npm - easyvibegate - Versions diffs - 0.4.4 - Mend

easyvibegate 0.4.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (34) hide show

package/LICENSE +21 -0
package/README.en.md +123 -0
package/README.md +144 -0
package/dist/cli/index.js +402 -0
package/dist/cli/wizard.js +196 -0
package/dist/engine/aifix.js +65 -0
package/dist/engine/checkers/backend/firebase.js +146 -0
package/dist/engine/checkers/backend/supabase.js +249 -0
package/dist/engine/checkers/deep/deps.js +118 -0
package/dist/engine/checkers/index.js +15 -0
package/dist/engine/checkers/live/endpoint-probe.js +72 -0
package/dist/engine/checkers/live/http-checks.js +123 -0
package/dist/engine/checkers/live/idor.js +101 -0
package/dist/engine/checkers/static/client-exposure.js +34 -0
package/dist/engine/checkers/static/config-risks.js +89 -0
package/dist/engine/checkers/static/env-git.js +70 -0
package/dist/engine/checkers/static/rls-migrations.js +324 -0
package/dist/engine/checkers/static/route-inventory.js +31 -0
package/dist/engine/checkers/static/secrets.js +262 -0
package/dist/engine/config.js +54 -0
package/dist/engine/detect.js +110 -0
package/dist/engine/endpoints.js +65 -0
package/dist/engine/i18n.js +189 -0
package/dist/engine/net/http.js +108 -0
package/dist/engine/report.js +219 -0
package/dist/engine/scan.js +53 -0
package/dist/engine/types.js +1 -0
package/dist/engine/util/color.js +17 -0
package/dist/engine/util/mask.js +66 -0
package/dist/engine/util/text.js +50 -0
package/dist/engine/version.js +12 -0
package/dist/engine/walk.js +86 -0
package/dist/orchestrator/flow.js +116 -0
package/package.json +46 -0

