fad-checker 1.0.0

package/lib/osv.js

@@ -0,0 +1,298 @@
+/**
+ * lib/osv.js — query OSV.dev for Maven-ecosystem vulnerabilities.
+ *
+ * OSV.dev (Google + GitHub Security Lab) aggregates CVE + GHSA data and
+ * maintains a curated Maven-coordinate mapping. For Maven recall this is
+ * vastly better than the raw CVEProject feed (which lacks packageName
+ * fields on pre-2024 CVEs).
+ *
+ * API: https://google.github.io/osv.dev/post-v1-querybatch/
+ *   POST /v1/querybatch  with up to 1000 queries
+ *   POST /v1/query       for a single dep
+ *   GET  /v1/vulns/{id}  to fetch full details
+ *
+ * Cached responses live in ~/.fad-check/osv-cache/ for 12h.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const OSV_CACHE_DIR = path.join(os.homedir(), ".fad-check", "osv-cache");
+const OSV_CACHE_TTL_MS = 12 * 3600 * 1000;
+const OSV_BASE = "https://api.osv.dev";
+const BATCH_SIZE = 800;          // OSV limit is 1000; stay under for safety
+
+function cacheKey(g, a, v, ecosystem = "maven") {
+	const safeG = (g || "").replace(/[/\\]/g, "_");
+	const safeA = (a || "").replace(/[/\\@]/g, "_");
+	return `${ecosystem}__${safeG}__${safeA}__${v}.json`;
+}
+
+function readCache(name) {
+	const p = path.join(OSV_CACHE_DIR, name);
+	if (!fs.existsSync(p)) return null;
+	try {
+		const data = JSON.parse(fs.readFileSync(p, "utf8"));
+		if (Date.now() - data._fetchedAt < OSV_CACHE_TTL_MS) return data.body;
+	} catch { /* ignore */ }
+	return null;
+}
+
+function writeCache(name, body) {
+	fs.mkdirSync(OSV_CACHE_DIR, { recursive: true });
+	fs.writeFileSync(path.join(OSV_CACHE_DIR, name), JSON.stringify({ _fetchedAt: Date.now(), body }));
+}
+
+const SEVERITY_ALIASES = { MODERATE: "MEDIUM", IMPORTANT: "HIGH", SEVERE: "HIGH", INFO: "LOW" };
+
+function normalizeSeverity(s) {
+	const up = String(s || "").toUpperCase();
+	return SEVERITY_ALIASES[up] || up;
+}
+
+/** Map an OSV severity score string ("9.8", "CVSS:3.1/AV:N/.../I:H/A:H") to a level. */
+function severityFromOsv(vuln) {
+	// Severity may live in `severity[]` (CVSS vector strings) or
+	// `database_specific.severity` (GHSA-style: "CRITICAL", "HIGH", "MODERATE"...).
+	const direct = vuln.database_specific?.severity;
+	if (direct) return { severity: normalizeSeverity(direct), score: scoreFromVuln(vuln) };
+	const sev = vuln.severity?.[0]?.score || "";
+	const numeric = parseFloat(sev.match(/(\d+(\.\d+)?)/)?.[1]);
+	if (Number.isFinite(numeric)) {
+		if (numeric >= 9) return { severity: "CRITICAL", score: numeric };
+		if (numeric >= 7) return { severity: "HIGH", score: numeric };
+		if (numeric >= 4) return { severity: "MEDIUM", score: numeric };
+		if (numeric > 0) return { severity: "LOW", score: numeric };
+	}
+	return { severity: "UNKNOWN", score: null };
+}
+
+function scoreFromVuln(vuln) {
+	for (const s of vuln.severity || []) {
+		const m = String(s.score || "").match(/(\d+(\.\d+)?)/);
+		if (m) return parseFloat(m[1]);
+	}
+	return null;
+}
+
+/** Extract the first fix version from OSV affected ranges (semver/ecosystem events). */
+function fixVersionFromOsv(vuln, depKey) {
+	for (const a of vuln.affected || []) {
+		const name = a.package?.name?.toLowerCase();
+		if (name && name !== depKey.toLowerCase()) continue;
+		for (const r of a.ranges || []) {
+			for (const ev of r.events || []) {
+				if (ev.fixed) return ev.fixed;
+			}
+		}
+	}
+	return null;
+}
+
+/** Pick the best CVE id from an OSV vuln (prefer CVE-* aliases over GHSA-*). */
+function pickPrimaryId(vuln) {
+	if (vuln.id?.startsWith("CVE-")) return vuln.id;
+	const cveAlias = (vuln.aliases || []).find(a => a.startsWith("CVE-"));
+	return cveAlias || vuln.id;
+}
+
+/** Build the OSV package-name key for a dep (Maven uses g:a, npm uses bare name). */
+function osvPkgName(dep) {
+	return dep.ecosystem === "npm" ? dep.artifactId : `${dep.groupId}:${dep.artifactId}`;
+}
+
+/** Convert one OSV vuln to fad-check match shape. */
+function vulnToMatch(dep, vuln) {
+	const id = pickPrimaryId(vuln);
+	const { severity, score } = severityFromOsv(vuln);
+	// `details` (long markdown) is the substantive description; `summary` is just the title.
