,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,MAAM,SAAS,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACzE,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,SAAS,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACzE,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,aAAa,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,gBAAM,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,SAAS,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC"}

package/dist/ecosystems/enrichment/CveOrgDatasetReader.d.ts

@@ -0,0 +1,12 @@
+import { CveEnrichment } from '../../core/types';
+/**
+ * Reads enrichment detail for a CVE id from a locally extracted CVE.org bulk
+ * download (https://www.cve.org/Downloads). See specs/80-cve-enrichment.md.
+ */
+export declare class CveOrgDatasetReader {
+    private cveDataDir;
+    constructor(cveDataDir: string | undefined);
+    read(cveId: string): CveEnrichment | undefined;
+    private resolvePath;
+    private parse;
+}

package/dist/ecosystems/enrichment/CveOrgDatasetReader.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CveOrgDatasetReader = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Reads enrichment detail for a CVE id from a locally extracted CVE.org bulk
+ * download (https://www.cve.org/Downloads). See specs/80-cve-enrichment.md.
+ */
+class CveOrgDatasetReader {
+    constructor(cveDataDir) {
+        this.cveDataDir = cveDataDir;
+    }
+    read(cveId) {
+        if (!this.cveDataDir)
+            return undefined;
+        const filePath = this.resolvePath(cveId);
+        if (!filePath || !(0, fs_1.existsSync)(filePath))
+            return undefined;
+        const record = JSON.parse((0, fs_1.readFileSync)(filePath, 'utf8'));
+        return this.parse(record);
+    }
+    resolvePath(cveId) {
+        const match = /^CVE-(\d{4})-(\d+)$/.exec(cveId);
+        if (!match)
+            return undefined;
+        const [, year, number] = match;
+        const bucket = number.length > 3 ? `${number.slice(0, -3)}xxx` : '0xxx';
+        return (0, path_1.join)(this.cveDataDir, 'cves', year, bucket, `${cveId}.json`);
+    }
+    parse(record) {
+        const cna = record.containers?.cna;
+        const description = cna?.descriptions?.find((d) => d.lang === 'en')?.value ??
+            cna?.descriptions?.[0]?.value ??
+            '';
+        const cvssVector = cna?.metrics
+            ?.map((m) => m.cvssV3_1?.vectorString ??
+            m.cvssV3_0?.vectorString ??
+            m.cvssV2_0?.vectorString)
+            .find((v) => v !== undefined);
+        const cwe = [
+            ...new Set((cna?.problemTypes ?? [])
+                .flatMap((pt) => pt.descriptions ?? [])
+                .map((d) => d.cweId)
+                .filter((id) => id !== undefined)),
+        ];
+        const references = (cna?.references ?? [])
+            .map((r) => r.url)
+            .filter((url) => url !== undefined);
+        return {
+            description,
+            cvssVector,
+            cwe: cwe.length > 0 ? cwe : undefined,
+            references,
+        };
+    }
+}
+exports.CveOrgDatasetReader = CveOrgDatasetReader;
+//# sourceMappingURL=CveOrgDatasetReader.js.map

package/dist/ecosystems/enrichment/CveOrgDatasetReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CveOrgDatasetReader.js","sourceRoot":"","sources":["../../../src/ecosystems/enrichment/CveOrgDatasetReader.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA4B;AA6B5B;;;GAGG;AACH;IACE,YAAoB,UAA8B;0BAA9B,UAAU;IAAuB,CAAC;IAEtD,IAAI,CAAC,KAAa;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAEzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAc,CAAC;QACvE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACxE,OAAO,IAAA,WAAI,EAAC,IAAI,CAAC,UAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,MAAiB;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC;QAEnC,MAAM,WAAW,GACf,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK;YACtD,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;YAC7B,EAAE,CAAC;QAEL,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO;YAC7B,EAAE,GAAG,CACH,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,EAAE,YAAY;YACxB,CAAC,CAAC,QAAQ,EAAE,YAAY;YACxB,CAAC,CAAC,QAAQ,EAAE,YAAY,CAC3B;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAEhC,MAAM,GAAG,GAAG;YACV,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC;iBACtB,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,IAAI,EAAE,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;iBACnB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC,CAClD;SACF,CAAC;QAEF,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;QAErD,OAAO;YACL,WAAW;YACX,UAAU;YACV,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YACrC,UAAU;SACX,CAAC;IACJ,CAAC;CACF"}

