fad-checker 1.0.0

package/lib/retire.js

@@ -0,0 +1,211 @@
+/**
+ * lib/retire.js — wrap retire.js (the CLI) to find vulnerable
+ * vendored JavaScript libraries living in the source tree as
+ * unmanaged .js / .min.js files (no package-lock to back them).
+ *
+ * retire ships its own signature DB updated weekly; we just shell
+ * out to it and normalise the output to fad-check match shape so the
+ * report can render it like any other CVE source.
+ *
+ * Cache: ~/.fad-check/retire-cache/<md5(src)>.json, 24 h TTL.
+ *
+ * The CLI is expected at node_modules/.bin/retire (declared in
+ * package.json deps). When bundled with bun, we also try `retire`
+ * on PATH as a fallback.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const crypto = require("crypto");
+const { execFile } = require("child_process");
+const { promisify } = require("util");
+const execFileP = promisify(execFile);
+
+const RETIRE_CACHE_DIR = path.join(os.homedir(), ".fad-check", "retire-cache");
+const RETIRE_CACHE_TTL_MS = 24 * 3600 * 1000;
+
+function cacheKey(srcDir) {
+	return crypto.createHash("md5").update(path.resolve(srcDir)).digest("hex") + ".json";
+}
+
+function readCache(srcDir) {
+	const p = path.join(RETIRE_CACHE_DIR, cacheKey(srcDir));
+	if (!fs.existsSync(p)) return null;
+	try {
+		const data = JSON.parse(fs.readFileSync(p, "utf8"));
+		if (Date.now() - data._fetchedAt < RETIRE_CACHE_TTL_MS) return data.body;
+	} catch { /* ignore */ }
+	return null;
+}
+
+function writeCache(srcDir, body) {
+	fs.mkdirSync(RETIRE_CACHE_DIR, { recursive: true });
+	fs.writeFileSync(path.join(RETIRE_CACHE_DIR, cacheKey(srcDir)),
+		JSON.stringify({ _fetchedAt: Date.now(), body }));
+}
+
+function findRetireBin() {
+	const local = path.join(__dirname, "..", "node_modules", ".bin", "retire");
+	if (fs.existsSync(local)) return local;
+	return "retire"; // fall back to PATH
+}
+
+/**
+ * Run retire.js against `srcDir`. Returns the parsed JSON output (an array
+ * of file-level findings) or null if retire is unavailable.
+ *
+ * `--outputformat json` is the structured form; `--ignore` takes a list of
+ * dirs to skip; we add the standard suspects to keep runtime bounded.
+ */
+async function runRetire(srcDir, opts = {}) {
+	const { verbose, force, offline } = opts;
+	if (offline) {
+		const cached = readCache(srcDir);
+		if (cached) return cached;
+		if (verbose) console.warn("retire: --offline and no cache — skipped");
+		return null;
+	}
+	if (!force) {
+		const cached = readCache(srcDir);
+		if (cached) {
+			if (verbose) console.log("retire: using cached results (<24h)");
+			return cached;
+		}
+	}
+
+	const bin = findRetireBin();
+	const ignoredDirs = [
+		"node_modules", "bower_components", "jspm_packages",
+		".git", ".idea", ".vscode", ".gradle", ".mvn",
+		"target", "dist", "build", "build-output", "out", "coverage", ".next", ".nuxt",
+	].join(",");
+
+	// retire.js refuses to write to /dev/stdout, so we use a real temp file
+	// and read it back. Falls back to stdout if --outputpath is rejected.
+	const tmpOut = path.join(os.tmpdir(), `fad-check-retire-${process.pid}-${Date.now()}.json`);
+	const args = [
+		"--outputformat", "json",
+		"--outputpath", tmpOut,
+		"--jspath", srcDir,
+		"--ignore", ignoredDirs,
+	];
+	if (verbose) console.log(`retire: scanning ${srcDir}…`);
+
+	try {
+		// retire.js exits with code 13 when it finds vulnerabilities — that's
+		// expected. Catch and ignore the non-zero exit; the JSON file is still
+		// produced.