package/dist/engine/checkers/live/http-checks.js ADDED Viewed

@@ -0,0 +1,123 @@
+import { isErr, request, requestFollow, unreliable } from '../../net/http.js';
+const EXPOSED = [
+    { path: '.env', signature: /^[A-Z0-9_]+=.+/m, title: '.env file served publicly', severity: 'critical' },
+    { path: '.env.local', signature: /^[A-Z0-9_]+=.+/m, title: '.env.local served publicly', severity: 'critical' },
+    { path: '.env.production', signature: /^[A-Z0-9_]+=.+/m, title: '.env.production served publicly', severity: 'critical' },
+    { path: '.git/config', signature: /\[core\]|\[remote/, title: '.git/config served publicly', severity: 'critical' },
+    { path: '.git/HEAD', signature: /^ref:\s/m, title: '.git/HEAD served publicly', severity: 'critical' },
+    { path: 'backup.sql', signature: /CREATE TABLE|INSERT INTO/i, title: 'SQL backup served publicly', severity: 'critical' },
+    { path: 'config.json', signature: /"[^"]*(api[_-]?key|secret|password|token|credential)[^"]*"\s*:/i, title: 'config.json served publicly', severity: 'warning' },
+];
+const SECURITY_HEADERS = [
+    { header: 'content-security-policy', id: 'missing_csp', title: 'Missing Content-Security-Policy' },
+    { header: 'strict-transport-security', id: 'missing_hsts', title: 'Missing Strict-Transport-Security' },
+    { header: 'x-frame-options', id: 'missing_xfo', title: 'Missing X-Frame-Options' },
+    { header: 'x-content-type-options', id: 'missing_xcto', title: 'Missing X-Content-Type-Options' },
+];
+function looksLikeHtml(body) {
+    return /<!doctype html|<html[\s>]/i.test(body.slice(0, 400));
+}
+/** Passive live checks on a deployed URL: exposed files + security headers. */
+export async function checkLiveSite(appUrl) {
+    const base = appUrl.replace(/\/$/, '');
+    const findings = [];
+    // Track every file probe: a timeout/5xx/429 there is a lost sub-check, not "file absent".
+    let fileErrors = 0;
+    for (const probe of EXPOSED) {
+        const res = await request(`${base}/${probe.path}`);
+        if (isErr(res) || res.status === 429 || res.status >= 500) {
+            fileErrors++;
+            continue;
+        }
+        if (res.status !== 200)
+            continue; // 404 etc. = that file is simply not served
+        if (looksLikeHtml(res.body))
+            continue; // SPA catch-all, not the real file
+        if (!probe.signature.test(res.body))
+            continue;
+        findings.push({
+            id: `exposed_${probe.path.replace(/[^a-z0-9]/gi, '_')}`,
+            severity: probe.severity,
+            title: probe.title,
+            detail: `${base}/${probe.path} is served and returns file content, not an app page.`,
+            fix: 'Block dotfiles and backups at the web server/CDN, and remove the file from the deploy output.',
+            checker: 'live-site',
+            level: 2,
+            endpoint: `GET /${probe.path}`,
+        });
+    }
+    // Follow redirects (bounded) so headers are read from the real page, not a 301/302 hop.
+    // Only analyze headers on a reliable response — a 5xx/429 must not masquerade as "headers missing".
+    const root = await requestFollow(base + '/');
+    // Only a genuine 2xx page supports a verdict about its headers.
+    if (!isErr(root) && root.status >= 200 && root.status < 300) {
+        for (const h of SECURITY_HEADERS) {
+            if (!root.headers.get(h.header)) {
+                findings.push({
+                    id: h.id,
+                    severity: 'warning',
+                    title: h.title,
+                    detail: `The response for ${base}/ does not set ${h.header}.`,
+                    fix: `Add the ${h.header} header at the app or CDN layer.`,
+                    checker: 'live-site',
+                    level: 2,
+                    endpoint: 'GET /',
+                });
+            }
+        }
+        const powered = root.headers.get('x-powered-by');
+        if (powered) {
+            findings.push({
+                id: 'server_disclosure',
+                severity: 'info',
+                title: 'Technology disclosed via X-Powered-By',
+                detail: `Response advertises "${powered}", helping an attacker fingerprint the stack.`,
+                fix: 'Remove or mask the X-Powered-By header.',
+                checker: 'live-site',
+                level: 2,
+                endpoint: 'GET /',
+            });
+        }
+        // Inspect each Set-Cookie separately — one hardened cookie must not mask another.
+        const cookies = root.hopCookies?.length ? root.hopCookies : getSetCookies(root.headers);
+        for (const c of cookies) {
+            const name = c.split('=', 1)[0]?.trim() || 'cookie';
+            const secure = /;\s*secure/i.test(c);
+            const httpOnly = /;\s*httponly/i.test(c);
+            if (!secure || !httpOnly) {
+                const missing = [!secure ? 'Secure' : null, !httpOnly ? 'HttpOnly' : null].filter(Boolean).join(' + ');
+                findings.push({
+                    id: 'cookie_flags',
+                    severity: 'warning',
+                    title: `Cookie "${name}" missing ${missing}`,
+                    detail: `Set-Cookie for "${name}" is missing ${missing}. If it is a session/auth cookie, that weakens it against theft.`,
+                    fix: 'Set Secure and HttpOnly (and SameSite) on session/auth cookies.',
+                    checker: 'live-site',
+                    level: 2,
+                    endpoint: 'GET /',
+                });
+            }
+        }
+    }
+    // Aggregate: the root page AND every file probe count. Losing any sub-check = partial;
+    // losing all of them = failed.
+    const rootBad = unreliable(root) || (!isErr(root) && (root.status < 200 || root.status >= 300));
+    const truncated = !isErr(root) && root.truncated === true;
+    const status = rootBad && fileErrors === EXPOSED.length ? 'failed' : rootBad || fileErrors > 0 || truncated ? 'partial' : 'completed';
+    const notes = [];
+    if (rootBad)
+        notes.push(isErr(root) ? `could not reach ${base}/: ${root.error}` : `no usable 2xx page (HTTP ${root.status}) at ${base}/`);
+    if (fileErrors > 0)
+        notes.push(`${fileErrors}/${EXPOSED.length} exposed-file probes errored`);
+    if (!isErr(root) && root.truncated)
+        notes.push('response body hit the 2 MB cap — content past it was not inspected');
+    return { findings, run: { id: 'live-site', level: 2, status, note: notes.length ? notes.join('; ') : undefined } };
+}
+/** Get individual Set-Cookie header values (undici exposes getSetCookie()). */
+function getSetCookies(headers) {
+    const withGetter = headers;
+    if (typeof withGetter.getSetCookie === 'function')
+        return withGetter.getSetCookie();
+    const single = headers.get('set-cookie');
+    return single ? [single] : [];
+}