package/dist/ecosystems/enrichment/CveOrgDatasetReader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ecosystems/enrichment/CveOrgDatasetReader.test.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const CveOrgDatasetReader_1 = require("./CveOrgDatasetReader");
+function makeFixtureDir() {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-enrichment-'));
+    const bucketDir = (0, node_path_1.join)(root, 'cves', '2023', '45xxx');
+    (0, node_fs_1.mkdirSync)(bucketDir, { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(bucketDir, 'CVE-2023-45678.json'), JSON.stringify({
+        containers: {
+            cna: {
+                descriptions: [
+                    { lang: 'en', value: 'An example vulnerability description.' },
+                ],
+                metrics: [{ cvssV3_1: { vectorString: 'CVSS:3.1/AV:N/AC:L' } }],
+                problemTypes: [{ descriptions: [{ cweId: 'CWE-79' }] }],
+                references: [{ url: 'https://example.com/advisory' }],
+            },
+        },
+    }));
+    return root;
+}
+(0, node_test_1.test)('returns undefined when cveDataDir is not set', () => {
+    const reader = new CveOrgDatasetReader_1.CveOrgDatasetReader(undefined);
+    strict_1.default.equal(reader.read('CVE-2023-45678'), undefined);
+});
+(0, node_test_1.test)('returns undefined when the matching file does not exist', () => {
+    const reader = new CveOrgDatasetReader_1.CveOrgDatasetReader(makeFixtureDir());
+    strict_1.default.equal(reader.read('CVE-2023-99999'), undefined);
+});
+(0, node_test_1.test)('parses a matching CVE JSON 5.0 record', () => {
+    const reader = new CveOrgDatasetReader_1.CveOrgDatasetReader(makeFixtureDir());
+    const enrichment = reader.read('CVE-2023-45678');
+    strict_1.default.deepEqual(enrichment, {
+        description: 'An example vulnerability description.',
+        cvssVector: 'CVSS:3.1/AV:N/AC:L',
+        cwe: ['CWE-79'],
+        references: ['https://example.com/advisory'],
+    });
+});
+//# sourceMappingURL=CveOrgDatasetReader.test.js.map

package/dist/ecosystems/enrichment/CveOrgDatasetReader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CveOrgDatasetReader.test.js","sourceRoot":"","sources":["../../../src/ecosystems/enrichment/CveOrgDatasetReader.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,qCAAgE;AAChE,qCAAiC;AACjC,yCAAiC;AACjC,yCAAiC;AACjC,+DAA4D;AAE5D,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,IAAA,mBAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,SAAS,EAAE,qBAAqB,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC;QACb,UAAU,EAAE;YACV,GAAG,EAAE;gBACH,YAAY,EAAE;oBACZ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,EAAE;iBAC/D;gBACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,oBAAoB,EAAE,EAAE,CAAC;gBAC/D,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;gBACvD,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,8BAA8B,EAAE,CAAC;aACtD;SACF;KACF,CAAC,CACH,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAA,gBAAI,EAAC,8CAA8C,EAAE,GAAG,EAAE;IACxD,MAAM,MAAM,GAAG,IAAI,yCAAmB,CAAC,SAAS,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,yCAAmB,CAAC,cAAc,EAAE,CAAC,CAAC;IACzD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,MAAM,MAAM,GAAG,IAAI,yCAAmB,CAAC,cAAc,EAAE,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjD,gBAAM,CAAC,SAAS,CAAC,UAAU,EAAE;QAC3B,WAAW,EAAE,uCAAuC;QACpD,UAAU,EAAE,oBAAoB;QAChC,GAAG,EAAE,CAAC,QAAQ,CAAC;QACf,UAAU,EAAE,CAAC,8BAA8B,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/ecosystems/enrichment/ZipExtractor.d.ts