+	// We keep them both: summary as headline, details as body.
+	const summary = (vuln.summary || "").trim();
+	const details = (vuln.details || "").trim();
+	let description = "";
+	if (summary && details && !details.toLowerCase().startsWith(summary.toLowerCase())) {
+		description = `${summary}\n\n${details}`;
+	} else if (details) {
+		description = details;
+	} else {
+		description = summary;
+	}
+	// Keep up to 2000 chars — enough for full advisory text without bloating the report.
+	if (description.length > 2000) description = description.slice(0, 2000) + "…";
+	// Categorise OSV references: ADVISORY / FIX / REPORT / WEB / PACKAGE / ARTICLE / EVIDENCE
+	const refs = (vuln.references || []).map(r => ({ type: String(r.type || "WEB").toUpperCase(), url: r.url }));
+	return {
+		dep,
+		cve: {
+			id,
+			severity,
+			score,
+			description,
+			summary,
+			fixVersion: fixVersionFromOsv(vuln, osvPkgName(dep)),
+			ghsa: (vuln.aliases || []).find(a => a.startsWith("GHSA-")) || (vuln.id?.startsWith("GHSA-") ? vuln.id : null),
+			published: vuln.published || null,
+			modified: vuln.modified || null,
+			osvRefs: refs,
+			aliases: vuln.aliases || [],
+		},
+		source: "osv",
+		confidence: "exact",
+	};
+}
+
+async function queryBatch(deps, opts = {}) {
+	const { verbose, offline, fetcher = globalThis.fetch } = opts;
+	// Build query list + parallel cached/uncached split
+	const queries = [];
+	const indexMap = []; // index in `deps` → either { cached: vulns } or { queryIdx: N }
+
+	for (let i = 0; i < deps.length; i++) {
+		const d = deps[i];
+		const ck = cacheKey(d.groupId, d.artifactId, d.version, d.ecosystem || "maven");
+		const hit = readCache(ck);
+		if (hit !== null) {
+			indexMap[i] = { cached: hit };
+		} else {
+			indexMap[i] = { queryIdx: queries.length, cacheKey: ck };
+			// Ecosystem-aware query: OSV uses "npm" for npm packages (name only,
+			// no groupId), "Maven" for Maven (name = "g:a"). The dep record's
+			// `ecosystem` field defaults to "maven" — npm collector sets "npm".
+			const ecosystem = d.ecosystem === "npm" ? "npm" : "Maven";
+			const pkgName = ecosystem === "npm" ? d.artifactId : `${d.groupId}:${d.artifactId}`;
+			queries.push({
+				package: { name: pkgName, ecosystem },
+				version: d.version,
+			});
+		}
+	}
+
+	// Run batch queries for uncached deps (if any). In offline mode we skip
+	// the network and rely entirely on cached per-dep ID lists.
