fad-checker 1.0.0

package/test/fixtures/cve-samples/cve-product-only.json

@@ -0,0 +1,31 @@
+{
+  "cveMetadata": {
+    "cveId": "CVE-2017-5638",
+    "datePublished": "2017-03-10T00:00:00Z"
+  },
+  "containers": {
+    "cna": {
+      "descriptions": [
+        { "lang": "en", "value": "Apache Struts 2 Jakarta Multipart parser arbitrary OS command execution." }
+      ],
+      "metrics": [
+        {
+          "cvssV3_1": {
+            "baseScore": 9.8,
+            "baseSeverity": "CRITICAL"
+          }
+        }
+      ],
+      "affected": [
+        {
+          "vendor": "apache",
+          "product": "struts2-core",
+          "versions": [
+            { "version": "2.3.5", "status": "affected", "lessThan": "2.3.32", "versionType": "maven" },
+            { "version": "2.5.0", "status": "affected", "lessThan": "2.5.10.1", "versionType": "maven" }
+          ]
+        }
+      ]
+    }
+  }
+}

package/test/fixtures/cve-samples/cve-with-packagename.json

@@ -0,0 +1,37 @@
+{
+  "cveMetadata": {
+    "cveId": "CVE-2021-44228",
+    "datePublished": "2021-12-10T00:00:00Z"
+  },
+  "containers": {
+    "cna": {
+      "descriptions": [
+        { "lang": "en", "value": "Apache Log4j2 JNDI features used in configuration do not protect against attacker controlled LDAP and other JNDI related endpoints. (Log4Shell)" }
+      ],
+      "metrics": [
+        {
+          "cvssV3_1": {
+            "baseScore": 10.0,
+            "baseSeverity": "CRITICAL"
+          }
+        }
+      ],
+      "affected": [
+        {
+          "vendor": "apache",
+          "product": "log4j-core",
+          "packageName": "org.apache.logging.log4j:log4j-core",
+          "collectionURL": "https://repo.maven.apache.org/maven2",
+          "versions": [
+            {
+              "version": "2.0",
+              "status": "affected",
+              "versionType": "maven",
+              "lessThan": "2.15.0"
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

package/test/fixtures/cve-samples/nvd-log4shell.json

@@ -0,0 +1,40 @@
+{
+	"id": "CVE-2021-44228",
+	"published": "2021-12-10T00:00:00Z",
+	"lastModified": "2022-04-01T00:00:00Z",
+	"descriptions": [
+		{ "lang": "en", "value": "Apache Log4j2 JNDI features used in configuration do not protect against attacker controlled LDAP and other JNDI related endpoints." }
+	],
+	"metrics": {
+		"cvssMetricV31": [
+			{
+				"cvssData": {
+					"baseScore": 10.0,
+					"baseSeverity": "CRITICAL",
+					"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
+				}
+			}
+		]
+	},
+	"references": [
+		{ "url": "https://logging.apache.org/log4j/2.x/security.html", "tags": ["Vendor Advisory"] }
+	],
+	"configurations": [
+		{
+			"operator": "OR",
+			"nodes": [
+				{
+					"operator": "OR",
+					"cpeMatch": [
+						{
+							"vulnerable": true,
+							"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
+							"versionStartIncluding": "2.0.0",
+							"versionEndExcluding": "2.15.0"
+						}
+					]
+				}
+			]
+		}
+	]
+}

package/test/fixtures/cve-samples/nvd-npm-lodash.json

@@ -0,0 +1,22 @@
+{
+	"id": "CVE-2019-10744",
+	"published": "2019-07-26T00:00:00Z",
+	"descriptions": [{ "lang": "en", "value": "Prototype pollution in lodash defaultsDeep." }],
+	"metrics": {
+		"cvssMetricV31": [{ "cvssData": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N" } }]
+	},
+	"references": [{ "url": "https://github.com/lodash/lodash/pull/4336", "tags": ["Patch"] }],
+	"configurations": [
+		{
+			"operator": "OR",
+			"nodes": [
+				{
+					"operator": "OR",
+					"cpeMatch": [
+						{ "vulnerable": true, "criteria": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "4.17.12" }
+					]
+				}
+			]
+		}
+	]
+}

package/test/fixtures/monorepo-mixed/libs/common-bom/pom.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme</groupId>
+		<artifactId>monorepo-parent</artifactId>
+		<version>1.0.0</version>
+		<relativePath>../../pom.xml</relativePath>
+	</parent>
+	<artifactId>common-bom</artifactId>
+	<packaging>pom</packaging>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>${jackson.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.apache.logging.log4j</groupId>
+				<artifactId>log4j-core</artifactId>
+				<version>${log4j.version}</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+</project>

package/test/fixtures/monorepo-mixed/packages/cli/package.json

@@ -0,0 +1,14 @@
+{
+	"name": "@acme/cli",
+	"version": "0.5.0",
+	"private": true,
+	"dependencies": {
+		"minimist": "1.2.5",
+		"node-fetch": "2.6.6",
+		"chalk": "4.1.2",
+		"@acme/private-utils": "1.0.0"
+	},
+	"devDependencies": {
+		"mocha": "9.0.0"
+	}
+}