@@ -0,0 +1,18 @@
+import * as yauzl from 'yauzl';
+/**
+ * Resolves a zip entry's file name against `targetDir`, rejecting it
+ * (returns undefined) if it would escape `targetDir` — the "zip slip" path
+ * traversal class of vulnerability (e.g. a malicious "../../etc/evil" entry
+ * name). Pure, no I/O — see specs/80-cve-enrichment.md.
+ */
+export declare function resolveSafeEntryPath(targetDir: string, fileName: string): string | undefined;
+export declare function isSymlinkEntry(entry: yauzl.Entry): boolean;
+/**
+ * Extracts a zip file using yauzl directly (not the `extract-zip` package,
+ * which has unpatched symlink path-traversal advisories — GHSA-jmr9-qjv8-65gv,
+ * GHSA-7pqw-9j4j-h8q3 — with no fix available). Mitigates the same class of
+ * issue via `resolveSafeEntryPath`, and by skipping symlink entries entirely
+ * — this archive is plain JSON files, there's no legitimate reason for one
+ * to contain a symlink. See specs/80-cve-enrichment.md.
+ */
+export declare function extractZip(zipPath: string, targetDir: string): Promise<void>;

package/dist/ecosystems/enrichment/ZipExtractor.js

@@ -0,0 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSafeEntryPath = resolveSafeEntryPath;
+exports.isSymlinkEntry = isSymlinkEntry;
+exports.extractZip = extractZip;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const yauzl = __importStar(require("yauzl"));
+const SYMLINK_MODE_BITS = 0xa000; // S_IFLNK, packed into the upper 16 bits of externalFileAttributes
+/**
+ * Resolves a zip entry's file name against `targetDir`, rejecting it
+ * (returns undefined) if it would escape `targetDir` — the "zip slip" path
+ * traversal class of vulnerability (e.g. a malicious "../../etc/evil" entry
+ * name). Pure, no I/O — see specs/80-cve-enrichment.md.
+ */
+function resolveSafeEntryPath(targetDir, fileName) {
+    const resolvedTargetDir = (0, path_1.resolve)(targetDir);
+    const entryPath = (0, path_1.resolve)(resolvedTargetDir, fileName);
+    const isInsideTarget = entryPath === resolvedTargetDir ||
+        entryPath.startsWith(resolvedTargetDir + path_1.sep);
+    return isInsideTarget ? entryPath : undefined;
+}
+function isSymlinkEntry(entry) {
+    const unixMode = entry.externalFileAttributes >>> 16;
+    return (unixMode & 0xf000) === SYMLINK_MODE_BITS;
+}
+/**
+ * Extracts a zip file using yauzl directly (not the `extract-zip` package,
+ * which has unpatched symlink path-traversal advisories — GHSA-jmr9-qjv8-65gv,
+ * GHSA-7pqw-9j4j-h8q3 — with no fix available). Mitigates the same class of
+ * issue via `resolveSafeEntryPath`, and by skipping symlink entries entirely
+ * — this archive is plain JSON files, there's no legitimate reason for one
+ * to contain a symlink. See specs/80-cve-enrichment.md.
+ */
+function extractZip(zipPath, targetDir) {
+    return new Promise((resolveResult, reject) => {
+        yauzl.open(zipPath, { lazyEntries: true }, (openErr, zipfile) => {
+            if (openErr) {
+                reject(openErr);
+                return;
+            }
+            zipfile.readEntry();
+            zipfile.on('entry', (entry) => {
+                const entryPath = resolveSafeEntryPath(targetDir, entry.fileName);
+                if (!entryPath || isSymlinkEntry(entry)) {
+                    zipfile.readEntry();
+                    return;
+                }
+                if (/\/$/.test(entry.fileName)) {
+                    (0, fs_1.mkdirSync)(entryPath, { recursive: true });
+                    zipfile.readEntry();
+                    return;
+                }
+                (0, fs_1.mkdirSync)((0, path_1.dirname)(entryPath), { recursive: true });
+                zipfile.openReadStream(entry, (streamErr, readStream) => {
+                    if (streamErr) {
+                        reject(streamErr);
+                        return;
+                    }
+                    const writeStream = (0, fs_1.createWriteStream)(entryPath);
+                    readStream.pipe(writeStream);
+                    writeStream.on('finish', () => zipfile.readEntry());
+                    writeStream.on('error', reject);
+                    readStream.on('error', reject);
+                });
+            });
+            zipfile.on('end', () => resolveResult());
+            zipfile.on('error', reject);
+        });
+    });
+}
+//# sourceMappingURL=ZipExtractor.js.map

