eaa-kit 0.2.1 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +51 -4
- package/dist/astro/index.d.ts +7 -34
- package/dist/astro/index.js +6 -26
- package/dist/audit/runners/worker.js +1 -1
- package/dist/audit-CPoZMXGM.js +779 -0
- package/dist/audit-CpXH2Mk8.js +2 -0
- package/dist/{baseline-CV_3lbER.js → baseline-22Y1NWxM.js} +1 -1
- package/dist/{baseline-CgBmzFTr.js → baseline-DB9CZGnV.js} +17 -27
- package/dist/cli/index.js +336 -142
- package/dist/collect-CFM8gEVv.js +134 -0
- package/dist/command-D8l_oYbV.js +77 -0
- package/dist/component-C3GL1Mnu.js +146 -0
- package/dist/component-DKd3EHOg.js +2 -0
- package/dist/coverage-B4IBKMO8.js +521 -0
- package/dist/{crawl-CtJbMNNb.js → crawl-BiI1Lau_.js} +13 -23
- package/dist/eleventy/index.d.ts +28 -0
- package/dist/eleventy/index.js +19 -0
- package/dist/frameworks-B4ClIJgE.js +314 -0
- package/dist/frameworks-etFg_O8K.js +2 -0
- package/dist/fs-BmPtmFke.js +40 -0
- package/dist/html-BGTO3ypW.js +543 -0
- package/dist/{impact-DvgBjupx.js → impact-DZt2oBCP.js} +15 -1
- package/dist/index.js +2 -2
- package/dist/{init-DRKIdpK1.js → init-DIWDE35F.js} +13 -10
- package/dist/jsdom-4IMzv0eE.js +3 -0
- package/dist/jsdom-DCpGSLfW.js +81 -0
- package/dist/{json-C9xS1PNC.js → json-DjEvy1nX.js} +19 -22
- package/dist/json-QQuFIw1W.js +2 -0
- package/dist/{load-sCkKsvGQ.js → load-5wRGLvub.js} +3 -9
- package/dist/nuxt/index.d.ts +35 -0
- package/dist/nuxt/index.js +23 -0
- package/dist/{playwright-DSRnXmcd.js → playwright-BWniOain.js} +70 -23
- package/dist/{pool-DixLeu8L.js → pool-BMevaLWD.js} +4 -12
- package/dist/{project-CufCqIE2.js → project-CzOnkLH6.js} +14 -21
- package/dist/project-MFrXcw1M.js +2 -0
- package/dist/remediation-Dtowi2EC.js +321 -0
- package/dist/{render-BO0nVrrZ.js → render-DrvXRCEn.js} +8 -16
- package/dist/{result-2aZPfM8w.js → result-DoamKFsp.js} +115 -1
- package/dist/routes-CmdRUuOs.js +265 -0
- package/dist/run-BMASMmwO.d.ts +45 -0
- package/dist/run-DB34BSOZ.js +53 -0
- package/dist/{sarif-eSCuI0eX.js → sarif-SR3_lLYd.js} +22 -36
- package/dist/{schema-CMZ8ItGk.js → schema-is6CGX2D.js} +4 -1
- package/dist/text-CKKpzkYM.js +43 -0
- package/dist/vite/index.d.ts +39 -0
- package/dist/vite/index.js +40 -0
- package/dist/webpack/index.d.ts +33 -0
- package/dist/webpack/index.js +20 -0
- package/package.json +36 -9
- package/dist/audit-B2dIKpJ5.js +0 -2
- package/dist/audit-DXpKkXsC.js +0 -950
- package/dist/escape-Dm1o_RAk.js +0 -21
- package/dist/html-BLEuzep6.js +0 -337
- package/dist/jsdom-BEu6Ra_2.js +0 -163
- package/dist/jsdom-C6dIyaxN.js +0 -3
- package/dist/routes-BxbSZKXC.js +0 -123
|
@@ -0,0 +1,314 @@
|
|
|
1
|
+
import { t as exists } from "./fs-BmPtmFke.js";
|
|
2
|
+
import { readFile } from "node:fs/promises";
|
|
3
|
+
import path from "node:path";
|
|
4
|
+
//#region src/audit/frameworks.ts
|
|
5
|
+
/**
|
|
6
|
+
* Most specific first. Several of these depend on Vite, so Vite is last: a
|
|
7
|
+
* SvelteKit project is a SvelteKit project, not a Vite one.
