fad-checker 1.0.6 → 2.0.1

package/test/cpe.test.js

@@ -1,166 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const path = require("path");
-const {
-	parseCpe23,
-	matchVersionRange,
-	cpeMatchesDep,
-	evaluateCveForDep,
-	refineMatchesWithCpe,
-} = require("../lib/cpe");
-
-const FIX = path.join(__dirname, "fixtures", "cve-samples");
-
-test("parseCpe23 splits all 13 fields and handles escaping", () => {
-	const c = parseCpe23("cpe:2.3:a:apache:log4j:2.14.0:*:*:*:*:*:*:*");
-	assert.equal(c.part, "a");
-	assert.equal(c.vendor, "apache");
-	assert.equal(c.product, "log4j");
-	assert.equal(c.version, "2.14.0");
-});
-
-test("parseCpe23 returns null for malformed URI", () => {
-	assert.equal(parseCpe23("not a cpe"), null);
-	assert.equal(parseCpe23("cpe:2.3:a:vendor"), null);
-	assert.equal(parseCpe23(42), null);
-});
-
-test("parseCpe23 handles backslash-escaped colons (e.g. eclipse:vert\\.x)", () => {
-	const c = parseCpe23("cpe:2.3:a:vendor:weird\\:name:1.0:*:*:*:*:*:*:*");
-	assert.equal(c.product, "weird:name");
-});
-
-test("matchVersionRange honours versionStartIncluding + versionEndExcluding", () => {
-	const m = {
-		criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
-		vulnerable: true,
-		versionStartIncluding: "2.0.0",
-		versionEndExcluding: "2.15.0",
-	};
-	assert.equal(matchVersionRange("2.14.1", m), true);
-	assert.equal(matchVersionRange("2.0.0", m), true);    // lower-inclusive
-	assert.equal(matchVersionRange("2.15.0", m), false);  // upper-exclusive
-	assert.equal(matchVersionRange("1.9.0", m), false);
-	assert.equal(matchVersionRange("2.17.0", m), false);
-});
-
-test("matchVersionRange honours hard-pinned criteria version", () => {
-	const m = { criteria: "cpe:2.3:a:apache:log4j:2.14.0:*:*:*:*:*:*:*", vulnerable: true };
-	assert.equal(matchVersionRange("2.14.0", m), true);
-	assert.equal(matchVersionRange("2.14.1", m), false);
-});
-
-test("matchVersionRange folds CPE update qualifier into the version pin (H5)", () => {
-	// CPE 2.3 ":1.0.0:rc1:" describes the 1.0.0-rc1 pre-release. A release dep
-	// at 1.0.0 must NOT match — that was the H5 cascade.
-	const beta = { criteria: "cpe:2.3:a:apache:foo:1.0.0:beta1:*:*:*:*:*:*", vulnerable: true };
-	assert.equal(matchVersionRange("1.0.0", beta), false);
-	assert.equal(matchVersionRange("1.0.0-beta1", beta), true);
-
-	const rc = { criteria: "cpe:2.3:a:apache:foo:1.0.0:rc1:*:*:*:*:*:*", vulnerable: true };
-	assert.equal(matchVersionRange("1.0.0", rc), false);
-	assert.equal(matchVersionRange("1.0.0-rc1", rc), true);
-});
-
-test("cpeMatchesDep rejects short-token vendor leak (M4 mirror of H2)", () => {
-	const cpe = parseCpe23("cpe:2.3:a:a:log4j-core:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "com.unrelated.log4j-core", artifactId: "log4j-core", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), false);
-});
-
-test("matchVersionRange returns true for unknown dep version (conservative)", () => {
-	const m = { criteria: "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", vulnerable: true, versionEndExcluding: "2.15.0" };
-	assert.equal(matchVersionRange(null, m), true);
-});
-
-test("cpeMatchesDep — curated map exact maven coord", () => {
-	const cpe = parseCpe23("cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — heuristic vendor token in groupId", () => {
-	const cpe = parseCpe23("cpe:2.3:a:apache:commons-totally-novel:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "org.apache.commons", artifactId: "commons-totally-novel", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — npm bare name", () => {
-	const cpe = parseCpe23("cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*");
-	const dep = { groupId: "", artifactId: "lodash", ecosystem: "npm" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — npm scoped package via vendor split", () => {
-	const cpe = parseCpe23("cpe:2.3:a:scope:pkg:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "", artifactId: "@scope/pkg", ecosystem: "npm" };
-	assert.equal(cpeMatchesDep(cpe, dep), true);
-});
-
-test("cpeMatchesDep — wrong artifact does not match", () => {