package/dist/ecosystems/enrichment/ZipExtractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZipExtractor.js","sourceRoot":"","sources":["../../../src/ecosystems/enrichment/ZipExtractor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2BAAkD;AAClD,+BAA6C;AAC7C,MAAY,KAAK,kCAAc;AAE/B,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,mEAAmE;AAErG;;;;;GAKG;AACH,8BACE,SAAiB,EACjB,QAAgB;IAEhB,MAAM,iBAAiB,GAAG,IAAA,cAAO,EAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,cAAc,GAClB,SAAS,KAAK,iBAAiB;QAC/B,SAAS,CAAC,UAAU,CAAC,iBAAiB,GAAG,UAAG,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,wBAA+B,KAAkB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC;IACrD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,iBAAiB,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,oBAA2B,OAAe,EAAE,SAAiB;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;YAC9D,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,SAAS,EAAE,CAAC;YAEpB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAkB,EAAE,EAAE;gBACzC,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAElE,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,IAAA,cAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC1C,OAAO,CAAC,SAAS,EAAE,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IAAA,cAAS,EAAC,IAAA,cAAO,EAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE;oBACtD,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,CAAC,SAAS,CAAC,CAAC;wBAClB,OAAO;oBACT,CAAC;oBACD,MAAM,WAAW,GAAG,IAAA,sBAAiB,EAAC,SAAS,CAAC,CAAC;oBACjD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAC7B,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;oBACpD,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAChC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/ecosystems/enrichment/ZipExtractor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/ecosystems/enrichment/ZipExtractor.test.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const ZipExtractor_1 = require("./ZipExtractor");
+(0, node_test_1.test)('resolves an ordinary nested entry inside the target dir', () => {
+    const result = (0, ZipExtractor_1.resolveSafeEntryPath)('/out', 'repo-main/cves/2023/1xxx/CVE-2023-0001.json');
+    strict_1.default.equal(result, (0, node_path_1.join)('/out', 'repo-main/cves/2023/1xxx/CVE-2023-0001.json'));
+});
+(0, node_test_1.test)('rejects a zip-slip entry that escapes the target dir via ../', () => {
+    strict_1.default.equal((0, ZipExtractor_1.resolveSafeEntryPath)('/out', '../../etc/passwd'), undefined);
+});
+(0, node_test_1.test)('rejects an absolute-path entry that would overwrite outside the target dir', () => {
+    strict_1.default.equal((0, ZipExtractor_1.resolveSafeEntryPath)('/out', '/etc/passwd'), undefined);
+});
+(0, node_test_1.test)('rejects an entry that only superficially looks nested but climbs back out', () => {
+    strict_1.default.equal((0, ZipExtractor_1.resolveSafeEntryPath)('/out', 'a/b/../../../etc/passwd'), undefined);
+});
+(0, node_test_1.test)('accepts the target dir root itself', () => {
+    strict_1.default.equal((0, ZipExtractor_1.resolveSafeEntryPath)('/out', '.'), '/out');
+});
+(0, node_test_1.test)('identifies a symlink entry from its externalFileAttributes', () => {
+    const symlinkMode = 0xa1ff; // S_IFLNK with permission bits
+    const entry = { externalFileAttributes: symlinkMode << 16 };
+    strict_1.default.equal((0, ZipExtractor_1.isSymlinkEntry)(entry), true);
+});
+(0, node_test_1.test)('does not treat a regular file entry as a symlink', () => {
+    const regularFileMode = 0x81a4; // S_IFREG with permission bits
+    const entry = { externalFileAttributes: regularFileMode << 16 };
+    strict_1.default.equal((0, ZipExtractor_1.isSymlinkEntry)(entry), false);
+});
+//# sourceMappingURL=ZipExtractor.test.js.map