|
|
8
|
+
*
|
|
9
|
+
* Several carry `files` as well as `packages` even though they are npm
|
|
10
|
+
* packages. A config file named after the framework is as good an identifier as
|
|
11
|
+
* the dependency, and it still works where package.json is missing, unreadable,
|
|
12
|
+
* or belongs to a workspace root rather than the project in front of us.
|
|
13
|
+
*/
|
|
14
|
+
const FRAMEWORKS = [
|
|
15
|
+
{
|
|
16
|
+
id: "next",
|
|
17
|
+
name: "Next.js",
|
|
18
|
+
packages: ["next"],
|
|
19
|
+
files: [
|
|
20
|
+
"next.config.js",
|
|
21
|
+
"next.config.mjs",
|
|
22
|
+
"next.config.ts"
|
|
23
|
+
],
|
|
24
|
+
outputs: ["out"],
|
|
25
|
+
configs: [
|
|
26
|
+
"next.config.js",
|
|
27
|
+
"next.config.mjs",
|
|
28
|
+
"next.config.ts"
|
|
29
|
+
],
|
|
30
|
+
outputPattern: /distDir\s*:\s*['"`]([^'"`]+)['"`]/,
|
|
31
|
+
staticOutput: {
|
|
32
|
+
needs: "output: 'export'",
|
|
33
|
+
how: "add output: 'export' to your Next config, then build"
|
|
34
|
+
},
|
|
35
|
+
serves: true
|
|
36
|
+
},
|
|
37
|
+
{
|
|
38
|
+
id: "nuxt",
|
|
39
|
+
name: "Nuxt",
|
|
40
|
+
packages: ["nuxt"],
|
|
41
|
+
files: ["nuxt.config.ts", "nuxt.config.js"],
|
|
42
|
+
outputs: [".output/public", "dist"],
|
|
43
|
+
staticOutput: {
|
|
44
|
+
needs: "nuxt generate",
|
|
45
|
+
how: "run nuxt generate rather than nuxt build"
|
|
46
|
+
},
|
|
47
|
+
serves: true
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
id: "sveltekit",
|
|
51
|
+
name: "SvelteKit",
|
|
52
|
+
packages: ["@sveltejs/kit"],
|
|
53
|
+
files: ["svelte.config.js"],
|
|
54
|
+
outputs: ["build", ".svelte-kit/output/prerendered/pages"],
|
|
55
|
+
staticOutput: {
|
|
56
|
+
needs: "@sveltejs/adapter-static",
|
|
57
|
+
how: "use @sveltejs/adapter-static, then build"
|
|
58
|
+
},
|
|
59
|
+
serves: true
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
id: "remix",
|
|
63
|
+
name: "React Router / Remix",
|
|
64
|
+
packages: [
|
|
65
|
+
"@remix-run/react",
|
|
66
|
+
"react-router",
|
|
67
|
+
"@react-router/dev"
|
|
68
|
+
],
|
|
69
|
+
outputs: ["build/client"],
|
|
70
|
+
serves: true
|
|
71
|
+
},
|
|
72
|
+
{
|
|
73
|
+
id: "astro",
|
|
74
|
+
name: "Astro",
|
|
75
|
+
packages: ["astro"],
|
|
76
|
+
files: [
|
|
77
|
+
"astro.config.mjs",
|
|
78
|
+
"astro.config.js",
|
|
79
|
+
"astro.config.ts"
|
|
80
|
+
],
|
|
81
|
+
outputs: ["dist"],
|
|
82
|
+
configs: [
|
|
83
|
+
"astro.config.mjs",
|
|
84
|
+
"astro.config.js",
|
|
85
|
+
"astro.config.ts"
|
|
86
|
+
],
|
|
87
|
+
outputPattern: /outDir\s*:\s*['"`]([^'"`]+)['"`]/,
|
|
88
|
+
serves: true
|
|
89
|
+
},
|
|
90
|
+
{
|
|
91
|
+
id: "gatsby",
|
|
92
|
+
name: "Gatsby",
|
|
93
|
+
packages: ["gatsby"],
|
|
94
|
+
outputs: ["public"],
|
|
95
|
+
serves: false
|
|
96
|
+
},
|
|
97
|
+
{
|
|
98
|
+
id: "docusaurus",
|
|
99
|
+
name: "Docusaurus",
|
|
100
|
+
packages: ["@docusaurus/core"],
