fad-checker 1.0.0 → 1.0.2

package/test/cpe.test.js

@@ -51,6 +51,24 @@ test("matchVersionRange honours hard-pinned criteria version", () => {
 	assert.equal(matchVersionRange("2.14.1", m), false);
 });
 
+test("matchVersionRange folds CPE update qualifier into the version pin (H5)", () => {
+	// CPE 2.3 ":1.0.0:rc1:" describes the 1.0.0-rc1 pre-release. A release dep
+	// at 1.0.0 must NOT match — that was the H5 cascade.
+	const beta = { criteria: "cpe:2.3:a:apache:foo:1.0.0:beta1:*:*:*:*:*:*", vulnerable: true };
+	assert.equal(matchVersionRange("1.0.0", beta), false);
+	assert.equal(matchVersionRange("1.0.0-beta1", beta), true);
+
+	const rc = { criteria: "cpe:2.3:a:apache:foo:1.0.0:rc1:*:*:*:*:*:*", vulnerable: true };
+	assert.equal(matchVersionRange("1.0.0", rc), false);
+	assert.equal(matchVersionRange("1.0.0-rc1", rc), true);
+});
+
+test("cpeMatchesDep rejects short-token vendor leak (M4 mirror of H2)", () => {
+	const cpe = parseCpe23("cpe:2.3:a:a:log4j-core:*:*:*:*:*:*:*:*");
+	const dep = { groupId: "com.unrelated.log4j-core", artifactId: "log4j-core", ecosystem: "maven" };
+	assert.equal(cpeMatchesDep(cpe, dep), false);
+});
+
 test("matchVersionRange returns true for unknown dep version (conservative)", () => {
 	const m = { criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", vulnerable: true, versionEndExcluding: "2.15.0" };
 	assert.equal(matchVersionRange(null, m), true);

package/test/cve-match.test.js

@@ -48,6 +48,62 @@ test("vendorMatchesGroup heuristic", () => {
 	assert.equal(vendorMatchesGroup("springframework", "org.springframework"), true);
 });
 
+test("vendorMatchesGroup rejects substring leaks (H2)", () => {
+	// All these cases used to leak through unbounded `g.includes(v)` / `v.includes(g)`
+	// branches. The fix keeps only equality + dot-segment membership.
+	assert.equal(vendorMatchesGroup("a", "com.acme.client"), false);
+	assert.equal(vendorMatchesGroup("ibm", "com.ibmcloudant.driver"), false);
+	assert.equal(vendorMatchesGroup("go", "org.golang.x"), false);
+	// "open" used to wrongly match every org.opensaml.* groupId via substring
+	assert.equal(vendorMatchesGroup("open", "org.opensaml.core"), false);
+	// Dot-segment match still works for legitimate cases
+	assert.equal(vendorMatchesGroup("apache", "org.apache.commons"), true);
+	assert.equal(vendorMatchesGroup("springframework", "org.springframework.boot"), true);
+});
+
+test("matchDepsAgainstCves hides 'possible' tier by default (H3)", () => {
+	// product matches `log4j-core` but vendor `acme` doesn't match groupId.
+	// Without opts.includePossibleTier we expect zero matches.
+	const idx = {
+		byPackageName: {},
+		byProduct: {
+			"log4j-core": [
+				{ id: "CVE-FAKE-0001", severity: "HIGH", vendor: "acme", product: "log4j-core",
+				  ranges: [{ version: "2.0", lessThan: "2.20.0", status: "affected" }] },
+			],
+		},
+	};
+	const deps = new Map([
+		["org.apache.logging.log4j:log4j-core", {
+			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile", pomPaths: [],
+		}],
+	]);
+	assert.equal(matchDepsAgainstCves(deps, idx).length, 0);
+	assert.equal(matchDepsAgainstCves(deps, idx, { includePossibleTier: true }).length, 1);
+});
+
+test("matchDepsAgainstCves does not flag deps when range has no bounds (H1+H3)", () => {
+	// Sparse range entry (`{status:"affected"}` with no bounds) used to flag
+	// every version that hit the product bucket. Combined with H3 hiding the
+	// possible tier, this should now produce zero matches even when the
+	// vendor matches.
+	const idx = {
+		byPackageName: {},
+		byProduct: {
+			"log4j-core": [
+				{ id: "CVE-FAKE-0002", severity: "HIGH", vendor: "apache", product: "log4j-core",
+				  ranges: [{ status: "affected" }] },
+			],
+		},
+	};
+	const deps = new Map([
+		["org.apache.logging.log4j:log4j-core", {
+			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.99.0", scope: "compile", pomPaths: [],
+		}],
+	]);
+	assert.equal(matchDepsAgainstCves(deps, idx).length, 0);
+});
+
 test("collectResolvedDeps dedupes by g:a and includes external parent POMs", async () => {
 	const { store, props } = await pipeline(COMPLEX);
 	const deps = collectResolvedDeps(store, props, {});