package/dist/ecosystems/enrichment/ZipExtractor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZipExtractor.test.js","sourceRoot":"","sources":["../../../src/ecosystems/enrichment/ZipExtractor.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,yCAAiC;AACjC,iDAAsE;AAEtE,IAAA,gBAAI,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,MAAM,GAAG,IAAA,mCAAoB,EACjC,MAAM,EACN,6CAA6C,CAC9C,CAAC;IACF,gBAAM,CAAC,KAAK,CACV,MAAM,EACN,IAAA,gBAAI,EAAC,MAAM,EAAE,6CAA6C,CAAC,CAC5D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAoB,EAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4EAA4E,EAAE,GAAG,EAAE;IACtF,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAoB,EAAC,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,gBAAM,CAAC,KAAK,CACV,IAAA,mCAAoB,EAAC,MAAM,EAAE,yBAAyB,CAAC,EACvD,SAAS,CACV,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,oCAAoC,EAAE,GAAG,EAAE;IAC9C,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAoB,EAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,+BAA+B;IAC3D,MAAM,KAAK,GAAG,EAAE,sBAAsB,EAAE,WAAW,IAAI,EAAE,EAErD,CAAC;IACL,gBAAM,CAAC,KAAK,CAAC,IAAA,6BAAc,EAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,+BAA+B;IAC/D,MAAM,KAAK,GAAG,EAAE,sBAAsB,EAAE,eAAe,IAAI,EAAE,EAEzD,CAAC;IACL,gBAAM,CAAC,KAAK,CAAC,IAAA,6BAAc,EAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}

package/dist/ecosystems/java/GradleDependencyDetector.d.ts

@@ -0,0 +1,9 @@
+import { CommandRunner } from '../../core/CommandRunner';
+import { DetectedArtifact, Detector, ScanOptions } from '../../core/types';
+export declare class GradleDependencyDetector implements Detector {
+    private commandRunner;
+    readonly ecosystem: 'gradle';
+    constructor(commandRunner?: CommandRunner);
+    isApplicable(options: ScanOptions): Promise<boolean>;
+    detect(options: ScanOptions): Promise<DetectedArtifact[]>;
+}

package/dist/ecosystems/java/GradleDependencyDetector.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GradleDependencyDetector = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const CommandRunner_1 = require("../../core/CommandRunner");
+const gradleDependencyOutputParser_1 = require("./parsers/gradleDependencyOutputParser");
+const resolveExecutable_1 = require("./resolveExecutable");
+// dist/ecosystems/java -> dist/ecosystems -> dist -> package root -> assets/...
+const INIT_SCRIPT_PATH = (0, path_1.join)(__dirname, '..', '..', '..', 'assets', 'gradle-init', 'list-dependencies.init.gradle');
+class GradleDependencyDetector {
+    constructor(commandRunner = new CommandRunner_1.RealCommandRunner()) {
+        this.commandRunner = commandRunner;
+        this.ecosystem = 'gradle';
+    }
+    async isApplicable(options) {
+        return ((0, fs_1.existsSync)((0, path_1.join)(options.scanDir, 'build.gradle')) ||
+            (0, fs_1.existsSync)((0, path_1.join)(options.scanDir, 'build.gradle.kts')));
+    }
+    async detect(options) {
+        const gradle = (0, resolveExecutable_1.resolveExecutable)(options.scanDir, 'gradlew', 'gradle', 'gradlew.bat');
+        const stdout = await this.commandRunner.run(`${gradle} --init-script ${INIT_SCRIPT_PATH} cveScannerListDependencies -q`, options.scanDir);
+        return (0, gradleDependencyOutputParser_1.gradleDependencyOutputParser)(stdout).map((dep) => ({
+            ecosystem: this.ecosystem,
+            coordinate: `${dep.group}:${dep.name}`,
+            version: dep.version,
+            source: 'build.gradle via gradle init-script',
+            projectRoot: options.scanDir,
+        }));
+    }
+}
+exports.GradleDependencyDetector = GradleDependencyDetector;
+//# sourceMappingURL=GradleDependencyDetector.js.map