package/dist/engine/checkers/live/idor.js ADDED Viewed

@@ -0,0 +1,101 @@
+import { concretePath } from '../../endpoints.js';
+import { isErr, request, sleep, unreliable } from '../../net/http.js';
+function bearer(token) {
+    return { Authorization: `Bearer ${token}`, accept: 'application/json' };
+}
+/** Real, non-empty JSON payload — an empty collection or an error envelope is not data. */
+function hasData(body) {
+    const t = body.trim();
+    if (t.length < 2 || !(t.startsWith('{') || t.startsWith('[')))
+        return false;
+    try {
+        const v = JSON.parse(t);
+        if (Array.isArray(v))
+            return v.length > 0;
+        if (v && typeof v === 'object') {
+            const o = v;
+            if ('error' in o || 'errors' in o)
+                return false;
+            return Object.keys(o).length > 0;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Differential IDOR/BOLA probe. For each object-scoped endpoint, requests the
+ * same resource as two different users and classifies the PAIR:
+ *   - either side unreliable (timeout/5xx/429) → inconclusive, not a verdict
+ *   - both 200 with data                       → candidate cross-user access
+ *   - otherwise                                → a definitive (non-leaking) answer
+ * Harvesting real object IDs and judging ambiguous cases is left to the
+ * operator or the AI-driven skill; the run status says how much was proven.
+ */
+export async function idorDifferential(appUrl, endpoints, tokenA, tokenB, rateLimitMs = 120) {
+    const base = appUrl.replace(/\/$/, '');
+    const findings = [];
+    // Two different, non-empty identities or the comparison proves nothing.
+    if (!tokenA.trim() || !tokenB.trim() || tokenA === tokenB) {
+        return { findings, run: { id: 'idor', level: 2, status: 'skipped', note: 'needs two different non-empty account tokens' } };
+    }
+    const idCandidates = endpoints
+        .filter((e) => (e.method === 'GET' || e.method === 'ANY') && /(:[A-Za-z0-9_]+|\[[^\]]+\]|\{[^}]+\})/.test(e.path));
+    const MAX = 40;
+    const idEndpoints = idCandidates.slice(0, MAX);
+    const droppedPairs = idCandidates.length - idEndpoints.length;
+    if (idEndpoints.length === 0) {
+        return { findings, run: { id: 'idor', level: 2, status: 'skipped', note: 'no object-scoped (id) endpoints found' } };
+    }
+    let inconclusive = 0; // a side timed out / 5xx / 429 — we learned nothing
+    let evaluated = 0; // both sides answered reliably
+    let dataSeen = 0; // at least one side returned actual data (the guessed id exists)
+    for (const e of idEndpoints) {
+        const path = concretePath(e.path).replace(/^\/?/, '/');
+        await sleep(rateLimitMs);
+        const a = await request(base + path, { headers: bearer(tokenA) });
+        await sleep(rateLimitMs);
+        const b = await request(base + path, { headers: bearer(tokenB) });
+        if (unreliable(a) || unreliable(b) || isErr(a) || isErr(b)) {
+            inconclusive++;
+            continue;
+        }
+        evaluated++;
+        const aOk = a.status === 200 && hasData(a.body);
+        const bOk = b.status === 200 && hasData(b.body);
+        if (aOk || bOk)
+            dataSeen++;
+        if (aOk && bOk) {
+            const identical = a.body === b.body;
+            findings.push({
+                id: 'idor_cross_user',
+                severity: 'warning',
+                title: `Two accounts both read ${path}`,
+                detail: identical
+                    ? `Both accounts received the identical object at ${path}. If this resource is meant to be private/per-user, that is an IDOR; if it is public/shared, it is fine — confirm which.`
+                    : `Both accounts got a 200 with data at ${path}. Verify each only ever sees their own record.`,
+                fix: 'Enforce ownership server-side: check the authenticated user owns the requested id before returning it (or apply RLS). To confirm exploitability, request an id you know belongs to account A while authenticated as account B.',
+                checker: 'idor',
+                level: 2,
+                endpoint: `GET ${path}`,
+            });
+        }
+    }
+    const total = idEndpoints.length;
+    if (evaluated === 0) {
+        return { findings, run: { id: 'idor', level: 2, status: 'failed', note: `all ${total} pair(s) were inconclusive (timeout/5xx/429)` } };
+    }
+    if (inconclusive > 0 || droppedPairs > 0) {
+        const n = [];
+        if (inconclusive > 0)
+            n.push(`${inconclusive}/${total} pair(s) inconclusive (timeout/5xx/429)`);
+        if (droppedPairs > 0)
+            n.push(`only ${MAX}/${idCandidates.length} object endpoints probed (cap)`);
+        return { findings, run: { id: 'idor', level: 2, status: 'partial', note: n.join('; ') } };
+    }
+    if (dataSeen === 0) {
+        return { findings, run: { id: 'idor', level: 2, status: 'partial', note: 'no endpoint returned data for the guessed id — provide real object ids to confirm ownership' } };
+    }
+    return { findings, run: { id: 'idor', level: 2, status: 'completed' } };
+}