|
|
101
|
+
outputs: ["build"],
|
|
102
|
+
serves: false
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
id: "vitepress",
|
|
106
|
+
name: "VitePress",
|
|
107
|
+
packages: ["vitepress"],
|
|
108
|
+
files: [".vitepress/config.ts", "docs/.vitepress/config.ts"],
|
|
109
|
+
outputs: [".vitepress/dist", "docs/.vitepress/dist"],
|
|
110
|
+
serves: false
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
id: "eleventy",
|
|
114
|
+
name: "Eleventy",
|
|
115
|
+
packages: ["@11ty/eleventy"],
|
|
116
|
+
outputs: ["_site"],
|
|
117
|
+
configs: [
|
|
118
|
+
".eleventy.js",
|
|
119
|
+
"eleventy.config.js",
|
|
120
|
+
"eleventy.config.mjs"
|
|
121
|
+
],
|
|
122
|
+
outputPattern: /output\s*:\s*['"`]([^'"`]+)['"`]/,
|
|
123
|
+
serves: false
|
|
124
|
+
},
|
|
125
|
+
{
|
|
126
|
+
id: "angular",
|
|
127
|
+
name: "Angular",
|
|
128
|
+
packages: ["@angular/core"],
|
|
129
|
+
outputs: ["dist"],
|
|
130
|
+
serves: false
|
|
131
|
+
},
|
|
132
|
+
{
|
|
133
|
+
id: "cra",
|
|
134
|
+
name: "Create React App",
|
|
135
|
+
packages: ["react-scripts"],
|
|
136
|
+
outputs: ["build"],
|
|
137
|
+
serves: false
|
|
138
|
+
},
|
|
139
|
+
{
|
|
140
|
+
id: "hugo",
|
|
141
|
+
name: "Hugo",
|
|
142
|
+
packages: [],
|
|
143
|
+
files: [
|
|
144
|
+
"hugo.toml",
|
|
145
|
+
"hugo.yaml",
|
|
146
|
+
"config.toml"
|
|
147
|
+
],
|
|
148
|
+
outputs: ["public"],
|
|
149
|
+
serves: false
|
|
150
|
+
},
|
|
151
|
+
{
|
|
152
|
+
id: "jekyll",
|
|
153
|
+
name: "Jekyll",
|
|
154
|
+
packages: [],
|
|
155
|
+
files: ["_config.yml"],
|
|
156
|
+
outputs: ["_site"],
|
|
157
|
+
serves: false
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
id: "wordpress",
|
|
161
|
+
name: "WordPress",
|
|
162
|
+
packages: [],
|
|
163
|
+
files: [
|
|
164
|
+
"wp-config.php",
|
|
165
|
+
"wp-config-sample.php",
|
|
166
|
+
"wp-load.php"
|
|
167
|
+
],
|
|
168
|
+
outputs: [],
|
|
169
|
+
serves: true,
|
|
170
|
+
serveCommand: "wp-env start, ddev start, or whichever local stack this site uses"
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
id: "typo3",
|
|
174
|
+
name: "TYPO3",
|
|
175
|
+
packages: [],
|
|
176
|
+
files: [
|
|
177
|
+
"typo3conf",
|
|
178
|
+
"public/typo3conf",
|
|
179
|
+
"typo3"
|
|
180
|
+
],
|
|
181
|
+
outputs: [],
|
|
182
|
+
serves: true,
|
|
183
|
+
serveCommand: "ddev start, or your usual local stack"
|
|
184
|
+
},
|
|
185
|
+
{
|
|
186
|
+
id: "craft",
|
|
187
|
+
name: "Craft CMS",
|
|
188
|
+
packages: [],
|
|
189
|
+
files: ["craft"],
|
|
190
|
+
outputs: [],
|
|
191
|
+
serves: true,
|
|
192
|
+
serveCommand: "ddev start, or php craft serve"
|
|
193
|
+
},
|
|
194
|
+
{
|
|
195
|
+
id: "laravel",
|
|
196
|
+
name: "Laravel",
|
|
197
|
+
packages: [],
|
|
198
|
+
files: ["artisan"],
|
|
199
|
+
outputs: [],
|
|
200
|
+
serves: true,
|
|
201
|
+
serveCommand: "php artisan serve"