-	const cpe = parseCpe23("cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*");
-	const dep = { groupId: "org.apache.commons", artifactId: "commons-io", ecosystem: "maven" };
-	assert.equal(cpeMatchesDep(cpe, dep), false);
-});
-
-test("evaluateCveForDep — Log4Shell NVD record matches vulnerable log4j-core", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", ecosystem: "maven" };
-	const { affected, confidence } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, true);
-	assert.equal(confidence, "exact");
-});
-
-test("evaluateCveForDep — patched log4j is not affected (version out of range)", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const dep = { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.17.1", ecosystem: "maven" };
-	const { affected } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, false);
-});
-
-test("evaluateCveForDep — unrelated maven dep is not affected", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const dep = { groupId: "com.google.guava", artifactId: "guava", version: "31.0", ecosystem: "maven" };
-	const { affected } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, false);
-});
-
-test("evaluateCveForDep — npm lodash matches the lodash CVE", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-npm-lodash.json"), "utf8"));
-	const dep = { groupId: "", artifactId: "lodash", version: "4.17.10", ecosystem: "npm" };
-	const { affected, confidence } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, true);
-	assert.equal(confidence, "exact");
-});
-
-test("evaluateCveForDep — patched npm lodash is not affected", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-npm-lodash.json"), "utf8"));
-	const dep = { groupId: "", artifactId: "lodash", version: "4.17.20", ecosystem: "npm" };
-	const { affected } = evaluateCveForDep(cve, dep);
-	assert.equal(affected, false);
-});
-
-test("refineMatchesWithCpe upgrades possible→exact when curated map confirms", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const matches = [{
-		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", ecosystem: "maven" },
-		cve: { id: cve.id, configurations: cve.configurations, severity: "HIGH" },
-		confidence: "possible",
-	}];
-	refineMatchesWithCpe(matches);
-	assert.equal(matches[0].confidence, "exact");
-	assert.equal(matches[0].cpeConfidence, "exact");
-	assert.equal(matches[0].cpeFiltered, undefined);
-});
-
-test("refineMatchesWithCpe flags out-of-range version as likely FP", () => {
-	const cve = JSON.parse(fs.readFileSync(path.join(FIX, "nvd-log4shell.json"), "utf8"));
-	const matches = [{
-		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.17.1", ecosystem: "maven" },
-		cve: { id: cve.id, configurations: cve.configurations, severity: "HIGH" },
-		confidence: "probable",
-	}];
-	refineMatchesWithCpe(matches);
-	assert.equal(matches[0].cpeFiltered, true);
-});

package/test/cve-download.test.js

@@ -1,39 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const path = require("path");
-const { extractMavenRelevantCve, isMavenRelevant } = require("../lib/cve-download");
-
-const SAMPLES = path.join(__dirname, "fixtures", "cve-samples");
-
-test("extractMavenRelevantCve returns null for non-Java CVEs", () => {
-	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-non-java.json"), "utf8"));
-	assert.equal(extractMavenRelevantCve(json), null);
-});
-
-test("extractMavenRelevantCve parses log4j CVE with packageName", () => {
-	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-with-packagename.json"), "utf8"));
-	const cve = extractMavenRelevantCve(json);
-	assert.equal(cve.id, "CVE-2021-44228");
-	assert.equal(cve.severity, "CRITICAL");
-	assert.equal(cve.score, 10);
-	assert.equal(cve.fixVersion, "2.15.0");
-	assert.equal(cve.affected[0].packageName, "org.apache.logging.log4j:log4j-core");
-});
-
-test("extractMavenRelevantCve handles product-only CVEs (no packageName)", () => {
-	const json = JSON.parse(fs.readFileSync(path.join(SAMPLES, "cve-product-only.json"), "utf8"));
-	const cve = extractMavenRelevantCve(json);