+		await execFileP(bin, args, { maxBuffer: 1024 * 1024 * 64 });
+	} catch (err) {
+		// exit code 13 (or anything where the output file exists) is OK
+		if (!fs.existsSync(tmpOut)) {
+			if (verbose) console.warn(`retire: failed to run — ${err.message}`);
+			return null;
+		}
+	}
+
+	let parsed;
+	try {
+		const body = fs.readFileSync(tmpOut, "utf8");
+		parsed = JSON.parse(body);
+	} catch (err) {
+		if (verbose) console.warn(`retire: could not parse output — ${err.message}`);
+		return null;
+	} finally {
+		try { fs.unlinkSync(tmpOut); } catch { /* best effort */ }
+	}
+	writeCache(srcDir, parsed);
+	return parsed;
+}
+
+/**
+ * Normalise a retire.js result tree to fad-check match shape.
+ *
+ * retire output (jsonsimple-ish):
+ *   {
+ *     data: [
+ *       {
+ *         file: "/abs/path/jquery-1.4.4.min.js",
+ *         results: [
+ *           {
+ *             component: "jquery",
+ *             version:   "1.4.4",
+ *             vulnerabilities: [
+ *               {
+ *                 severity: "high",
+ *                 identifiers: { CVE: ["CVE-…"], summary: "…", issue?: "…" },
+ *                 info:      ["https://…"],
+ *                 below?:    "1.6.3",
+ *                 atOrAbove?: "1.4.0",
+ *               },
+ *             ],
+ *           },
+ *         ],
+ *       },
+ *     ],
+ *   }
+ */
+function normaliseRetireResults(raw, srcDir) {
+	const out = [];
+	if (!raw) return out;
+	const files = Array.isArray(raw) ? raw : (raw.data || []);
+	for (const f of files) {
+		const file = f.file;
+		const relFile = srcDir && file?.startsWith(srcDir) ? path.relative(srcDir, file) : file;
+		for (const res of f.results || []) {
+			const component = res.component;
+			const version = res.version;
+			for (const v of res.vulnerabilities || []) {
+				const ids = v.identifiers || {};
+				const cveIds = Array.isArray(ids.CVE) && ids.CVE.length ? ids.CVE : [ids.issue || ids.summary || `RETIRE-${component}-${version}`];
+				const severity = (v.severity || "medium").toUpperCase();
+				const description = ids.summary || v.info?.[0] || "";
+				const refs = (v.info || []).map(u => ({ type: "WEB", url: u }));
+				for (const cveId of cveIds) {
+					out.push({
+						dep: {
+							groupId: "",
+							artifactId: component,
+							version,
+							scope: "vendored",
+							ecosystem: "npm",
+							ecosystemType: "retire",
+							pomPaths: file ? [file] : [],
+							manifestPaths: file ? [file] : [],
+							vendoredFile: relFile,
+						},
+						cve: {
+							id: cveId,
+							severity,
+							score: null,
+							description,
+							fixVersion: v.below || null,
+							osvRefs: refs,
+						},
+						source: "retire",
+						confidence: "exact",
+					});
+				}
+			}
+		}
+	}
+	return out;
+}
+
+/**
+ * Public entry point. Returns an array of match objects or [] if retire
+ * couldn't run or found nothing.
+ */
+async function scanWithRetire(srcDir, opts = {}) {
+	const raw = await runRetire(srcDir, opts);
+	if (!raw) return [];
+	return normaliseRetireResults(raw, srcDir);
+}
+
+module.exports = {
+	scanWithRetire,
+	runRetire,
+	normaliseRetireResults,
+	findRetireBin,
+	RETIRE_CACHE_DIR,
+};

package/lib/scan-completeness.js

@@ -0,0 +1,67 @@
+/**
+ * lib/scan-completeness.js — produce warnings telling the user when fad-check
+ * has gone as far as it can without running the real build tool.
