dsh-code-security 0.3.7 → 0.4.0

package/lib/scanner.js

@@ -9,6 +9,8 @@ import { createHash } from 'node:crypto';
 import { DEFAULT_EXCLUDE_DIRS } from './config.js';
 import { languageForFile, RULES } from './rules.js';
 import { policyExcludesDir, policyIgnores } from './policy.js';
+import { protectFinding } from './privacy.js';
+import { sanitizedHtmlLines } from './syntax.js';
 const DISABLE_NEXT = /secure-review-disable-next-line(?:\s+([\w,-]+))?/;
 const DISABLE_LINE = /secure-review-disable-line(?:\s+([\w,-]+))?/;
 function isComment(line) {
@@ -64,7 +66,7 @@ function shannon(text) {
 }
 const TOKEN_PATTERN = /['"]([A-Za-z0-9+/=_-]{24,})['"]/g;
 const HIGH_ENTROPY_THRESHOLD = 3.8;
-function detectHighEntropy(line, lineNumber, file, rel, rule) {
+function detectHighEntropy(line, lineNumber, rel, rule) {
     const findings = [];
     for (const match of line.matchAll(TOKEN_PATTERN)) {
         const token = match[1];
@@ -94,23 +96,69 @@ function makeId(ruleId, file, line, snippet) {
     const hash = createHash('sha256').update(ruleId + '|' + file + '|' + line + '|' + snippet.slice(0, 80)).digest('hex').slice(0, 10);
     return 'SR-' + hash;
 }
+function scanFileRule(entries, rel, rule, disabledNext, selectedLines) {
+    let block = [];
+    const checkBlock = () => {
+        if (block.length === 0)
+            return undefined;
+        const text = block.map(entry => entry.text).join('\n');
+        let best;
+        for (const pattern of rule.patterns) {
+            const regex = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');
+            for (const match of text.matchAll(regex)) {
+                const index = match.index;
+                const start = text.slice(0, index).split('\n').length - 1;
+                const end = start + match[0].split('\n').length - 1;
+                if (selectedLines !== undefined && !block.slice(start, end + 1).some(entry => selectedLines.has(entry.line)))
+                    continue;
+                if (best === undefined || index < best.index)
+                    best = { index, start, end };
+                break;
+            }
+        }
+        if (best === undefined)
+            return undefined;
+        const line = block[best.start].line;
+        const snippet = block.slice(best.start, best.end + 1).map(entry => entry.text).join('\n');
+        return {
+            id: makeId(rule.id, rel, line, snippet), ruleId: rule.id, title: rule.title,
+            cwe: rule.cwe, severity: rule.severity, confidence: rule.confidence,
+            file: rel, line, snippet: snippet.trim().slice(0, 200), message: rule.message,
+        };
+    };
+    for (const entry of entries) {
+        const suppressed = isComment(entry.text) || shouldSkipLine(rule, disabledNext.get(entry.line));
+        if (suppressed || block.length > 0 && entry.line !== block.at(-1).line + 1) {
+            const finding = checkBlock();
+            if (finding !== undefined)
+                return finding;
+            block = [];
+        }
+        if (!suppressed)
+            block.push(entry);
+    }
+    return checkBlock();
+}
 /** 对带行号的文本行应用规则（全量扫描与 git diff 增量扫描共用）。 */
-export function scanLineSet(entries, rel, policy) {
+export function scanLineSet(entries, rel, policy, selectedLines, sanitized = new Set()) {
     const language = languageForFile(rel);
     const findings = [];
-    const applied = RULES.filter((rule) => rule.languages.includes(language) || rule.languages.includes('any'));
+    const applied = RULES.filter((rule) => (rule.languages.includes(language) || rule.languages.includes('any')) && !policyIgnores(policy, rule.id, rel));
+    const entropyRule = applied.find((rule) => rule.id === 'SEC-304');
     const prevDisable = new Map();
     for (const entry of entries) {
         if (isComment(entry.text))
             prevDisable.set(entry.line + 1, disabledRules(entry.text, DISABLE_NEXT));
     }
     for (const entry of entries) {
+        if (selectedLines !== undefined && !selectedLines.has(entry.line))
+            continue;
         const isCommentLine = isComment(entry.text);
         const currentDisable = isCommentLine ? disabledRules(entry.text, DISABLE_LINE) : null;
         for (const rule of applied) {
             if (rule.id === 'SEC-304')
                 continue;
-            if (policyIgnores(policy, rule.id, rel))
+            if (rule.id === 'SEC-009' && sanitized.has(entry.line))
                 continue;
             if (shouldSkipLine(rule, currentDisable) || shouldSkipLine(rule, prevDisable.get(entry.line)))
                 continue;
@@ -133,41 +181,30 @@ export function scanLineSet(entries, rel, policy) {
                 message: rule.message,
             });
         }
-        const entropyRule = RULES.find((rule) => rule.id === 'SEC-304');
-        if (entropyRule !== undefined && !policyIgnores(policy, entropyRule.id, rel) && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
-            findings.push(...detectHighEntropy(entry.text, entry.line, rel, rel, entropyRule));
+        if (entropyRule !== undefined && !isCommentLine && !shouldSkipLine(entropyRule, currentDisable) && !shouldSkipLine(entropyRule, prevDisable.get(entry.line))) {
+            findings.push(...detectHighEntropy(entry.text, entry.line, rel, entropyRule));
         }
     }
-    return findings;
+    for (const rule of applied) {