|
|
202
|
+
},
|
|
203
|
+
{
|
|
204
|
+
id: "symfony",
|
|
205
|
+
name: "Symfony",
|
|
206
|
+
packages: [],
|
|
207
|
+
files: ["bin/console", "symfony.lock"],
|
|
208
|
+
outputs: [],
|
|
209
|
+
serves: true,
|
|
210
|
+
serveCommand: "symfony serve, or php -S localhost:8000 -t public"
|
|
211
|
+
},
|
|
212
|
+
{
|
|
213
|
+
id: "rails",
|
|
214
|
+
name: "Ruby on Rails",
|
|
215
|
+
packages: [],
|
|
216
|
+
files: ["bin/rails", "config.ru"],
|
|
217
|
+
outputs: [],
|
|
218
|
+
serves: true,
|
|
219
|
+
serveCommand: "bin/rails server"
|
|
220
|
+
},
|
|
221
|
+
{
|
|
222
|
+
id: "django",
|
|
223
|
+
name: "Django",
|
|
224
|
+
packages: [],
|
|
225
|
+
files: ["manage.py"],
|
|
226
|
+
outputs: [],
|
|
227
|
+
serves: true,
|
|
228
|
+
serveCommand: "python manage.py runserver"
|
|
229
|
+
},
|
|
230
|
+
{
|
|
231
|
+
id: "vite",
|
|
232
|
+
name: "Vite",
|
|
233
|
+
packages: ["vite"],
|
|
234
|
+
outputs: ["dist"],
|
|
235
|
+
configs: [
|
|
236
|
+
"vite.config.ts",
|
|
237
|
+
"vite.config.js",
|
|
238
|
+
"vite.config.mjs"
|
|
239
|
+
],
|
|
240
|
+
outputPattern: /outDir\s*:\s*['"`]([^'"`]+)['"`]/,
|
|
241
|
+
serves: true
|
|
242
|
+
}
|
|
243
|
+
];
|
|
244
|
+
/** Output directories to try when nothing was recognised. */
|
|
245
|
+
const FALLBACK_OUTPUTS = [
|
|
246
|
+
"dist",
|
|
247
|
+
"out",
|
|
248
|
+
"build",
|
|
249
|
+
"_site",
|
|
250
|
+
"public",
|
|
251
|
+
".output/public"
|
|
252
|
+
];
|
|
253
|
+
/**
|
|
254
|
+
* The framework this project uses, if it is one this knows.
|
|
255
|
+
*
|
|
256
|
+
* Dependencies decide it where there are any, because a package.json states
|
|
257
|
+
* what a project is far more reliably than a file lying in the root. The
|
|
258
|
+
* file-based entries exist for Hugo and Jekyll, which have no package.json to
|
|
259
|
+
* read.
|
|
260
|
+
*/
|
|
261
|
+
async function detectFramework(cwd, pkg) {
|
|
262
|
+
const deps = {
|
|
263
|
+
...pkg?.dependencies,
|
|
264
|
+
...pkg?.devDependencies
|
|
265
|
+
};
|
|
266
|
+
for (const framework of FRAMEWORKS) {
|
|
267
|
+
const byPackage = framework.packages.some((name) => deps[name] !== void 0);
|
|
268
|
+
let byFile = false;
|
|
269
|
+
if (!byPackage && framework.files !== void 0) {
|
|
270
|
+
for (const file of framework.files) if (await exists(file, cwd)) {
|
|
271
|
+
byFile = true;
|
|
272
|
+
break;
|
|
273
|
+
}
|
|
274
|
+
}
|
|
275
|
+
if (!byPackage && !byFile) continue;
|
|
276
|
+
const configured = await outputFromConfig(cwd, framework);
|
|
277
|
+
const outputs = configured === void 0 ? [...framework.outputs] : [configured, ...framework.outputs];
|
|
278
|
+
return {
|
|
279
|
+
framework,
|
|
280
|
+
outputs: [...new Set(outputs)]
|
|
281
|
+
};
|
|
282
|
+
}
|
|
283
|
+
}
|
|
284
|
+
/**
|
|
285
|
+
* A custom output directory, read out of the framework's config file.