+ *
+ * The two big "you need a real scan" cases:
+ *   1. BOMs (Maven `<scope>import</scope>`): version pins live in another
+ *      POM that may itself be transitive. We follow LOCAL BOMs in core.js,
+ *      but external BOMs (Spring Boot, Quarkus, JBoss…) bring in a managed
+ *      version table that we can't enumerate without resolving them. The
+ *      resolved deps map will still list deps with unresolved `${prop}` or
+ *      missing versions in this case.
+ *   2. Unresolved versions: any dep whose `version` is null or still
+ *      contains a `${…}` placeholder — we can't query OSV/Maven Central
+ *      for these, so they silently fall out of the scan.
+ *
+ * For npm/yarn, lockfiles already pin everything, so we only flag the
+ * already-handled "no lockfile" case from lib/npm/collect.js elsewhere.
+ *
+ * Output: an array of warning objects matching the same shape as
+ * lib/npm/collect.js warnings ({ type, manifestPath?, message, ... }).
+ */
+/**
+ * Scan the resolved deps map and return warnings.
+ *
+ * opts:
+ *   ranSnyk   — true if --snyk was run (suppresses the "run snyk" hint)
+ *   ranTransitive — true if --transitive was on (changes wording slightly)
+ */
+function detectScanCompletenessWarnings(resolvedDeps, opts = {}) {
+	const warnings = [];
+	if (!resolvedDeps || typeof resolvedDeps.values !== "function") return warnings;
+
+	// Deps without a concrete version are the actionable signal — these
+	// silently fall out of the CVE / OSV / outdated scans. Their root cause
+	// is almost always an external BOM (spring-boot-dependencies, …) or a
+	// property defined outside the source tree. We report the deps, not the
+	// BOMs themselves: a present-and-correct BOM is not a problem.
+	const unresolved = [];
+	for (const d of resolvedDeps.values()) {
+		if (d.ecosystem === "npm") continue; // lockfile already pins everything
+		if (d.scope === "import") continue;  // BOM-pointer entries themselves: not a dep
+		if (!d.version) unresolved.push({ ...d, reason: "no-version" });
+		else if (/\$\{[^}]+\}/.test(String(d.version))) unresolved.push({ ...d, reason: "unresolved-property" });
+	}
+
+	if (unresolved.length) {
+		// Dedupe by g:a (same coord may appear in several modules)
+		const seenKeys = new Set();
+		const items = [];
+		for (const d of unresolved) {
+			const k = `${d.groupId}:${d.artifactId}`;
+			if (seenKeys.has(k)) continue;
+			seenKeys.add(k);
+			items.push(`${k}${d.version ? " (" + d.version + ")" : " (no version resolved)"}`);
+		}
+		warnings.push({
+			type: "unresolved-versions",
+			count: items.length,
+			items,
+			message: `${items.length} Maven dep(s) without a concrete version — silently skipped from CVE/OSV/outdated scans. Their versions are likely pinned by an external BOM or a property defined outside the source tree. Run "mvn dependency:tree" against the source (or "snyk test --all-projects" against the cleaned POMs${opts.ranSnyk ? " — already done with --snyk" : ", or re-run fad-check with --snyk"}) to resolve them and complete the scan.`,
+		});
+	}
+
+	return warnings;
+}
+
+module.exports = { detectScanCompletenessWarnings };

package/lib/snyk.js

@@ -0,0 +1,127 @@
+/**
+ * lib/snyk.js — optional Snyk integration.
+ *
+ * Runs `snyk test --all-projects --json` on the cleaned POM directory and
+ * normalises the output to fad-check's CVE match shape so the report can
+ * merge findings from both engines.
+ */
+const { execFile } = require("child_process");
+const { promisify } = require("util");
+const execFileP = promisify(execFile);
+
+/**
+ * Run `snyk test --all-projects --json` in outputDir.
+ * Snyk exits with code 1 when vulnerabilities are found — that's not an
+ * error for us, so we accept exit codes 0 and 1.