+	const allResults = new Array(queries.length);
+	if (queries.length && !offline) {
+		const batches = [];
+		for (let i = 0; i < queries.length; i += BATCH_SIZE) {
+			batches.push(queries.slice(i, i + BATCH_SIZE));
+		}
+		let batchIdx = 0;
+		for (const batch of batches) {
+			if (verbose) process.stdout.write(`\r   OSV batch ${++batchIdx}/${batches.length} (${batch.length} deps)…`);
+			const res = await fetcher(`${OSV_BASE}/v1/querybatch`, {
+				method: "POST",
+				headers: { "Content-Type": "application/json", "User-Agent": "fad-check-osv" },
+				body: JSON.stringify({ queries: batch }),
+			});
+			if (!res.ok) {
+				if (verbose) console.warn(`\n   OSV HTTP ${res.status}`);
+				for (let j = 0; j < batch.length; j++) allResults[(batchIdx - 1) * BATCH_SIZE + j] = { vulns: [] };
+				continue;
+			}
+			const data = await res.json();
+			const results = data.results || [];
+			for (let j = 0; j < batch.length; j++) {
+				allResults[(batchIdx - 1) * BATCH_SIZE + j] = results[j] || { vulns: [] };
+			}
+		}
+		if (verbose) process.stdout.write(`\r   OSV batches complete (${batches.length})                \n`);
+
+		// Persist per-dep cache (stub list — details cached separately)
+		for (let i = 0; i < deps.length; i++) {
+			const slot = indexMap[i];
+			if (slot.queryIdx != null) {
+				const queryGlobalIdx = slot.queryIdx;
+				const result = allResults[queryGlobalIdx] || { vulns: [] };
+				const ids = (result.vulns || []).map(v => v.id);
+				writeCache(slot.cacheKey, ids);
+				slot.cached = ids;
+			}
+		}
+	}
+
+	// Collect every unique vuln id we need to enrich — whether it came from
+	// the cached per-dep list or from a fresh batch result.
+	const allIds = new Set();
+	for (const slot of indexMap) for (const id of (slot.cached || [])) allIds.add(id);
+
+	const detailById = new Map();
+	let fetched = 0;
+	for (const id of allIds) {
+		const detailCacheKey = `vuln_${id}.json`;
+		const hit = readCache(detailCacheKey);
+		if (hit) { detailById.set(id, hit); continue; }
+		if (offline) continue;
+		try {
+			const r = await fetcher(`${OSV_BASE}/v1/vulns/${encodeURIComponent(id)}`, {
+				headers: { "User-Agent": "fad-check-osv" },
+			});
+			if (r.ok) {
+				const body = await r.json();
+				detailById.set(id, body);
+				writeCache(detailCacheKey, body);
+			}
+		} catch { /* ignore individual failures */ }
+		fetched++;
+		if (verbose && fetched % 25 === 0) process.stdout.write(`\r   OSV details fetched: ${fetched}/${allIds.size}`);
+	}
+	if (verbose) process.stdout.write(`\r   OSV details fetched: ${fetched}/${allIds.size}                \n`);
+
+	return runMatches(deps, indexMap, detailById);
+}
+
+function runMatches(deps, indexMap, detailById) {
+	const matches = [];
+	for (let i = 0; i < deps.length; i++) {
+		const slot = indexMap[i];
+		const ids = slot.cached || [];
+		const dep = deps[i];
+		for (const id of ids) {
+			const vuln = detailById instanceof Map ? detailById.get(id) : null;
+			if (!vuln) {
+				// Stub only — emit a minimal match with no description so the
+				// report still surfaces it.
+				matches.push({
+					dep,
+					cve: { id, severity: "UNKNOWN", score: null, description: "", fixVersion: null },
+					source: "osv",
+					confidence: "exact",
+				});
+				continue;
+			}
+			matches.push(vulnToMatch(dep, vuln));
+		}
+	}
+	return matches;
+}
+
+/**
+ * Public: query OSV for every dep in `resolvedDeps` Map, return fad-check-shape matches.
+ */
+async function queryOsvForDeps(resolvedDeps, opts = {}) {
+	const deps = [];
+	for (const d of resolvedDeps.values()) {
+		if (!d.version || /\$\{|SNAPSHOT/i.test(d.version)) continue;
+		if (d.scope === "parent") continue; // parents don't have OSV entries typically
+		// npm version specifiers like "^1.0.0" can't be queried against OSV — need
+		// a concrete version. Lockfiles always provide one; package.json-only deps
+		// are skipped here.
