fad-checker 1.0.0

package/lib/maven-repo.js

@@ -0,0 +1,134 @@
+/**
+ * lib/maven-repo.js — fan-out HTTP fetcher across the user's configured
+ * Maven repositories with Maven Central as a final fallback.
+ *
+ * Use cases:
+ *   - Fetching a transitive POM (lib/transitive.js)
+ *   - Checking whether an artifact exists at all (HEAD)
+ *   - Reading <maven-metadata.xml> for latest-version discovery
+ *     (lib/outdated.js)
+ *
+ * Repository entry shape (from ~/.fad-check/config.json or CLI):
+ *   { name?, url, auth? }   auth = "user:pass" (we wrap as Basic <base64>)
+ *
+ * URL convention: each repo URL must end at the directory under which Maven
+ * artifacts are laid out the standard way:
+ *   <repo-url>/<groupId-with-/>/<artifactId>/<version>/<artifactId>-<version>.pom
+ *
+ * The first 2xx wins. Misses are silently aggregated; the caller decides
+ * what to do with "not found anywhere".
+ */
+const MAVEN_CENTRAL = { name: "central", url: "https://repo1.maven.org/maven2/" };
+
+function normalise(url) {
+	if (!url) return url;
+	return url.endsWith("/") ? url : url + "/";
+}
+
+/**
+ * Parse user:pass embedded in a URL (e.g. https://alice:s3cr3t@nexus.acme/...)
+ * Returns { url, auth } where auth is "user:pass" stripped of the URL part.
+ */
+function splitUrlAuth(url) {
+	if (!url) return { url, auth: null };
+	try {
+		const u = new URL(url);
+		if (u.username || u.password) {
+			const auth = decodeURIComponent(u.username) + ":" + decodeURIComponent(u.password);
+			u.username = ""; u.password = "";
+			return { url: u.toString(), auth };
+		}
+	} catch { /* not a URL — return as-is */ }
+	return { url, auth: null };
+}
+
+/**
+ * Build the effective repository list: user-configured + extras (from --repo
+ * CLI) + Maven Central as final fallback. Dedupes by URL.
+ */
+function buildRepoList(userRepos, extraRepos = []) {
+	const out = [];
+	const seen = new Set();
+	const push = r => {
+		if (!r?.url) return;
+		const { url, auth } = splitUrlAuth(normalise(r.url));
+		if (seen.has(url)) return;
+		seen.add(url);
+		out.push({ name: r.name || url, url, auth: r.auth || auth || null });
+	};
+	for (const r of userRepos || []) push(r);
+	for (const r of extraRepos || []) push(r);
+	push(MAVEN_CENTRAL);
+	return out;
+}
+
+function authHeader(auth) {
+	if (!auth) return null;
+	return "Basic " + Buffer.from(auth).toString("base64");
+}
+
+/**
+ * Try fetching `pathSuffix` (relative to each repo URL) from every repo
+ * in order. Returns the first 2xx response as { repo, response, body? }.
+ *
+ * opts:
+ *   method     "GET" (default) | "HEAD"
+ *   fetcher    custom fetch (for tests)
+ *   readBody   read response.text() into body (default false to save mem
+ *              on HEAD calls; transitive.js sets true for POMs)
+ *   userAgent  default "fad-check-maven-repo"
+ *   onMiss     callback(repo, status) for telemetry (verbose mode)
+ */
+async function tryRepos(repos, pathSuffix, opts = {}) {
+	const { method = "GET", fetcher = globalThis.fetch, readBody = false, userAgent = "fad-check-maven-repo", onMiss } = opts;
+	for (const repo of repos) {
+		const url = repo.url + pathSuffix.replace(/^\//, "");
+		const headers = { "User-Agent": userAgent };
+		const ah = authHeader(repo.auth);
+		if (ah) headers.Authorization = ah;
+		let r;
+		try {
+			r = await fetcher(url, { method, headers });
+		} catch (err) {
+			if (onMiss) onMiss(repo, `network: ${err.message}`);
+			continue;
+		}
+		if (r.ok) {
+			let body = null;
+			if (readBody && method !== "HEAD") {
+				try { body = await r.text(); } catch { /* ignore body read fail */ }
+			}
+			return { repo, response: r, body, url };
+		}
+		if (onMiss) onMiss(repo, `HTTP ${r.status}`);
+	}
+	return null;
+}
+
+/** Convenience: HEAD an artifact (any of the listed repos) to check existence. */
+function existsInAny(repos, pathSuffix, opts = {}) {
+	return tryRepos(repos, pathSuffix, { ...opts, method: "HEAD" });
+}
+
+/** Convenience: GET a POM (text/xml) — sets readBody=true. */
+function fetchPomFromRepos(repos, groupId, artifactId, version, opts = {}) {
+	const p = `${groupId.replace(/\./g, "/")}/${artifactId}/${version}/${artifactId}-${version}.pom`;
+	return tryRepos(repos, p, { ...opts, method: "GET", readBody: true });
+}
+
+/** Convenience: GET maven-metadata.xml (for latest-version discovery). */
+function fetchMavenMetadata(repos, groupId, artifactId, opts = {}) {
+	const p = `${groupId.replace(/\./g, "/")}/${artifactId}/maven-metadata.xml`;
+	return tryRepos(repos, p, { ...opts, method: "GET", readBody: true });
+}
+
+module.exports = {
+	MAVEN_CENTRAL,
+	buildRepoList,
+	tryRepos,
+	existsInAny,
+	fetchPomFromRepos,
+	fetchMavenMetadata,
+	splitUrlAuth,
+	authHeader,
+};

package/lib/maven-version.js

@@ -0,0 +1,153 @@
+/**
+ * lib/maven-version.js — Maven-flavoured version parsing and comparison.