|
|
286
|
+
*
|
|
287
|
+
* Read with a pattern rather than executed. A config file is code, and this runs
|
|
288
|
+
* before anything has decided the project is worth trusting; a regex that
|
|
289
|
+
* misses a computed value is a directory not found, which the caller already
|
|
290
|
+
* handles, while running the file to find out is a different class of risk
|
|
291
|
+
* entirely.
|
|
292
|
+
*/
|
|
293
|
+
async function outputFromConfig(cwd, framework) {
|
|
294
|
+
if (framework.configs === void 0 || framework.outputPattern === void 0) return void 0;
|
|
295
|
+
for (const name of framework.configs) {
|
|
296
|
+
let source;
|
|
297
|
+
try {
|
|
298
|
+
source = await readFile(path.resolve(cwd, name), "utf8");
|
|
299
|
+
} catch {
|
|
300
|
+
continue;
|
|
301
|
+
}
|
|
302
|
+
const value = framework.outputPattern.exec(source)?.[1];
|
|
303
|
+
if (value === void 0 || value === "") continue;
|
|
304
|
+
if (path.isAbsolute(value)) continue;
|
|
305
|
+
return value.replace(/^\.\//, "");
|
|
306
|
+
}
|
|
307
|
+
}
|
|
308
|
+
/** Every output directory worth trying, framework-aware, most likely first. */
|
|
309
|
+
async function candidateOutputs(cwd, pkg) {
|
|
310
|
+
const detected = await detectFramework(cwd, pkg);
|
|
311
|
+
return [.../* @__PURE__ */ new Set([...detected?.outputs ?? [], ...FALLBACK_OUTPUTS])];
|
|
312
|
+
}
|
|
313
|
+
//#endregion
|
|
314
|
+
export { outputFromConfig as a, detectFramework as i, FRAMEWORKS as n, candidateOutputs as r, FALLBACK_OUTPUTS as t };
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
import { stat } from "node:fs/promises";
|
|
2
|
+
import path from "node:path";
|
|
3
|
+
//#region src/fs.ts
|
|
4
|
+
/**
|
|
5
|
+
* Asking the filesystem a yes-or-no question.
|
|
6
|
+
*
|
|
7
|
+
* Six modules had their own copy of the same try/stat/catch, each answering a
|
|
8
|
+
* slightly different question and each getting it right by hand. A path that
|
|
9
|
+
* cannot be stat'd is not a path of the kind asked about, which is the only
|
|
10
|
+
* behaviour any caller here wants from an unreadable directory.
|
|
11
|
+
*/
|
|
12
|
+
/** Whether anything is there, resolved against `root` when one is given. */
|
|
13
|
+
async function exists(target, root) {
|
|
14
|
+
try {
|
|
15
|
+
await stat(root === void 0 ? target : path.resolve(root, target));
|
|
16
|
+
return true;
|
|
17
|
+
} catch {
|
|
18
|
+
return false;
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
async function isFile(target) {
|
|
22
|
+
try {
|
|
23
|
+
return (await stat(target)).isFile();
|
|
24
|
+
} catch {
|
|
25
|
+
return false;
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
async function isDirectory(target) {
|
|
29
|
+
try {
|
|
30
|
+
return (await stat(target)).isDirectory();
|
|
31
|
+
} catch {
|
|
32
|
+
return false;
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
/** Platform-native separators to POSIX, so paths in reports match everywhere. */
|
|
36
|
+
function toPosix(filePath) {
|
|
37
|
+
return filePath.split(path.sep).join("/");
|
|
38
|
+
}
|
|
39
|
+
//#endregion
|
|
40
|
+
export { toPosix as i, isDirectory as n, isFile as r, exists as t };
|