+		if (d.ecosystem === "npm" && /^[\^~>=<*]|^(latest|next|workspace:|git\+|file:|link:)/.test(d.version)) continue;
+		deps.push({
+			groupId: d.groupId, artifactId: d.artifactId, version: d.version,
+			scope: d.scope, via: d.via, depth: d.depth, pomPaths: d.pomPaths,
+			manifestPaths: d.manifestPaths,
+			ecosystem: d.ecosystem || "maven",
+			ecosystemType: d.ecosystemType,
+			isDev: !!d.isDev,
+		});
+	}
+	return queryBatch(deps, opts);
+}
+
+module.exports = {
+	queryOsvForDeps,
+	queryBatch,
+	vulnToMatch,
+	severityFromOsv,
+	fixVersionFromOsv,
+	OSV_CACHE_DIR,
+};

package/lib/outdated.js

@@ -0,0 +1,265 @@
+/**
+ * lib/outdated.js — EOL, obsolete, and outdated dependency checks.
+ *
+ * EOL data comes from endoflife.date (with on-disk cache).
+ * Obsolete data is curated locally (data/known-obsolete.json).
+ * Outdated comes from Maven Central's maven-metadata.xml.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { compareMavenVersions } = require("./maven-version");
+
+const KNOWN_OBSOLETE = require("../data/known-obsolete.json");
+const EOL_MAPPING = require("../data/eol-mapping.json");
+
+const CACHE_DIR = path.join(os.homedir(), ".fad-check");
+const EOL_CACHE_PATH = path.join(CACHE_DIR, "eol-cache.json");
+const VERSION_CACHE_PATH = path.join(CACHE_DIR, "version-cache.json");
+const EOL_CACHE_MAX_AGE_MS = 7 * 24 * 3600 * 1000; // 7 days
+const VERSION_CACHE_MAX_AGE_MS = 24 * 3600 * 1000; // 1 day
+
+function loadJsonCache(file) {
+	try { return JSON.parse(fs.readFileSync(file, "utf8")); }
+	catch { return { meta: { fetchedAt: 0 }, entries: {} }; }
+}
+
+function saveJsonCache(file, data) {
+	try {
+		fs.mkdirSync(CACHE_DIR, { recursive: true });
+		fs.writeFileSync(file, JSON.stringify(data));
+	} catch { /* ignore */ }
+}
+
+function isEolCacheFresh(maxAge = EOL_CACHE_MAX_AGE_MS) {
+	const c = loadJsonCache(EOL_CACHE_PATH);
+	return c.meta?.fetchedAt && (Date.now() - c.meta.fetchedAt) < maxAge;
+}
+
+// -------- EOL via endoflife.date --------
+
+function findEolProduct(dep) {
+	const key = `${dep.groupId}:${dep.artifactId}`;
+	const direct = EOL_MAPPING.by_group_artifact?.[key];
+	if (direct) return direct;
+	// Match longest groupId prefix
+	const prefixes = Object.keys(EOL_MAPPING.by_group_prefix || {})
+		.sort((a, b) => b.length - a.length);
+	for (const p of prefixes) {
+		if (dep.groupId === p || dep.groupId.startsWith(p + ".")) {
+			return EOL_MAPPING.by_group_prefix[p];
+		}
+	}
+	return null;
+}
+
+async function fetchEndoflife(product, cache, opts = {}) {
+	if (cache.entries[product]) return cache.entries[product];
+	if (opts.offline) return null;
+	try {
+		const res = await fetch(`https://endoflife.date/api/${encodeURIComponent(product)}.json`, {
+			headers: { "User-Agent": "fad-check-eol-checker" },
+		});
+		if (!res.ok) {
+			cache.entries[product] = { error: `HTTP ${res.status}` };
+			return cache.entries[product];
+		}
+		const cycles = await res.json();
+		cache.entries[product] = cycles;
+		return cycles;
+	} catch (err) {
+		cache.entries[product] = { error: err.message };
+		return cache.entries[product];
+	}
+}
+
+function findCycleForVersion(cycles, version) {