package/dist/engine/checkers/static/client-exposure.js ADDED Viewed

@@ -0,0 +1,34 @@
+import { lineAt, looksLikePlaceholder, redact } from '../../util/text.js';
+// Public env prefixes are inlined into the browser bundle by the bundler.
+const PUBLIC_PREFIX = '(?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|PUBLIC_)';
+// A public var whose NAME implies a real secret (not an anon/publishable key).
+const PUBLIC_SECRET = new RegExp(`\\b${PUBLIC_PREFIX}[A-Z0-9_]*(SERVICE_ROLE|SECRET|PRIVATE|PASSWORD|PASSWD|TOKEN|CREDENTIAL|API_KEY|ACCESS_KEY)[A-Z0-9_]*\\s*[:=]\\s*["']?([^"'\\s]{6,})`, 'gi');
+export const clientExposureChecker = {
+    id: 'client-exposure',
+    title: 'Secrets exposed to the browser',
+    level: 0,
+    run(ctx) {
+        const findings = [];
+        for (const file of ctx.files) {
+            const { content, rel } = file;
+            for (const m of content.matchAll(PUBLIC_SECRET)) {
+                const value = m[2] ?? '';
+                if (looksLikePlaceholder(value))
+                    continue;
+                findings.push({
+                    id: 'public_env_secret',
+                    severity: 'critical',
+                    title: 'Server secret exposed via a public env var',
+                    detail: `A public-prefixed variable carries a secret-looking value (${redact(value)}). Anything with a public prefix is shipped to the browser.`,
+                    fix: 'Drop the public prefix, read this value only in server code, and rotate it — it may already be in a deployed bundle.',
+                    checker: 'client-exposure',
+                    level: 0,
+                    file: rel,
+                    line: lineAt(content, m.index ?? 0),
+                    evidence: redact(value),
+                });
+            }
+        }
+        return findings;
+    },
+};

package/dist/engine/checkers/static/config-risks.js ADDED Viewed

@@ -0,0 +1,89 @@
+import { lineAt } from '../../util/text.js';
+import { looksMinified, maskCode } from '../../util/mask.js';
+const RULES = [
+    {
+        id: 'cors_star',
+        title: 'CORS open to any origin',
+        re: /Access-Control-Allow-Origin["']?\s*[:,]\s*["']\*["']|origin\s*:\s*["']\*["']/g,
+        severity: 'warning',
+        detail: 'The API allows any origin ("*"). If it also allows credentials this is a serious CORS hole; even without credentials it widens exposure.',
+        fix: 'Set an explicit allowlist of origins instead of "*", and never combine "*" with credentials.',
+        maskStrings: false,
+    },
+    {
+        id: 'debug_on',
+        title: 'Debug mode enabled',
+        re: /\bDEBUG\s*=\s*True\b|debug\s*=\s*True\b|run\([^)]*debug\s*=\s*True/g,
+        severity: 'warning',
+        detail: 'Debug mode leaks stack traces and internals to visitors in production.',
+        fix: 'Drive debug from an env var and keep it off in production.',
+        maskStrings: true,
+    },
+    {
+        id: 'eval_use',
+        title: 'Use of eval / new Function',
+        re: /\beval\s*\(|\bnew\s+Function\s*\(/g,
+        severity: 'warning',
+        detail: 'eval on any untrusted input is a code-execution risk.',
+        fix: 'Replace eval with explicit parsing/logic; never eval user-supplied data.',
+        maskStrings: true,
+    },
+    {
+        id: 'sql_interpolation',
+        title: 'SQL built by string interpolation',
+        // Requires real query shape: a DML verb + a clause keyword + interpolation,
+        // inside one string literal — so prose mentioning "insert" won't match.
+        // Quantifiers are length-bounded ({0,200}) to prevent catastrophic
+        // backtracking (ReDoS) on very long / minified lines.
+        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f["']\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^"'\n]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^"'\n]{0,200}\{/gi,
+        severity: 'warning',
+        detail: 'Interpolating values into SQL invites SQL injection.',
+        fix: 'Use parameterized queries / prepared statements instead of string interpolation.',
+        maskStrings: false,
+    },
+    {
+        id: 'jwt_alg_none',
+        title: 'JWT algorithm set to none',
+        re: /(?:alg|algorithm)["']?\s*[:=]\s*["']none["']/gi,
+        severity: 'critical',
+        detail: 'alg:none disables signature verification — anyone can forge a valid token.',
+        fix: 'Require a real signing algorithm (e.g. HS256/RS256) and reject "none".',
+        maskStrings: false,
+    },
+];
+export const configRisksChecker = {
+    id: 'config-risks',
+    title: 'Dangerous configuration',
+    level: 0,
+    run(ctx) {
+        const findings = [];
+        for (const file of ctx.files) {
+            // Config risks in prose docs are examples, not live config — skip them.
+            if (file.rel.endsWith('.md') || file.rel.endsWith('.txt'))
+                continue;
+            if (looksMinified(file.rel, file.content))
+                continue; // generated output, not source
+            // Comments never trigger a rule. Strings are a per-rule decision: a rule
+            // matching a literal value must still see it (see Rule.maskStrings).
+            const noComments = maskCode(file.content);
+            const noStrings = maskCode(file.content, { strings: true });
+            for (const rule of RULES) {
+                const scan = rule.maskStrings ? noStrings : noComments;
+                for (const m of scan.matchAll(rule.re)) {
+                    findings.push({
+                        id: rule.id,
+                        severity: rule.severity,
+                        title: rule.title,
+                        detail: rule.detail,
+                        fix: rule.fix,
+                        checker: 'config-risks',
+                        level: 0,
+                        file: file.rel,
+                        line: lineAt(file.content, m.index ?? 0),
+                    });
+                }
+            }
+        }
+        return findings;
+    },
+};

