fad-checker 1.0.0

package/lib/cve-match.js

@@ -0,0 +1,228 @@
+/**
+ * lib/cve-match.js — collect resolved deps from the parsed POM tree and
+ * match them against a CVE index built by lib/cve-download.js.
+ */
+const { coord } = require("./core");
+const { compareMavenVersions, isVersionAffected } = require("./maven-version");
+const { resolveTransitiveDeps } = require("./transitive");
+
+const SEVERITY_RANK = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1, NONE: 0, UNKNOWN: 0 };
+
+function resolveDepVersion(rawVersion, allProps) {
+	if (!rawVersion) return null;
+	// Resolve ${prop} references using the merged property map for this POM.
+	return String(rawVersion).replace(/\$\{\s*([\w._-]+)\s*\}/g, (m, k) => {
+		const v = allProps?.[k];
+		if (Array.isArray(v)) return v[0];
+		return v != null ? v : m;
+	});
+}
+
+/**
+ * Walk allPomMetadata.byPath, collect every {groupId,artifactId,version,scope}
+ * triple, dedupe by groupId:artifactId keeping the highest version seen,
+ * also include external parent POMs as scope='parent'.
+ *
+ * Returns Map<key, { groupId, artifactId, version, scope, pomPaths }>
+ */
+function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
+	const { ignoreTest, deps2Exclude } = opts;
+	const out = new Map();
+
+	const collectFrom = (depList, pomPath, props) => {
+		if (!depList) return;
+		for (const dep of depList) {
+			const g = coord(dep.groupId?.[0]);
+			const a = coord(dep.artifactId?.[0]);
+			let v = coord(dep.version?.[0]);
+			const scope = dep.scope?.[0] || "compile";
+			if (!g || !a) continue;
+			if (ignoreTest && scope === "test") continue;
+			if (deps2Exclude && deps2Exclude.test(g)) continue;
+			if (v) v = resolveDepVersion(v, props);
+			const key = `${g}:${a}`;
+			const existing = out.get(key);
+			const isDev = scope === "test" || scope === "provided";
+			if (!existing) {
+				out.set(key, { groupId: g, artifactId: a, version: v || null, scope, pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven", isDev });
+			} else {
+				if (!existing.pomPaths.includes(pomPath)) existing.pomPaths.push(pomPath);
+				if (existing.scope === "test" && scope !== "test") existing.scope = scope;
+				if (v && (!existing.version || compareMavenVersions(v, existing.version) > 0)) {
+					existing.version = v;
+				}
+				// A dep is "dev" overall only if every occurrence is test/provided.
+				if (!isDev) existing.isDev = false;
+			}
+		}
+	};
+
+	for (const pomPath of Object.keys(allPomMetadata.byPath)) {
+		const props = allPropsByPom[pomPath]?.properties || {};
+		const merged = allPropsByPom[pomPath];
+		collectFrom(merged?.dependencies, pomPath, props);
+		collectFrom(merged?.dependencyManagement, pomPath, props);
+	}
+
+	// Add external parent POMs (those not present locally) as scope='parent'.
+	for (const pomPath of Object.keys(allPomMetadata.byPath)) {
+		const meta = allPomMetadata.byPath[pomPath];
+		const p = meta.parentInfo;
+		if (!p || !p.groupId || !p.artifactId) continue;
+		const isLocal = allPomMetadata.byId[`${p.groupId}:${p.artifactId}`] ||
+			(p.version && allPomMetadata.byId[`${p.groupId}:${p.artifactId}:${p.version}`]);
+		if (isLocal) continue;
+		if (deps2Exclude && deps2Exclude.test(p.groupId)) continue;
+		const key = `${p.groupId}:${p.artifactId}`;
+		if (!out.has(key)) {
+			out.set(key, {
+				groupId: p.groupId, artifactId: p.artifactId, version: p.version || null,
+				scope: "parent", pomPaths: [pomPath], ecosystem: "maven", ecosystemType: "maven",
+			});
+		}
+	}
+
+	return out;
+}
+
+/**
+ * Expand a deps Map (from collectResolvedDeps) by resolving every dep's
+ * transitive closure via Maven Central. Mutates and returns the Map.
+ *
+ * opts:
+ *   verbose, maxDepth, includedScopes
+ *   includeRootMgmt (default true) — feed the project's own depMgmt entries
+ *     (collected as scope='compile' deps with no version) as version overrides
+ *     for transitive deps. This mirrors Maven's behaviour where the root
+ *     project's <dependencyManagement> wins over transitive depMgmt.
+ */
+async function expandWithTransitives(resolvedDeps, opts = {}) {
+	const { verbose } = opts;
+	// Root depMgmt: every dep in the Map that has a concrete version becomes a
+	// version override for transitive resolution. This catches cases where the
+	// project pins a transitive's version via <dependencyManagement>.