package/dist/ecosystems/java/GradleDependencyDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GradleDependencyDetector.js","sourceRoot":"","sources":["../../../src/ecosystems/java/GradleDependencyDetector.ts"],"names":[],"mappings":";;;AAAA,2BAAgC;AAChC,+BAA4B;AAC5B,4DAA4E;AAE5E,yFAAsF;AACtF,2DAAwD;AAExD,gFAAgF;AAChF,MAAM,gBAAgB,GAAG,IAAA,WAAI,EAC3B,SAAS,EACT,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,aAAa,EACb,+BAA+B,CAChC,CAAC;AAEF;IAGE,YAAoB,aAAa,GAAkB,IAAI,iCAAiB,EAAE;QAAtD,kBAAa,GAAb,aAAa,CAAyC;QAFjE,cAAS,GAAG,QAAiB,CAAC;IAEsC,CAAC;IAE9E,KAAK,CAAC,YAAY,CAAC,OAAoB;QACrC,OAAO,CACL,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACjD,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB;QAC/B,MAAM,MAAM,GAAG,IAAA,qCAAiB,EAC9B,OAAO,CAAC,OAAO,EACf,SAAS,EACT,QAAQ,EACR,aAAa,CACd,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CACzC,GAAG,MAAM,kBAAkB,gBAAgB,gCAAgC,EAC3E,OAAO,CAAC,OAAO,CAChB,CAAC;QACF,OAAO,IAAA,2DAA4B,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE;YACtC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,qCAAqC;YAC7C,WAAW,EAAE,OAAO,CAAC,OAAO;SAC7B,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/ecosystems/java/MavenDependencyDetector.d.ts

@@ -0,0 +1,9 @@
+import { CommandRunner } from '../../core/CommandRunner';
+import { DetectedArtifact, Detector, ScanOptions } from '../../core/types';
+export declare class MavenDependencyDetector implements Detector {
+    private commandRunner;
+    readonly ecosystem: 'maven';
+    constructor(commandRunner?: CommandRunner);
+    isApplicable(options: ScanOptions): Promise<boolean>;
+    detect(options: ScanOptions): Promise<DetectedArtifact[]>;
+}

package/dist/ecosystems/java/MavenDependencyDetector.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MavenDependencyDetector = void 0;
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const CommandRunner_1 = require("../../core/CommandRunner");
+const mavenDependencyListParser_1 = require("./parsers/mavenDependencyListParser");
+const resolveExecutable_1 = require("./resolveExecutable");
+class MavenDependencyDetector {
+    constructor(commandRunner = new CommandRunner_1.RealCommandRunner()) {
+        this.commandRunner = commandRunner;
+        this.ecosystem = 'maven';
+    }
+    async isApplicable(options) {
+        return (0, fs_1.existsSync)((0, path_1.join)(options.scanDir, 'pom.xml'));
+    }
+    async detect(options) {
+        const mvn = (0, resolveExecutable_1.resolveExecutable)(options.scanDir, 'mvnw', 'mvn', 'mvnw.cmd');
+        const tmpDir = (0, fs_1.mkdtempSync)((0, path_1.join)((0, os_1.tmpdir)(), 'cve-scanner-mvn-'));
+        const outputFile = (0, path_1.join)(tmpDir, 'dependencies.txt');
+        try {
+            await this.commandRunner.run(`${mvn} dependency:list -DoutputFile=${outputFile} -DappendOutput=false`, options.scanDir);
+            const text = (0, fs_1.readFileSync)(outputFile, 'utf8');
+            return (0, mavenDependencyListParser_1.mavenDependencyListParser)(text).map((dep) => ({
+                ecosystem: this.ecosystem,
+                coordinate: `${dep.groupId}:${dep.artifactId}`,
+                version: dep.version,
+                source: 'pom.xml via mvn dependency:list',
+                projectRoot: options.scanDir,
+            }));
+        }
+        finally {
+            (0, fs_1.rmSync)(tmpDir, { recursive: true, force: true });
+        }
+    }
+}
+exports.MavenDependencyDetector = MavenDependencyDetector;
+//# sourceMappingURL=MavenDependencyDetector.js.map