package/test/fixtures/monorepo-mixed/packages/cli/yarn.lock

@@ -0,0 +1,41 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@acme/private-utils@1.0.0":
+  version "1.0.0"
+  resolved "https://npm.acme.internal/@acme/private-utils/-/private-utils-1.0.0.tgz"
+  integrity sha512-private-fake-hash
+
+chalk@4.1.2:
+  version "4.1.2"
+  resolved "https://registry.yarnpkg.com/chalk/-/chalk-4.1.2.tgz"
+  integrity sha512-fake-chalk-hash
+  dependencies:
+    ansi-styles "^4.1.0"
+    supports-color "^7.1.0"
+
+ansi-styles@^4.1.0:
+  version "4.3.0"
+  resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-4.3.0.tgz"
+  integrity sha512-fake-ansi-hash
+
+supports-color@^7.1.0:
+  version "7.2.0"
+  resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-7.2.0.tgz"
+  integrity sha512-fake-supports-hash
+
+mocha@9.0.0:
+  version "9.0.0"
+  resolved "https://registry.yarnpkg.com/mocha/-/mocha-9.0.0.tgz"
+  integrity sha512-fake-mocha-hash
+
+minimist@1.2.5:
+  version "1.2.5"
+  resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz"
+  integrity sha512-fake-minimist-hash
+
+node-fetch@2.6.6:
+  version "2.6.6"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.6.tgz"
+  integrity sha512-fake-nodefetch-hash

package/test/fixtures/monorepo-mixed/packages/no-lock/package.json

@@ -0,0 +1,9 @@
+{
+	"name": "@acme/no-lock",
+	"version": "0.1.0",
+	"private": true,
+	"dependencies": {
+		"left-pad": "^1.0.0",
+		"chalk": "^4.0.0"
+	}
+}

package/test/fixtures/monorepo-mixed/packages/web-app/package-lock.json

@@ -0,0 +1,71 @@
+{
+	"name": "@acme/web-app",
+	"version": "1.0.0",
+	"lockfileVersion": 3,
+	"requires": true,
+	"packages": {
+		"": {
+			"name": "@acme/web-app",
+			"version": "1.0.0",
+			"dependencies": {
+				"axios": "0.21.0",
+				"lodash": "4.17.15",
+				"express": "4.17.1"
+			},
+			"devDependencies": {
+				"jest": "27.0.0",
+				"eslint": "7.32.0"
+			},
+			"peerDependencies": {
+				"react": "17.0.2"
+			}
+		},
+		"node_modules/axios": {
+			"version": "0.21.0",
+			"resolved": "https://registry.npmjs.org/axios/-/axios-0.21.0.tgz",
+			"integrity": "sha512-fakehash1",
+			"dependencies": { "follow-redirects": "1.13.0" }
+		},
+		"node_modules/follow-redirects": {
+			"version": "1.13.0",
+			"resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz",
+			"integrity": "sha512-fakehash2"
+		},
+		"node_modules/lodash": {
+			"version": "4.17.15",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
+			"integrity": "sha512-fakehash3"
+		},
+		"node_modules/express": {
+			"version": "4.17.1",
+			"resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
+			"integrity": "sha512-fakehash4",
+			"dependencies": {
+				"qs": "6.7.0"
+			}
+		},
+		"node_modules/qs": {
+			"version": "6.7.0",
+			"resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
+			"integrity": "sha512-fakehash5"
+		},
+		"node_modules/jest": {
+			"version": "27.0.0",
+			"dev": true,
+			"resolved": "https://registry.npmjs.org/jest/-/jest-27.0.0.tgz",
+			"integrity": "sha512-fakehash6"
+		},
+		"node_modules/eslint": {
+			"version": "7.32.0",
+			"dev": true,
+			"resolved": "https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz",
+			"integrity": "sha512-fakehash7"
+		},
+		"node_modules/react": {
+			"version": "17.0.2",
+			"peer": true,
+			"resolved": "https://registry.npmjs.org/react/-/react-17.0.2.tgz",
+			"integrity": "sha512-fakehash8"
+		}
+	}
+}

package/test/fixtures/monorepo-mixed/packages/web-app/package.json

@@ -0,0 +1,17 @@
+{
+	"name": "@acme/web-app",
+	"version": "1.0.0",
+	"private": true,
+	"dependencies": {
+		"axios": "0.21.0",
+		"lodash": "4.17.15",
+		"express": "4.17.1"
+	},
+	"devDependencies": {
+		"jest": "27.0.0",
+		"eslint": "7.32.0"
+	},
+	"peerDependencies": {
+		"react": "17.0.2"
+	}
+}