+ *
+ * Maven version ordering rules (approximation of Apache Maven's
+ * ComparableVersion):
+ *   - Versions are split on `.` and `-` into segments.
+ *   - Numeric segments compare numerically.
+ *   - String segments compare via a qualifier ordering:
+ *       alpha < beta < milestone < rc < snapshot < "" (release) < sp
+ *   - Trailing zeros are insignificant: 1.0 == 1.0.0 == 1.
+ *   - Known release qualifiers (final, release, ga) are treated as "".
+ */
+
+// Lower number == lower precedence
+const QUALIFIER_ORDER = {
+	"alpha": 1, "a": 1,
+	"beta": 2, "b": 2,
+	"milestone": 3, "m": 3,
+	"rc": 4, "cr": 4,
+	"snapshot": 5,
+	"": 6, "ga": 6, "final": 6, "release": 6,
+	"sp": 7,
+};
+
+function parseMavenVersion(versionStr) {
+	if (versionStr == null) return { original: "", segments: [] };
+	const original = String(versionStr).trim();
+	if (!original) return { original: "", segments: [] };
+
+	// Split on `.` and `-`, lowercase string segments
+	const raw = original.toLowerCase().split(/[.\-]/);
+	const segments = raw.map(s => {
+		if (/^\d+$/.test(s)) return { kind: "num", value: parseInt(s, 10) };
+		// Embedded numbers (e.g. "rc1" → ["rc", 1])
+		const m = s.match(/^([a-z]+)(\d+)$/);
+		if (m) return { kind: "qual+num", qual: m[1], num: parseInt(m[2], 10) };
+		return { kind: "str", value: s };
+	});
+	return { original, segments };
+}
+
+function qualifierRank(q) {
+	if (q == null) return QUALIFIER_ORDER[""];
+	const r = QUALIFIER_ORDER[q.toLowerCase()];
+	return r != null ? r : QUALIFIER_ORDER[""] - 0.5; // unknown qualifier sits just below release
+}
+
+function qualOf(seg) {
+	if (!seg) return null;
+	if (seg.kind === "str") return seg.value;
+	if (seg.kind === "qual+num") return seg.qual;
+	return null;
+}
+
+function cmpSegments(a, b) {
+	// a or b may be missing — treat as numeric 0 (trailing zeros are insignificant)
+	if (!a) {
+		if (b.kind === "num") return b.value === 0 ? 0 : -1;
+		// b is a qualifier (str or qual+num) — pre-release < release
+		return qualifierRank("") - qualifierRank(qualOf(b));
+	}
+	if (!b) {
+		if (a.kind === "num") return a.value === 0 ? 0 : 1;
+		return qualifierRank(qualOf(a)) - qualifierRank("");
+	}
+	if (a.kind === "num" && b.kind === "num") return a.value - b.value;
+	if (a.kind === "num") {
+		// number vs qualifier — numbers are "newer" than pre-release qualifiers
+		const r = qualifierRank(b.value);
+		return r < QUALIFIER_ORDER[""] ? 1 : -1;
+	}
+	if (b.kind === "num") {
+		const r = qualifierRank(a.value);
+		return r < QUALIFIER_ORDER[""] ? -1 : 1;
+	}
+	if (a.kind === "qual+num" && b.kind === "qual+num") {
+		const d = qualifierRank(a.qual) - qualifierRank(b.qual);
+		return d !== 0 ? d : a.num - b.num;
+	}
+	if (a.kind === "qual+num") return qualifierRank(a.qual) - qualifierRank(b.value);
+	if (b.kind === "qual+num") return qualifierRank(a.value) - qualifierRank(b.qual);
+	return qualifierRank(a.value) - qualifierRank(b.value);
+}
+
+function compareMavenVersions(aStr, bStr) {
+	const a = parseMavenVersion(aStr).segments;
+	const b = parseMavenVersion(bStr).segments;
+	const n = Math.max(a.length, b.length);
+	for (let i = 0; i < n; i++) {
+		const c = cmpSegments(a[i], b[i]);
+		if (c !== 0) return c < 0 ? -1 : 1;
+	}
+	return 0;
+}
+
+/**
+ * Check whether a dependency version falls within a CVE-specified range.