+	if (!Array.isArray(cycles) || !version) return null;
+	// Match by cycle prefix: e.g. version "2.7.18" → cycle "2.7"
+	for (const c of cycles) {
+		const cycle = String(c.cycle || "");
+		if (!cycle) continue;
+		if (version === cycle || version.startsWith(cycle + ".") || version.startsWith(cycle + "-")) {
+			return c;
+		}
+	}
+	return null;
+}
+
+function isEol(cycle) {
+	if (!cycle) return false;
+	if (cycle.eol === true) return true;
+	if (typeof cycle.eol === "string") {
+		const eolDate = new Date(cycle.eol);
+		if (!isNaN(eolDate.getTime())) return eolDate.getTime() < Date.now();
+	}
+	return false;
+}
+
+async function checkEolDeps(resolvedDeps, opts = {}) {
+	const { verbose, offline } = opts;
+	const cache = loadJsonCache(EOL_CACHE_PATH);
+	const fresh = isEolCacheFresh();
+	const results = [];
+	const seen = new Set();
+
+	for (const dep of resolvedDeps.values()) {
+		if (dep.ecosystem === "npm") continue; // EOL mapping is Maven-only for now
+		const product = findEolProduct(dep);
+		if (!product) continue;
+		const dedupeKey = `${dep.groupId}:${dep.artifactId}|${product.product}`;
+		if (seen.has(dedupeKey)) continue;
+		seen.add(dedupeKey);
+
+		const cycles = fresh && cache.entries[product.product]
+			? cache.entries[product.product]
+			: await fetchEndoflife(product.product, cache, { offline });
+
+		if (!Array.isArray(cycles)) continue;
+		const cycle = findCycleForVersion(cycles, dep.version);
+		if (!cycle) continue;
+		if (!isEol(cycle)) continue;
+
+		results.push({
+			dep,
+			product: product.label || product.product,
+			productSlug: product.product,
+			cycle: cycle.cycle,
+			eol: cycle.eol === true ? "true" : String(cycle.eol),
+			latest: cycle.latest || null,
+			notes: cycle.latestReleaseDate ? `Latest: ${cycle.latest} (${cycle.latestReleaseDate})` : "",
+		});
+		if (verbose) process.stdout.write(`  EOL: ${dep.groupId}:${dep.artifactId}:${dep.version} (${product.label})\n`);
+	}
+
+	cache.meta = { fetchedAt: Date.now() };
+	saveJsonCache(EOL_CACHE_PATH, cache);
+	return results;
+}
+
+// -------- Obsolete via curated list --------
+
+function checkObsoleteDeps(resolvedDeps) {
+	const results = [];
+	const seen = new Set();
+	for (const dep of resolvedDeps.values()) {
+		const key = `${dep.groupId}:${dep.artifactId}`;
+		if (seen.has(key)) continue;
+		const entry = KNOWN_OBSOLETE[key];
+		if (!entry) continue;
+		seen.add(key);
+		results.push({
+			dep,
+			severity: entry.severity || "MEDIUM",
+			replacement: entry.replacement || null,
+			reason: entry.reason || "",
+		});
+	}
+	return results;
+}
+
+function checkObsolete(dep) {
+	const entry = KNOWN_OBSOLETE[`${dep.groupId}:${dep.artifactId}`];
+	return entry ? { dep, ...entry } : null;
+}
+
+// -------- Outdated via Maven Central --------
+
+async function fetchLatestVersion(groupId, artifactId, cache, opts = {}) {
+	const key = `${groupId}:${artifactId}`;
+	if (cache.entries[key]) return cache.entries[key];
+	if (opts.offline) return null;
+	// Try Central's Solr first (fast), then fall back to maven-metadata.xml
+	// in every configured private repo. The private fallback is what catches
+	// internal Nexus/Artifactory artifacts that aren't on Central.