+	const rootDepMgmt = new Map();
+	for (const dep of resolvedDeps.values()) {
+		if (dep.version && !/\$\{/.test(dep.version)) {
+			rootDepMgmt.set(`${dep.groupId}:${dep.artifactId}`, { version: dep.version });
+		}
+	}
+
+	const directs = [...resolvedDeps.values()]
+		.filter(d => d.version && !/\$\{/.test(d.version))
+		.filter(d => d.scope !== "test" || opts.includeTestDeps)
+		.filter(d => d.scope !== "parent");
+
+	if (verbose) console.log(`🌳 Resolving transitives for ${directs.length} direct deps…`);
+
+	const transitives = await resolveTransitiveDeps(directs, {
+		...opts,
+		rootDepMgmt,
+	});
+
+	let added = 0;
+	for (const [key, t] of transitives) {
+		if (resolvedDeps.has(key)) continue; // direct dep takes priority
+		resolvedDeps.set(key, {
+			groupId: t.groupId,
+			artifactId: t.artifactId,
+			version: t.version,
+			scope: "transitive",
+			pomPaths: [],
+			via: t.via,
+			viaPaths: t.viaPaths || [t.via],
+			depth: t.depth,
+			ecosystem: "maven",
+			ecosystemType: "maven",
+		});
+		added++;
+	}
+	if (verbose) console.log(`🌳 Added ${added} transitive deps to the scan set`);
+	return resolvedDeps;
+}
+
+/**
+ * Match a single dep against an index entry array, deduping by cve.id.
+ * confidence levels:
+ *   "exact"  — index lookup by packageName matched
+ *   "probable" — vendor matches groupId prefix
+ *   "possible" — product matches artifactId but vendor is unknown/unmatched
+ */
+function matchOne(dep, entries, confidence) {
+	const matches = [];
+	if (!entries) return matches;
+	for (const e of entries) {
+		const affected = (e.ranges || []).some(r => {
+			if (!dep.version) return r.status === "affected"; // unknown version → assume affected
+			return isVersionAffected(dep.version, r);
+		});
+		if (affected) matches.push({ dep, cve: { ...e }, confidence });
+	}
+	return matches;
+}
+
+function vendorMatchesGroup(vendor, groupId) {
+	if (!vendor || !groupId) return false;
+	const v = vendor.toLowerCase();
+	const g = groupId.toLowerCase();
+	if (g === v) return true;
+	if (g.includes(v) || v.includes(g)) return true;
+	// org.apache.commons matches vendor "apache"
+	const parts = g.split(".");
+	return parts.includes(v);
+}
+
+function matchDepsAgainstCves(resolvedDeps, cveIndex) {
+	if (!cveIndex) return [];
+	const byPackage = cveIndex.byPackageName || {};
+	const byProduct = cveIndex.byProduct || {};
+
+	const all = [];
+	for (const dep of resolvedDeps.values()) {
+		// The CVEProject Maven index has no npm coverage — skip npm deps here.
+		// They are caught by the OSV pipeline (which is multi-ecosystem) and
+		// the CPE refinement step (post-NVD).
+		if (dep.ecosystem === "npm") continue;
+		const key = `${dep.groupId}:${dep.artifactId}`.toLowerCase();
+		// Tier 1: exact packageName match
+		const t1 = matchOne(dep, byPackage[key], "exact");
+		all.push(...t1);
+		// Tier 2/3: product match, scoped by vendor heuristic
+		const productMatches = byProduct[dep.artifactId.toLowerCase()] || [];
+		for (const e of productMatches) {
+			if (vendorMatchesGroup(e.vendor, dep.groupId)) {
+				all.push(...matchOne(dep, [e], "probable"));
+			} else {
+				all.push(...matchOne(dep, [e], "possible"));
+			}
+		}
+	}
+
+	// Dedupe by dep + cve.id
+	const seen = new Set();
+	const deduped = [];
+	for (const m of all) {
+		const k = `${m.dep.groupId}:${m.dep.artifactId}|${m.cve.id}`;
+		if (seen.has(k)) continue;
+		seen.add(k);
+		deduped.push(m);
+	}
+
+	// Sort by severity descending, then CVE id
+	deduped.sort((a, b) => {
+		const sa = SEVERITY_RANK[(a.cve.severity || "UNKNOWN").toUpperCase()] || 0;
+		const sb = SEVERITY_RANK[(b.cve.severity || "UNKNOWN").toUpperCase()] || 0;
+		if (sb !== sa) return sb - sa;
+		return a.cve.id.localeCompare(b.cve.id);
+	});
+	return deduped;
+}
+
+module.exports = {
+	collectResolvedDeps,
+	expandWithTransitives,
+	matchDepsAgainstCves,
+	resolveDepVersion,
+	vendorMatchesGroup,
+	SEVERITY_RANK,
+};