-	assert.equal(cve.id, "CVE-2017-5638");
-	assert.equal(cve.affected[0].product, "struts2-core");
-	assert.equal(cve.affected[0].packageName, null);
-});
-
-test("isMavenRelevant true on known java vendors", () => {
-	assert.equal(isMavenRelevant([{ vendor: "apache", product: "log4j-core" }]), true);
-	assert.equal(isMavenRelevant([{ vendor: "fasterxml", product: "jackson" }]), true);
-});
-
-test("isMavenRelevant false on unrelated ecosystems", () => {
-	assert.equal(isMavenRelevant([{ vendor: "node-vendor", product: "left-pad", collectionURL: "https://registry.npmjs.org" }]), false);
-});

package/test/cve-match.test.js

@@ -1,217 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const path = require("path");
-const fs = require("fs");
-const core = require("../lib/core");
-const { collectResolvedDeps, matchDepsAgainstCves, vendorMatchesGroup } = require("../lib/cve-match");
-const { extractMavenRelevantCve, isMavenRelevant } = require("../lib/cve-download");
-
-const FIXTURES = path.join(__dirname, "fixtures");
-const COMPLEX = path.join(FIXTURES, "complex-enterprise");
-const CVE_SAMPLES = path.join(FIXTURES, "cve-samples");
-
-async function pipeline(src) {
-	const store = core.newMetadataStore();
-	const props = {};
-	const pomFiles = core.findPomFiles(src);
-	for (const f of pomFiles) await core.parsePom(f, store);
-	for (const f of pomFiles) await core.getAllInheritedProps(f, store, props);
-	return { store, props };
-}
-
-function buildIndexFromSamples() {
-	const index = { meta: {}, byPackageName: {}, byProduct: {} };
-	for (const f of fs.readdirSync(CVE_SAMPLES)) {
-		const json = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, f), "utf8"));
-		const cve = extractMavenRelevantCve(json);
-		if (!cve) continue;
-		for (const a of cve.affected) {
-			const e = { id: cve.id, severity: cve.severity, score: cve.score, description: cve.description, ranges: a.ranges, vendor: a.vendor, product: a.product, fixVersion: cve.fixVersion };
-			if (a.packageName) (index.byPackageName[a.packageName.toLowerCase()] ||= []).push(e);
-			if (a.product) (index.byProduct[a.product] ||= []).push(e);
-		}
-	}
-	return index;
-}
-
-test("isMavenRelevant filters out non-Java CVEs", () => {
-	const npmCve = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, "cve-non-java.json"), "utf8"));
-	assert.equal(isMavenRelevant(npmCve.containers.cna.affected), false);
-
-	const log4jCve = JSON.parse(fs.readFileSync(path.join(CVE_SAMPLES, "cve-with-packagename.json"), "utf8"));
-	assert.equal(isMavenRelevant(log4jCve.containers.cna.affected), true);
-});
-
-test("vendorMatchesGroup heuristic", () => {
-	assert.equal(vendorMatchesGroup("apache", "org.apache.commons"), true);
-	assert.equal(vendorMatchesGroup("apache", "org.eclipse.jetty"), false);
-	assert.equal(vendorMatchesGroup("springframework", "org.springframework"), true);
-});
-
-test("vendorMatchesGroup rejects substring leaks (H2)", () => {
-	// All these cases used to leak through unbounded `g.includes(v)` / `v.includes(g)`
-	// branches. The fix keeps only equality + dot-segment membership.
-	assert.equal(vendorMatchesGroup("a", "com.acme.client"), false);
-	assert.equal(vendorMatchesGroup("ibm", "com.ibmcloudant.driver"), false);
-	assert.equal(vendorMatchesGroup("go", "org.golang.x"), false);
-	// "open" used to wrongly match every org.opensaml.* groupId via substring
-	assert.equal(vendorMatchesGroup("open", "org.opensaml.core"), false);
-	// Dot-segment match still works for legitimate cases
-	assert.equal(vendorMatchesGroup("apache", "org.apache.commons"), true);
-	assert.equal(vendorMatchesGroup("springframework", "org.springframework.boot"), true);
-});
-
-test("vendorMatchesGroup tokenizes multi-word legal-entity vendors", () => {
-	// NVD records the logback vendor as "qos.ch sarl" — a legal entity name.
-	// Neither equality nor plain dot-segment catches it, but tokenization on
-	// non-alphanumerics finds "qos"/"ch" as group segments and confirms the
-	// match. Without this, real logback CVEs landed in tier "possible".