package/test/cve-report.test.js

@@ -61,7 +61,7 @@ test("generateWordReport contains Word XML namespaces", () => {
 });
 
 test("writeReports writes both files to disk", async () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-rep-"));
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-rep-"));
 	const r = await writeReports({
 		cveMatches: sampleMatches,
 		eolResults: [{ dep: { groupId: "org.hibernate", artifactId: "hibernate-core", version: "5.6" }, product: "Hibernate ORM", eol: "2025-08-08" }],

package/test/maven-version.test.js

@@ -41,6 +41,15 @@ test("isVersionAffected returns false when status != affected", () => {
 	assert.equal(isVersionAffected("1.5", spec), false);
 });
 
+test("isVersionAffected fail-closed when spec has no version bounds (H1)", () => {
+	// CVEProject sometimes emits {status:"affected"} stubs with no version
+	// fields. The matcher must NOT fall through to `return true` — that was
+	// the H1 cascade.
+	assert.equal(isVersionAffected("2.14.0", { status: "affected" }), false);
+	assert.equal(isVersionAffected("2.14.0", {}), false);
+	assert.equal(isVersionAffected("0.0.1", { status: "affected" }), false);
+});
+
 test("parseRange handles Maven range syntax", () => {
 	assert.deepEqual(parseRange("1.2.3"), { exact: "1.2.3" });
 	assert.deepEqual(parseRange("[1.0,2.0)"), { lower: "1.0", lowerInclusive: true, upper: "2.0", upperInclusive: false });

package/test/monorepo.test.js

@@ -4,7 +4,7 @@
  *   - 1 npm package (package-lock v3) with prod/dev/peer deps
  *   - 1 yarn-v1 package with prod/dev deps + a private @acme/* dep
  *
- * Drives the same code paths as `fad-check --report` minus the network calls.
+ * Drives the same code paths as `fad-checker --report` minus the network calls.
  */
 const { test } = require("node:test");
 const assert = require("node:assert/strict");

package/test/snyk.test.js

@@ -35,7 +35,7 @@ test("parseSnykStdout accepts a JSON object or array", () => {
 	assert.equal(obj.length, 1);
 });
 
-test("parseSnykResults normalises to fad-check match shape", () => {
+test("parseSnykResults normalises to fad-checker match shape", () => {
 	const out = parseSnykResults(snykSample);
 	assert.equal(out.length, 2);
 	assert.equal(out[0].dep.groupId, "org.apache.logging.log4j");

package/test/transitive.test.js

@@ -5,9 +5,9 @@ const os = require("os");
 const path = require("path");
 const { parsePomXml, resolveProps, buildMgmt, SCOPE_MATRIX, resolveTransitiveDeps } = require("../lib/transitive");
 
-// Per-test cache dir so we don't poison ~/.fad-check/poms-cache during tests
+// Per-test cache dir so we don't poison ~/.fad-checker/poms-cache during tests
 function freshCache() {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fad-check-pom-cache-"));
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-pom-cache-"));
 	return dir;
 }