+        if (rule.fileLevel !== true)
+            continue;
+        const finding = scanFileRule(entries, rel, rule, prevDisable, selectedLines);
+        if (finding !== undefined)
+            findings.push(finding);
+    }
+    return findings.map(finding => protectFinding({ ...finding, engine: 'builtin', evidence: 'pattern' }));
 }
 /** 扫描单个文件内容，按语言与行应用规则。 */
 export function scanText(content, file, rel, policy) {
     const lines = content.split(/\r?\n/);
     const entries = lines.map((text, index) => ({ line: index + 1, text }));
-    const findings = scanLineSet(entries, rel, policy);
-    const language = languageForFile(rel);
-    const applied = RULES.filter((rule) => rule.languages.includes(language) || rule.languages.includes('any'));
-    for (const rule of applied) {
-        if (rule.fileLevel !== true)
-            continue;
-        if (policyIgnores(policy, rule.id, rel))
-            continue;
-        if (rule.patterns.some((pattern) => pattern.test(content))) {
-            findings.push({
-                id: makeId(rule.id, rel, 1, content.slice(0, 80)),
-                ruleId: rule.id,
-                title: rule.title,
-                cwe: rule.cwe,
-                severity: rule.severity,
-                confidence: rule.confidence,
-                file: rel,
-                line: 1,
-                snippet: content.slice(0, 200),
-                message: rule.message,
-            });
-        }
-    }
-    return findings;
+    // Match file rules over contiguous lines, sharing locations and suppressions
+    // with incremental scans without joining unrelated diff hunks.
+    return scanLineSet(entries, rel, policy, undefined, languageForFile(rel) === 'javascript' ? sanitizedHtmlLines(content) : new Set());
+}
+/** Apply the same exclusions to full scans, directly selected files and diffs. */
+export function isExcludedPath(rel, policy) {
+    return rel.split('/').some((part) => DEFAULT_EXCLUDE_DIRS.includes(part)) || policyExcludesDir(policy, rel);
 }
 /** 扫描目录或单个文件。 */
 export async function scanPath(options) {
@@ -177,24 +214,35 @@ export async function scanPath(options) {
     let filesScanned = 0;
     let filesSkipped = 0;
     const findings = [];
-    const relRoot = path.relative(cwd, root) || '.';
+    const relRoot = path.relative(cwd, root).split(path.sep).join('/');
+    let complete = true;
+    const warnings = [];
+    const incomplete = (message) => { complete = false; if (warnings.length < 50)
+        warnings.push(message); };
     const visit = async (absolute, rel) => {
         options.signal?.throwIfAborted();
+        if (isExcludedPath(rel, policy)) {
+            filesSkipped += 1;
+            return;
+        }
         let stat;
         try {
             stat = await fs.lstat(absolute);
         }
         catch {
             filesSkipped += 1;
+            incomplete('无法读取 ' + rel);
             return;
         }
         options.signal?.throwIfAborted();
         if (stat.isSymbolicLink()) {
             filesSkipped += 1;
+            if (absolute === root)
+                incomplete('目标为链接，未读取链接内容');
             return;
         }
         if (stat.isDirectory()) {
-            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)) || policyExcludesDir(policy, rel))
+            if (DEFAULT_EXCLUDE_DIRS.includes(path.basename(absolute)))
                 return;
             let entries;
             try {
@@ -202,11 +250,14 @@ export async function scanPath(options) {
             }
             catch {
                 filesSkipped += 1;
+                incomplete('无法遍历 ' + rel);
                 return;
             }
             for (const entry of entries) {
-                if (filesScanned >= maxFiles)
+                if (filesScanned >= maxFiles) {
+                    incomplete('已达到文件数量上限');
                     return;
+                }
                 await visit(path.join(absolute, entry.name), rel === '' ? entry.name : rel + '/' + entry.name);
             }
             return;
@@ -217,6 +268,7 @@ export async function scanPath(options) {
         }
         if (stat.size > maxFileBytes) {
             filesSkipped += 1;
+            incomplete(rel + ' 超过文件大小上限');
             return;
         }
         let buffer;
@@ -225,6 +277,7 @@ export async function scanPath(options) {
         }
         catch {
             filesSkipped += 1;
+            incomplete('无法读取 ' + rel);
             return;
         }
         if (fileHasBinary(buffer)) {
@@ -234,11 +287,12 @@ export async function scanPath(options) {
         filesScanned += 1;
         options.signal?.throwIfAborted();
         const text = new TextDecoder('utf-8', { fatal: false }).decode(buffer);
+        options.onDocument?.({ file: rel, text });
         findings.push(...scanText(text, absolute, rel, policy));
     };
     await visit(root, relRoot);
     findings.sort((a, b) => severityRank(b.severity) - severityRank(a.severity) || a.file.localeCompare(b.file) || a.line - b.line);
-    return { root, filesScanned, filesSkipped, findings, durationMs: Date.now() - started };
+    return { root, filesScanned, filesSkipped, findings, durationMs: Date.now() - started, complete, warnings };
 }
 function severityRank(severity) {
     return severity === 'critical' ? 4 : severity === 'high' ? 3 : severity === 'medium' ? 2 : 1;