+	try {
+		const url = `https://search.maven.org/solrsearch/select?q=g:%22${encodeURIComponent(groupId)}%22+AND+a:%22${encodeURIComponent(artifactId)}%22&core=gav&rows=1&wt=json`;
+		const res = await fetch(url, { headers: { "User-Agent": "fad-check-outdated-checker" } });
+		if (res.ok) {
+			const json = await res.json();
+			const doc = json?.response?.docs?.[0];
+			if (doc) {
+				const entry = { latest: doc.v, releaseDate: doc.timestamp ? new Date(doc.timestamp).toISOString().slice(0, 10) : null, source: "central" };
+				cache.entries[key] = entry;
+				return entry;
+			}
+		}
+	} catch { /* fall through to repo metadata */ }
+
+	if (Array.isArray(opts.repos) && opts.repos.length) {
+		try {
+			const { fetchMavenMetadata } = require("./maven-repo");
+			const hit = await fetchMavenMetadata(opts.repos, groupId, artifactId, { userAgent: "fad-check-outdated-checker" });
+			if (hit?.body) {
+				const latest = parseMavenMetadataLatest(hit.body);
+				if (latest) {
+					const entry = { latest, releaseDate: null, source: hit.repo.name || hit.repo.url };
+					cache.entries[key] = entry;
+					return entry;
+				}
+			}
+		} catch { /* swallow */ }
+	}
+	cache.entries[key] = { error: "not found" };
+	return cache.entries[key];
+}
+
+/**
+ * Pull the "latest" version from a maven-metadata.xml body. Prefers
+ * <versioning><release> (stable), falls back to <versioning><latest> and
+ * then the highest entry in <versioning><versions>.
+ */
+function parseMavenMetadataLatest(xml) {
+	if (!xml) return null;
+	const release = xml.match(/<release>([^<]+)<\/release>/);
+	if (release?.[1]) return release[1].trim();
+	const latest = xml.match(/<latest>([^<]+)<\/latest>/);
+	if (latest?.[1]) return latest[1].trim();
+	const versions = [...xml.matchAll(/<version>([^<]+)<\/version>/g)].map(m => m[1].trim()).filter(Boolean);
+	if (versions.length) {
+		try { versions.sort((a, b) => compareMavenVersions(a, b)); return versions[versions.length - 1]; }
+		catch { return versions[versions.length - 1]; }
+	}
+	return null;
+}
+
+async function checkOutdatedDeps(resolvedDeps, opts = {}) {
+	const { verbose, offline, concurrency = 8, repos } = opts;
+	const cache = loadJsonCache(VERSION_CACHE_PATH);
+	const fresh = cache.meta?.fetchedAt && (Date.now() - cache.meta.fetchedAt) < VERSION_CACHE_MAX_AGE_MS;
+	if (!fresh && !offline) cache.entries = {};
+	const list = [...resolvedDeps.values()].filter(d => d.version && !/\$\{|SNAPSHOT/i.test(d.version) && d.ecosystem !== "npm");
+	const results = [];
+
+	// Simple p-limit style throttle without requiring p-limit here (already used in fad-check.js)
+	let cursor = 0;
+	const workers = Array.from({ length: concurrency }, async () => {
+		while (cursor < list.length) {
+			const dep = list[cursor++];
+			const entry = await fetchLatestVersion(dep.groupId, dep.artifactId, cache, { offline, repos });
+			if (!entry?.latest) continue;
+			try {
+				if (compareMavenVersions(dep.version, entry.latest) < 0) {
+					results.push({ dep, latest: entry.latest, releaseDate: entry.releaseDate || null });
+					if (verbose) process.stdout.write(`  outdated: ${dep.groupId}:${dep.artifactId} ${dep.version} → ${entry.latest}\n`);
+				}
+			} catch { /* ignore comparison failure */ }
+		}
+	});
+	await Promise.all(workers);
+
+	cache.meta = { fetchedAt: Date.now() };
+	saveJsonCache(VERSION_CACHE_PATH, cache);
+	results.sort((a, b) => `${a.dep.groupId}:${a.dep.artifactId}`.localeCompare(`${b.dep.groupId}:${b.dep.artifactId}`));
+	return results;
+}
+
+module.exports = {
+	checkEolDeps,
+	checkObsoleteDeps,
+	checkObsolete,
+	checkOutdatedDeps,
+	findEolProduct,
+	isEolCacheFresh,
+	KNOWN_OBSOLETE,
+};