package/dist/ecosystems/java/MavenDependencyDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MavenDependencyDetector.js","sourceRoot":"","sources":["../../../src/ecosystems/java/MavenDependencyDetector.ts"],"names":[],"mappings":";;;AAAA,2BAAmE;AACnE,2BAA4B;AAC5B,+BAA4B;AAC5B,4DAA4E;AAE5E,mFAAgF;AAChF,2DAAwD;AAExD;IAGE,YAAoB,aAAa,GAAkB,IAAI,iCAAiB,EAAE;QAAtD,kBAAa,GAAb,aAAa,CAAyC;QAFjE,cAAS,GAAG,OAAgB,CAAC;IAEuC,CAAC;IAE9E,KAAK,CAAC,YAAY,CAAC,OAAoB;QACrC,OAAO,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAoB;QAC/B,MAAM,GAAG,GAAG,IAAA,qCAAiB,EAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAA,gBAAW,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAC1B,GAAG,GAAG,iCAAiC,UAAU,uBAAuB,EACxE,OAAO,CAAC,OAAO,CAChB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,IAAA,qDAAyB,EAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACnD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE;gBAC9C,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,iCAAiC;gBACzC,WAAW,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC,CAAC;QACN,CAAC;gBAAS,CAAC;YACT,IAAA,WAAM,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;CACF"}

package/dist/ecosystems/java/parsers/gradleDependencyOutputParser.d.ts

@@ -0,0 +1,12 @@
+export interface GradleCoordinate {
+    group: string;
+    name: string;
+    version: string;
+}
+export declare const GRADLE_DEP_MARKER = "CVE_SCANNER_DEP:";
+/**
+ * Parses stdout produced by the bundled Gradle init script, which prints one
+ * "CVE_SCANNER_DEP:<group>:<name>:<version>" line per resolved module.
+ * See specs/30-java-detector.md.
+ */
+export declare function gradleDependencyOutputParser(text: string): GradleCoordinate[];

package/dist/ecosystems/java/parsers/gradleDependencyOutputParser.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GRADLE_DEP_MARKER = void 0;
+exports.gradleDependencyOutputParser = gradleDependencyOutputParser;
+exports.GRADLE_DEP_MARKER = 'CVE_SCANNER_DEP:';
+/**
+ * Parses stdout produced by the bundled Gradle init script, which prints one
+ * "CVE_SCANNER_DEP:<group>:<name>:<version>" line per resolved module.
+ * See specs/30-java-detector.md.
+ */
+function gradleDependencyOutputParser(text) {
+    const results = [];
+    const seen = new Set();
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line.startsWith(exports.GRADLE_DEP_MARKER))
+            continue;
+        const parts = line.slice(exports.GRADLE_DEP_MARKER.length).split(':');
+        if (parts.length !== 3)
+            continue;
+        const [group, name, version] = parts;
+        if (!group || !name || !version)
+            continue;
+        const key = `${group}:${name}:${version}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        results.push({ group, name, version });
+    }
+    return results;
+}
+//# sourceMappingURL=gradleDependencyOutputParser.js.map

package/dist/ecosystems/java/parsers/gradleDependencyOutputParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gradleDependencyOutputParser.js","sourceRoot":"","sources":["../../../../src/ecosystems/java/parsers/gradleDependencyOutputParser.ts"],"names":[],"mappings":";;;;AAMa,QAAA,iBAAiB,GAAG,kBAAkB,CAAC;AAEpD;;;;GAIG;AACH,sCAA6C,IAAY;IACvD,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAA,iBAAiB,CAAC;YAAE,SAAS;QAElD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAA,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAE1C,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/ecosystems/java/parsers/gradleDependencyOutputParser.test.d.ts

@@ -0,0 +1 @@
+export {};