package/dist/engine/checkers/static/env-git.js ADDED Viewed

@@ -0,0 +1,70 @@
+import { execFileSync } from 'node:child_process';
+function gitOk(root, args) {
+    try {
+        execFileSync('git', ['-C', root, ...args], { stdio: 'ignore', timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensures .env files are actually kept out of Git, using Git's own semantics
+ * (check-ignore + ls-files) rather than a text heuristic. A tracked .env is the
+ * real leak; an un-ignored .env is a risk of becoming one.
+ */
+export const envGitChecker = {
+    id: 'env-git',
+    title: '.env exposure via git',
+    level: 0,
+    run(ctx) {
+        const envFiles = ctx.files.filter((f) => f.rel === '.env' || (/(^|\/)\.env(\.|$)/.test(f.rel) && !f.rel.endsWith('.example') && !f.rel.endsWith('.sample')));
+        if (envFiles.length === 0)
+            return [];
+        const findings = [];
+        // Ask git itself: a subdirectory of a repo (monorepo package) is still in git.
+        const isGit = gitOk(ctx.root, ['rev-parse', '--git-dir']);
+        if (!isGit) {
+            findings.push({
+                id: 'env_git_unverified',
+                severity: 'info',
+                title: 'Cannot verify .env is ignored (not a git repo)',
+                detail: `Found ${envFiles.map((f) => f.rel).join(', ')}, but this folder is not a git repository, so tracking cannot be checked here.`,
+                fix: 'Before pushing, ensure a .gitignore ignores .env files (e.g. `.env*`), and never commit real secrets.',
+                checker: 'env-git',
+                level: 0,
+            });
+            return findings;
+        }
+        for (const env of envFiles) {
+            const tracked = gitOk(ctx.root, ['ls-files', '--error-unmatch', '--', env.rel]);
+            if (tracked) {
+                findings.push({
+                    id: 'env_committed',
+                    severity: 'critical',
+                    title: `${env.rel} is committed to git`,
+                    detail: `${env.rel} is tracked by git — its secrets are in the repository (and its history), reachable by anyone with repo access.`,
+                    fix: `Untrack it: git rm --cached ${env.rel}; add it to .gitignore; and ROTATE every secret it contained (a committed secret is already burned; deleting it does not un-leak history).`,
+                    checker: 'env-git',
+                    level: 0,
+                    file: env.rel,
+                });
+                continue;
+            }
+            const ignored = gitOk(ctx.root, ['check-ignore', '-q', '--', env.rel]);
+            if (!ignored) {
+                findings.push({
+                    id: 'env_not_ignored',
+                    severity: 'warning',
+                    title: `${env.rel} is not gitignored`,
+                    detail: `${env.rel} is not tracked yet, but no .gitignore rule matches it, so it can be committed by accident.`,
+                    fix: 'Add a matching rule to .gitignore (e.g. `.env*`) so it can never be committed.',
+                    checker: 'env-git',
+                    level: 0,
+                    file: env.rel,
+                });
+            }
+        }
+        return findings;
+    },
+};