+ */
+async function runSnykTest(outputDir, opts = {}) {
+	const { verbose, timeoutMs = 10 * 60 * 1000 } = opts;
+	if (!outputDir) throw new Error("runSnykTest: outputDir required");
+	try {
+		const { stdout } = await execFileP("snyk", ["test", "--all-projects", "--json"], {
+			cwd: outputDir,
+			maxBuffer: 256 * 1024 * 1024,
+			timeout: timeoutMs,
+		});
+		return parseSnykStdout(stdout);
+	} catch (err) {
+		// snyk exits 1 when vulns are found — stdout still contains the JSON
+		if (err.stdout) return parseSnykStdout(err.stdout);
+		if (err.code === "ENOENT") throw new Error("snyk CLI not found on PATH — install snyk separately");
+		throw err;
+	}
+}
+
+function parseSnykStdout(stdout) {
+	if (!stdout) return [];
+	const str = String(stdout).trim();
+	if (!str) return [];
+	// --all-projects can produce either a JSON array of project results
+	// or a single object. Normalise to array.
+	try {
+		const parsed = JSON.parse(str);
+		return Array.isArray(parsed) ? parsed : [parsed];
+	} catch (_) {
+		// Some snyk versions emit one JSON object per line.
+		const lines = str.split(/\n+/).filter(Boolean);
+		const out = [];
+		for (const l of lines) {
+			try { out.push(JSON.parse(l)); } catch { /* skip */ }
+		}
+		return out;
+	}
+}
+
+/**
+ * Normalise snyk JSON to fad-check match objects:
+ *   [{ dep: {groupId, artifactId, version}, cve: {id, severity, score, ...}, source: 'snyk' }]
+ */
+function parseSnykResults(snykProjectsJson) {
+	const out = [];
+	const projects = Array.isArray(snykProjectsJson) ? snykProjectsJson : [snykProjectsJson];
+	for (const proj of projects) {
+		const vulns = proj?.vulnerabilities || [];
+		for (const v of vulns) {
+			const pkg = v.packageName || v.moduleName || "";
+			const [groupId, artifactId] = pkg.includes(":") ? pkg.split(":") : [null, pkg];
+			const cveIds = v.identifiers?.CVE || [];
+			const cveId = cveIds[0] || v.id;
+			const fixVersions = Array.isArray(v.fixedIn) ? v.fixedIn : [];
+			out.push({
+				dep: {
+					groupId: groupId || "",
+					artifactId: artifactId || "",
+					version: v.version || "",
+					scope: "compile",
+					pomPaths: [],
+				},
+				cve: {
+					id: cveId,
+					severity: (v.severity || "UNKNOWN").toUpperCase(),
+					score: typeof v.cvssScore === "number" ? v.cvssScore : null,
+					description: v.title || v.description || "",
+					fixVersion: fixVersions[0] || null,
+				},
+				source: "snyk",
+				confidence: "exact",
+			});
+		}
+	}
+	return out;
+}
+
+/**
+ * Merge fad-check and Snyk matches, deduping by (groupId:artifactId, cve.id).
+ * When a finding exists in both, fad-check's row is kept but tagged source='both'.
+ */
+function mergeWithFadResults(fadMatches, snykMatches) {
+	const byKey = new Map();
+	const k = m => `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+	for (const m of fadMatches || []) byKey.set(k(m), { ...m, source: "fad" });
+	for (const s of snykMatches || []) {
+		const key = k(s);
+		if (byKey.has(key)) {
+			const existing = byKey.get(key);
+			byKey.set(key, { ...existing, source: "both" });
+		} else {
+			byKey.set(key, s);
+		}
+	}
+	const merged = [...byKey.values()];
+	// Re-sort by severity (Snyk additions throw off ordering)
+	const rank = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+	merged.sort((a, b) => {
+		const sa = rank[(a.cve.severity || "UNKNOWN").toUpperCase()] || 0;
+		const sb = rank[(b.cve.severity || "UNKNOWN").toUpperCase()] || 0;
+		if (sb !== sa) return sb - sa;
+		return (a.cve.id || "").localeCompare(b.cve.id || "");
+	});
+	return merged;
+}
+
+module.exports = {
+	runSnykTest,
+	parseSnykResults,
+	parseSnykStdout,
+	mergeWithFadResults,
+};