package/test/fixtures/monorepo-mixed/pom.xml

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>com.acme</groupId>
+	<artifactId>monorepo-parent</artifactId>
+	<version>1.0.0</version>
+	<packaging>pom</packaging>
+	<modules>
+		<module>services/api</module>
+		<module>services/worker</module>
+		<module>libs/common-bom</module>
+	</modules>
+	<properties>
+		<jackson.version>2.9.10</jackson.version>
+		<log4j.version>2.14.0</log4j.version>
+		<spring.version>5.3.20</spring.version>
+	</properties>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.acme</groupId>
+				<artifactId>common-bom</artifactId>
+				<version>1.0.0</version>
+				<type>pom</type>
+				<scope>import</scope>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+</project>

package/test/fixtures/monorepo-mixed/services/api/pom.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme</groupId>
+		<artifactId>monorepo-parent</artifactId>
+		<version>1.0.0</version>
+		<relativePath>../../pom.xml</relativePath>
+	</parent>
+	<artifactId>api</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>com.fasterxml.jackson.core</groupId>
+			<artifactId>jackson-databind</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-web</artifactId>
+			<version>${spring.version}</version>
+		</dependency>
+		<dependency>
+			<groupId>com.acme.private</groupId>
+			<artifactId>internal-auth</artifactId>
+			<version>1.2.3</version>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/monorepo-mixed/services/worker/pom.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.acme</groupId>
+		<artifactId>monorepo-parent</artifactId>
+		<version>1.0.0</version>
+		<relativePath>../../pom.xml</relativePath>
+	</parent>
+	<artifactId>worker</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>org.apache.logging.log4j</groupId>
+			<artifactId>log4j-core</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.yaml</groupId>
+			<artifactId>snakeyaml</artifactId>
+			<version>1.30</version>
+		</dependency>
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<version>4.12</version>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/private-lib-detection/core/pom.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.client.app</groupId>
+		<artifactId>secret-monolith</artifactId>
+		<version>1.0.0</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>core</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>org.springframework</groupId>
+			<artifactId>spring-context</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>com.client.private</groupId>
+			<artifactId>secret-lib</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>org.megacorp.private</groupId>
+			<artifactId>megacorp-utils</artifactId>
+			<version>2.1.0</version>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/private-lib-detection/plugin/pom.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.client.app</groupId>
+		<artifactId>secret-monolith</artifactId>
+		<version>1.0.0</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>plugin</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>com.client.app</groupId>
+			<artifactId>core</artifactId>
+			<version>1.0.0</version>
+		</dependency>
+		<dependency>
+			<groupId>com.googlecode.json-simple</groupId>
+			<artifactId>json-simple</artifactId>
+			<version>1.1.1</version>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/private-lib-detection/pom.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>org.megacorp.parents</groupId>
+		<artifactId>megacorp-super-parent</artifactId>
+		<version>9.9.9-PRIVATE</version>
+	</parent>
+	<groupId>com.client.app</groupId>
+	<artifactId>secret-monolith</artifactId>
+	<version>1.0.0</version>
+	<packaging>pom</packaging>
+	<modules>
+		<module>core</module>
+		<module>plugin</module>
+	</modules>
+	<properties>
+		<spring.version>5.3.30</spring.version>
+		<secret-lib.version>1.0.0-CLIENT</secret-lib.version>
+	</properties>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.client.private</groupId>
+				<artifactId>secret-lib</artifactId>
+				<version>${secret-lib.version}</version>
+			</dependency>
+			<dependency>
+				<groupId>org.springframework</groupId>
+				<artifactId>spring-context</artifactId>
+				<version>${spring.version}</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+</project>

package/test/fixtures/simple/app/pom.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.example.simple</groupId>
+		<artifactId>simple-parent</artifactId>
+		<version>1.0.0</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>app</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>com.fasterxml.jackson.core</groupId>
+			<artifactId>jackson-databind</artifactId>
+		</dependency>
+		<dependency>
+			<groupId>com.example.simple</groupId>
+			<artifactId>lib</artifactId>
+			<version>1.0.0</version>
+		</dependency>
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<version>4.13.2</version>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/simple/lib/pom.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<parent>
+		<groupId>com.example.simple</groupId>
+		<artifactId>simple-parent</artifactId>
+		<version>1.0.0</version>
+		<relativePath>..</relativePath>
+	</parent>
+	<artifactId>lib</artifactId>
+	<dependencies>
+		<dependency>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-lang3</artifactId>
+			<version>3.14.0</version>
+		</dependency>
+	</dependencies>
+</project>

package/test/fixtures/simple/pom.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+	<modelVersion>4.0.0</modelVersion>
+	<groupId>com.example.simple</groupId>
+	<artifactId>simple-parent</artifactId>
+	<version>1.0.0</version>
+	<packaging>pom</packaging>
+	<modules>
+		<module>app</module>
+		<module>lib</module>
+	</modules>
+	<properties>
+		<jackson.version>2.16.0</jackson.version>
+	</properties>
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>com.fasterxml.jackson.core</groupId>
+				<artifactId>jackson-databind</artifactId>
+				<version>${jackson.version}</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+</project>