+ * spec shape: { version, status, lessThan, lessThanOrEqual, versionType }
+ * Returns true if depVersion is affected.
+ */
+function isVersionAffected(depVersion, spec) {
+	if (!spec) return false;
+	if (spec.status && spec.status !== "affected") return false;
+
+	const dep = parseMavenVersion(depVersion);
+	if (!dep.segments.length) return false;
+
+	// Lower bound (inclusive)
+	if (spec.version && spec.version !== "0" && spec.version !== "*") {
+		if (compareMavenVersions(depVersion, spec.version) < 0) return false;
+	}
+	// Upper bound exclusive
+	if (spec.lessThan) {
+		if (compareMavenVersions(depVersion, spec.lessThan) >= 0) return false;
+	}
+	// Upper bound inclusive
+	if (spec.lessThanOrEqual) {
+		if (compareMavenVersions(depVersion, spec.lessThanOrEqual) > 0) return false;
+	}
+	// Exact match with no bounds — only affected if equal
+	if (!spec.lessThan && !spec.lessThanOrEqual && spec.version && spec.version !== "0" && spec.version !== "*") {
+		if (compareMavenVersions(depVersion, spec.version) !== 0) return false;
+	}
+	return true;
+}
+
+/**
+ * Parse a Maven version range expression like "[1.0,2.0)", "(,1.5]", "1.2.3".
+ * Returns { lower, lowerInclusive, upper, upperInclusive, exact } or null.
+ */
+function parseRange(rangeStr) {
+	if (rangeStr == null) return null;
+	const s = String(rangeStr).trim();
+	if (!s) return null;
+	if (!/^[\[\(]/.test(s)) return { exact: s };
+	const open = s[0];
+	const close = s[s.length - 1];
+	const inner = s.slice(1, -1);
+	const [lo, hi] = inner.split(",").map(p => p.trim());
+	return {
+		lower: lo || null,
+		lowerInclusive: open === "[",
+		upper: hi || null,
+		upperInclusive: close === "]",
+	};
+}
+
+module.exports = {
+	parseMavenVersion,
+	compareMavenVersions,
+	isVersionAffected,
+	parseRange,
+};

package/lib/npm/collect.js

@@ -0,0 +1,224 @@
+/**
+ * lib/npm/collect.js — walk a JS project root, parse every manifest /
+ * lockfile, and produce a Map<key, depRecord> matching the shape that
+ * lib/cve-match.collectResolvedDeps produces for Maven.
+ *
+ *   key:        "npm:<name>"   (deliberately namespaced so it never
+ *                                collides with Maven "g:a" keys)
+ *   depRecord:  { groupId: "", artifactId: name, version, scope, pomPaths,
+ *                 ecosystem: "npm", resolved, integrity, lockType,
+ *                 manifestPaths: [absolute paths of files mentioning it] }
+ *
+ * Conflict resolution between manifests for the same package:
+ *   - lockfile entries WIN over package.json range specs (concrete version)
+ *   - if two lockfiles disagree, keep the highest semver-comparable version
+ *   - dev/optional/peer downgrade to prod if any manifest puts the dep in prod
+ */
+const path = require("path");
+const fs = require("fs");
+const { parsePackageJson, parsePackageLock, parseYarnLockV1, findJsManifests } = require("./parse");
+
+const SCOPE_RANK = { prod: 4, peer: 3, optional: 2, dev: 1, transitive: 0 };
+
+function rankScope(s) { return SCOPE_RANK[s] || 0; }
+
+function semverCompare(a, b) {
+	// Lightweight semver compare — good enough for "keep highest"; not
+	// canonical (doesn't fully implement build metadata ordering). For CVE
+	// matching we'll defer to ecosystem-aware comparators when needed.