package/lib/state.d.ts

@@ -5,7 +5,14 @@
  * @module dsh-code-security/state
  */
 import type { Finding } from './scanner.js';
+import type { SourceEngine } from './config.js';
+import type { EngineCoverage } from './engines.js';
+import type { ScanScope } from './audit.js';
 export interface ScanStateEntry {
+    complete?: boolean;
+    coverage?: EngineCoverage[];
+    engines?: SourceEngine[];
+    scope?: ScanScope;
     mode: string;
     target: string;
     time: string;

package/lib/state.js

@@ -6,18 +6,33 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { createHash, randomUUID } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
 import lockfile from 'proper-lockfile';
+import { evidenceFingerprint, protectFinding, redactText } from './privacy.js';
 const STATE_FILE = 'state.json';
 const HISTORY_LIMIT = 50;
 export function findingFingerprint(finding) {
-    const raw = finding.ruleId + '|' + finding.file + '|' + finding.snippet.trim();
-    return createHash('sha256').update(raw).digest('hex');
+    return evidenceFingerprint(finding);
 }
 export function statePath(stateDir) {
     return path.join(stateDir, STATE_FILE);
 }
 export async function loadState(stateDir) {
+    const initial = await readState(stateDir);
+    const protectedState = protectState(initial);
+    if (JSON.stringify(initial) === JSON.stringify(protectedState))
+        return protectedState;
+    const unlock = await lockfile.lock(stateDir, { retries: { retries: 30, minTimeout: 25, maxTimeout: 100 } });
+    try {
+        const state = protectState(await readState(stateDir));
+        await writeState(stateDir, state);
+        return state;
+    }
+    finally {
+        await unlock();
+    }
+}
+async function readState(stateDir) {
     try {
         const info = await fs.lstat(statePath(stateDir));
         if (!info.isFile() || info.isSymbolicLink() || info.size > 16 * 1024 * 1024)
@@ -38,6 +53,13 @@ export async function loadState(stateDir) {
         return { last: null, history: [], baseline: null };
     }
 }
+function protectState(state) {
+    const clean = (entry) => {
+        const findings = entry.findings.map(protectFinding);
+        return { ...entry, ...('reason' in entry ? { reason: redactText(entry.reason) } : {}), findings, fingerprints: findings.map(findingFingerprint) };
+    };
+    return { last: state.last ? clean(state.last) : null, history: state.history.map(clean), baseline: state.baseline ? clean(state.baseline) : null };
+}
 function isEntry(value) {
     if (typeof value !== 'object' || value === null)
         return false;
@@ -71,7 +93,7 @@ export async function saveState(stateDir, entry, signal) {
     const unlock = await lockfile.lock(stateDir, { retries: { retries: 30, minTimeout: 25, maxTimeout: 100 } });
     try {
         signal?.throwIfAborted();
-        const state = await loadState(stateDir);
+        const state = protectState(await readState(stateDir));
         state.last = entry;
         state.history.unshift(entry);
         state.history = state.history.slice(0, HISTORY_LIMIT);
@@ -87,7 +109,7 @@ export async function saveBaseline(stateDir, baseline, signal) {
     const unlock = await lockfile.lock(stateDir, { retries: { retries: 30, minTimeout: 25, maxTimeout: 100 } });
     try {
         signal?.throwIfAborted();
-        const state = await loadState(stateDir);
+        const state = protectState(await readState(stateDir));
         state.baseline = baseline;
         return await writeState(stateDir, state, signal);
     }
@@ -98,7 +120,7 @@ export async function saveBaseline(stateDir, baseline, signal) {
 async function writeState(stateDir, state, signal) {
     signal?.throwIfAborted();
     const file = statePath(stateDir);
-    const tmp = file + '.tmp-' + randomUUID(), bytes = JSON.stringify(state, null, 2);
+    const tmp = file + '.tmp-' + randomUUID(), bytes = JSON.stringify(protectState(state), null, 2);
     if (Buffer.byteLength(bytes) > 16 * 1024 * 1024)
         throw new Error('安全扫描记录超过 16 MiB，本次没有保存。');
     try {
@@ -130,7 +152,8 @@ export function compareFingerprints(baseline, current) {
 export function splitByBaseline(findings, baseline) {
     if (baseline === null)
         return { fresh: findings, accepted: [] };
-    const acceptedSet = new Set(baseline.fingerprints);
+    // Recompute from saved evidence so older "./file" fingerprints remain usable.
+    const acceptedSet = new Set(baseline.findings.map(findingFingerprint));
     const fresh = [];
     const accepted = [];
     for (const finding of findings) {

package/lib/syntax.d.ts

@@ -0,0 +1 @@
+export declare function sanitizedHtmlLines(content: string): Set<number>;

package/lib/syntax.js

@@ -0,0 +1,43 @@
+/** A narrow sanitizer check with real lexical bindings, never string-based suppression. */
+import { parse } from '@babel/parser';
+import traverseModule from '@babel/traverse';
+const traverse = (traverseModule.default ?? traverseModule);
+export function sanitizedHtmlLines(content) {
+    const sinks = new Map();
+    const add = (line, safe) => { if (line)
+        sinks.set(line, [...sinks.get(line) ?? [], safe]); };
+    function trustedSanitizer(node, at) {
+        if (node?.type !== 'CallExpression' || node.arguments.length !== 1 || node.callee.type !== 'MemberExpression' || node.callee.computed || node.callee.object.type !== 'Identifier' || node.callee.property.type !== 'Identifier' || node.callee.property.name !== 'sanitize')
+            return false;
+        const binding = at.scope.getBinding(node.callee.object.name);
+        if (!binding?.constant || !binding.path.isImportDefaultSpecifier() && !binding.path.isImportNamespaceSpecifier())
+            return false;
+        if (!binding.path.parentPath.isImportDeclaration() || binding.path.parentPath.node.source.value !== 'dompurify')
+            return false;
+        return binding.referencePaths.every(ref => {
+            const member = ref.parentPath, call = member?.parentPath;
+            return member?.isMemberExpression() && !member.node.computed && member.node.property.type === 'Identifier' && member.node.property.name === 'sanitize' && call?.isCallExpression() && call.node.callee === member.node;
+        });
+    }
+    try {
+        const ast = parse(content, { sourceType: 'unambiguous', plugins: ['typescript', 'jsx'], allowReturnOutsideFunction: true });
+        traverse(ast, {
+            AssignmentExpression(at) {
+                const left = at.node.left;
+                if (left.type === 'MemberExpression' && !left.computed && left.property.type === 'Identifier' && left.property.name === 'innerHTML')
+                    add(left.loc?.start.line, trustedSanitizer(at.node.right, at));
+            },
+            JSXAttribute(at) {
+                if (at.node.name.type !== 'JSXIdentifier' || at.node.name.name !== 'dangerouslySetInnerHTML')
+                    return;
+                const expression = at.node.value?.type === 'JSXExpressionContainer' ? at.node.value.expression : undefined;
+                const html = expression?.type === 'ObjectExpression' ? expression.properties.find(prop => prop.type === 'ObjectProperty' && !prop.computed && prop.key.type === 'Identifier' && prop.key.name === '__html') : undefined;
+                add(at.node.loc?.start.line, html?.type === 'ObjectProperty' && trustedSanitizer(html.value, at));
+            },
+        });
+    }
+    catch {
+        return new Set();
+    }
+    return new Set([...sinks].filter(([, safe]) => safe.length > 0 && safe.every(Boolean)).map(([line]) => line));
+}

package/lib/tools.d.ts

@@ -1,7 +1,7 @@
 /**
- * 九个面向模型的安全审查工具：
+ * 十个面向模型的安全审查工具：
  * secure_scan / secure_diff / secure_fix_verify / secure_report / secure_export /
- * secure_baseline / secure_deps / secure_policy_show / secure_policy_set。
+ * secure_baseline / secure_deps / secure_policy_show / secure_policy_set / secure_health。
  *
  * @module dsh-code-security/tools
  */
@@ -27,4 +27,6 @@ export interface SecureToolDefinition {
     execute(args: unknown, exec: unknown): Promise<unknown>;
     timeoutMs?: number;
 }
+/** Reject ambiguous scopes before reading files, running git, or replacing scan state. */
+export declare function scanArguments(raw: unknown, allowed?: readonly string[]): Record<string, unknown>;
 export declare function buildSecureTools(cfg: ResolvedSecureConfig, cwd: string, runner: ProcessRunner): SecureToolDefinition[];