+	const norm = v => String(v || "").replace(/^[v=]+/, "").split(/[-+]/)[0].split(".").map(n => parseInt(n, 10) || 0);
+	const ax = norm(a), bx = norm(b);
+	const n = Math.max(ax.length, bx.length);
+	for (let i = 0; i < n; i++) {
+		const d = (ax[i] || 0) - (bx[i] || 0);
+		if (d !== 0) return d > 0 ? 1 : -1;
+	}
+	return 0;
+}
+
+function isResolvedVersion(v) {
+	// Reject ranges/specifiers like "^1.0.0", "~2.0", ">=1.0.0", "*", "latest", "git+..."
+	if (!v) return false;
+	if (/^[\^~>=<*]/.test(v)) return false;
+	if (/^(latest|next|workspace:|git\+|file:|link:|http)/i.test(v)) return false;
+	// Bare semver-ish strings only (digits and at most one dash for prerelease tag)
+	return /^\d+\.\d+(\.\d+)?([.\-+]\S+)?$/.test(v) || /^\d+$/.test(v);
+}
+
+function upsert(out, dep, manifestPath, lockType) {
+	const key = `npm:${dep.name}`;
+	const existing = out.get(key);
+	// ecosystemType narrows "ecosystem" to the tool that produced the lockfile:
+	//   "npm"  for package-lock.json
+	//   "yarn" for yarn.lock
+	// Used by the report to split sections per tool.
+	const ecosystemType = (lockType || "").startsWith("package-lock") ? "npm"
+		: (lockType || "").startsWith("yarn") ? "yarn"
+		: "npm";
+	const record = {
+		groupId: "",
+		artifactId: dep.name,
+		version: dep.version || null,
+		scope: dep.scope || "prod",
+		isDev: !!dep.isDev,
+		pomPaths: [manifestPath],
+		manifestPaths: [manifestPath],
+		ecosystem: "npm",
+		ecosystemType,
+		lockType,
+		depth: dep.depth ?? null,
+		resolved: dep.resolved || null,
+		integrity: dep.integrity || null,
+		from: dep.from || null,
+	};
+	if (!existing) {
+		out.set(key, record);
+		return;
+	}
+	// Merge
+	if (!existing.manifestPaths.includes(manifestPath)) {
+		existing.manifestPaths.push(manifestPath);
+		existing.pomPaths.push(manifestPath);
+	}
+	// Prefer the resolved (lockfile) version over a range from package.json
+	const incoming = record.version;
+	const have = existing.version;
+	if (isResolvedVersion(incoming) && !isResolvedVersion(have)) {
+		existing.version = incoming;
+	} else if (isResolvedVersion(incoming) && isResolvedVersion(have)) {
+		if (semverCompare(incoming, have) > 0) existing.version = incoming;
+	} else if (!have && incoming) {
+		existing.version = incoming;
+	}
+	// Stronger scope wins (prod > peer > optional > dev)
+	if (rankScope(record.scope) > rankScope(existing.scope)) existing.scope = record.scope;
+	// A dep is "dev" overall only if every occurrence is dev. Any prod use → not dev.
+	if (!record.isDev) existing.isDev = false;
+	// First non-null resolved/integrity wins
+	if (!existing.resolved && record.resolved) existing.resolved = record.resolved;
+	if (!existing.integrity && record.integrity) existing.integrity = record.integrity;
+}
+
+/**
+ * Walk `rootDir`, parse every manifest, return { deps, warnings }.
+ *
+ * Returns:
+ *   {
+ *     deps:     Map<key, depRecord>,   // unchanged shape from before
+ *     warnings: [                       // surfaced into console + report
+ *       { type: "no-lockfile", manifestPath, message }, ...
+ *     ],
+ *   }
+ *
+ * Lockfile policy: we ONLY collect deps from a lockfile (package-lock.json or
+ * yarn.lock). A package.json without a sibling lockfile is intentionally
+ * skipped — its values are ranges ("^1.0.0") that can't be queried against
+ * OSV and create false negatives. The caller is warned so they can either
+ * run `npm install` / `yarn install` to generate a lock, or accept the gap.
+ *
+ * opts:
+ *   ignoreTest    — skip dev / optional dependencies (mirrors Maven's --ignore-test)
+ *   deps2Exclude  — RegExp tested against the npm name (covers private @scope/* packages)
+ *   verbose
+ */
+function collectNpmDeps(rootDir, opts = {}) {
+	const { ignoreTest, deps2Exclude, verbose } = opts;
+	const out = new Map();
+	const warnings = [];
+	const manifestGroups = findJsManifests(rootDir);
+	let parsedCount = 0;
+
+	for (const group of manifestGroups) {
+		const pj = group.packageJson ? safeParse(parsePackageJson, group.packageJson, verbose) : null;
+		const pl = group.packageLock ? safeParse(parsePackageLock, group.packageLock, verbose) : null;
+		const yl = group.yarnLock ? safeParse(parseYarnLockV1, group.yarnLock, verbose) : null;
+		const hasLock = !!(pl || yl);
+
+		// package.json without lockfile → warning, skip dep collection.
+		if (pj && !hasLock) {
+			warnings.push({
+				type: "no-lockfile",
+				manifestPath: group.packageJson,
+				packageName: pj.packageName || null,
+				message: `package.json without lockfile — skipped (run "npm install" or "yarn install" to generate one)`,
+			});
+			if (verbose) console.warn(`⚠️  ${group.packageJson}: no lockfile, skipped (${pj.deps.length} ranges in package.json)`);
+		}
+
+		// Yarn-Berry lockfile detected but unsupported → warning, skip.
+		if (yl?.unsupported === "yarn-berry") {
+			warnings.push({
+				type: "yarn-berry-unsupported",
+				manifestPath: group.yarnLock,
+				message: `yarn 2+/Berry lockfile not yet supported — skipped`,
+			});
+			if (verbose) console.warn(`⚠️  ${group.yarnLock}: yarn-berry not supported, skipped`);
+		}
+
+		// Used only as a source of scope info — never emits deps on its own.
+		const directScopes = pj ? new Map(pj.deps.map(d => [d.name, d.scope])) : null;
+
+		if (pl) {
+			parsedCount++;
+			for (const d of pl.deps) {
+				// In v1 npm dev/optional propagate; in v2/v3 the `dev` flag is reliable
+				const explicit = directScopes?.get(d.name);
+				const scope = explicit || d.scope || "prod";
+				if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+				if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+				upsert(out, { ...d, scope }, group.packageLock, `package-lock-v${pl.lockfileVersion}`);
+			}
+		}
+		if (yl) {
+			parsedCount++;
+			// yarn-berry warning already pushed above; only emit deps for v1
+			if (yl.unsupported !== "yarn-berry") {
+				for (const d of yl.deps) {
+					const explicit = directScopes?.get(d.name);
+					const scope = explicit || "prod";
+					if (ignoreTest && (scope === "dev" || scope === "optional")) continue;
+					if (deps2Exclude && deps2Exclude.test(d.name)) continue;
+					upsert(out, { ...d, scope }, group.yarnLock, "yarn-v1");
+				}
+			}
+		}
+	}
+
+	if (verbose) console.log(`📦 npm/yarn: parsed ${parsedCount} manifests, ${out.size} unique packages${warnings.length ? `, ${warnings.length} warnings` : ""}`);
+	// Backward compat: the Map carries the warnings under a non-enumerable prop
+	// so existing callers that iterate `for (const [k,v] of map)` still work.
+	Object.defineProperty(out, "warnings", { value: warnings, enumerable: false });
+	return out;
+}
+
+function safeParse(fn, file, verbose) {
+	try { return fn(file); }
+	catch (e) {
+		if (verbose) console.warn(`⚠️  parse failed: ${file} — ${e.message}`);
+		return null;
+	}
+}
+
+function hasJsManifests(rootDir) {
+	try {
+		const stack = [rootDir];
+		const skip = new Set([
+			"node_modules", "bower_components", "jspm_packages",
+			".git", ".idea", ".vscode", ".gradle", ".mvn",
+			"dist", "build", "out", "target", "coverage", ".next", ".nuxt",
+		]);
+		while (stack.length) {
+			const cur = stack.pop();
+			let entries;
+			try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
+			catch { continue; }
+			for (const e of entries) {
+				if (e.isFile() && (e.name === "package.json" || e.name === "package-lock.json" || e.name === "yarn.lock")) return true;
+				if (e.isDirectory() && !skip.has(e.name)) stack.push(path.join(cur, e.name));
+			}
+		}
+	} catch { /* ignore */ }
+	return false;
+}
+
+module.exports = { collectNpmDeps, hasJsManifests };