-	assert.equal(vendorMatchesGroup("qos.ch sarl", "ch.qos.logback"), true);
-	assert.equal(vendorMatchesGroup("the apache software foundation", "org.apache.commons"), true);
-	// A single-token vendor must NOT be tokenized into substrings — that
-	// would re-introduce the H2 leak (e.g. "open" → ["open"] alone never
-	// matches arbitrary "org.opensaml.*").
-	assert.equal(vendorMatchesGroup("open", "org.opensaml.core"), false);
-});
-
-test("matchDepsAgainstCves hides 'possible' tier by default (H3)", () => {
-	// product matches `log4j-core` but vendor `acme` doesn't match groupId.
-	// Without opts.includePossibleTier we expect zero matches.
-	const idx = {
-		byPackageName: {},
-		byProduct: {
-			"log4j-core": [
-				{ id: "CVE-FAKE-0001", severity: "HIGH", vendor: "acme", product: "log4j-core",
-				  ranges: [{ version: "2.0", lessThan: "2.20.0", status: "affected" }] },
-			],
-		},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile", pomPaths: [],
-		}],
-	]);
-	assert.equal(matchDepsAgainstCves(deps, idx).length, 0);
-	assert.equal(matchDepsAgainstCves(deps, idx, { includePossibleTier: true }).length, 1);
-});
-
-test("matchDepsAgainstCves does not flag deps when range has no bounds (H1+H3)", () => {
-	// Sparse range entry (`{status:"affected"}` with no bounds) used to flag
-	// every version that hit the product bucket. Combined with H3 hiding the
-	// possible tier, this should now produce zero matches even when the
-	// vendor matches.
-	const idx = {
-		byPackageName: {},
-		byProduct: {
-			"log4j-core": [
-				{ id: "CVE-FAKE-0002", severity: "HIGH", vendor: "apache", product: "log4j-core",
-				  ranges: [{ status: "affected" }] },
-			],
-		},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.99.0", scope: "compile", pomPaths: [],
-		}],
-	]);
-	assert.equal(matchDepsAgainstCves(deps, idx).length, 0);
-});
-
-test("collectResolvedDeps dedupes by g:a and includes external parent POMs", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const deps = collectResolvedDeps(store, props, {});
-	// External Spring Boot parent should be present as scope='parent'
-	const sbParent = deps.get("org.springframework.boot:spring-boot-starter-parent");
-	assert.ok(sbParent, "external parent should be collected");
-	assert.equal(sbParent.scope, "parent");
-});
-
-test("collectResolvedDeps keeps highest version on conflict", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const deps = collectResolvedDeps(store, props, {});
-	const lang = deps.get("org.apache.commons:commons-lang3");
-	if (lang) assert.equal(lang.version, "3.12.0");
-});
-
-test("collectResolvedDeps records every distinct version (e.g. two profiles)", () => {
-	const depXml = (g, a, v) => ({ groupId: [g], artifactId: [a], version: [v], scope: ["compile"] });
-	const store = { byPath: { a: {}, b: {} }, byId: {} };
-	// Same g:a pinned to different versions in two modules/profiles.
-	const props = {
-		a: { properties: {}, dependencies: [depXml("com.x", "y", "1.0.0")], dependencyManagement: [] },
-		b: { properties: {}, dependencies: [depXml("com.x", "y", "2.0.0")], dependencyManagement: [] },
-	};
-	const deps = collectResolvedDeps(store, props, {});
-	const y = deps.get("com.x:y");
-	assert.ok(y, "the dep is collected once, keyed by g:a");
-	assert.equal(y.version, "2.0.0", "representative version is still the highest");
-	assert.deepEqual([...y.versions].sort(), ["1.0.0", "2.0.0"], "both distinct versions are tracked");
-});
-
-test("matchDepsAgainstCves scans every distinct version, not just the highest", () => {
-	// A CVE that only affects the OLD version. Profiles pin 2.14.0 (vulnerable)
-	// and 2.20.0 (patched); the highest is patched, so deduping on max would
-	// hide the real exposure. Each distinct version must be scanned.
-	const idx = {
-		byPackageName: {
-			"org.apache.logging.log4j:log4j-core": [
-				{ id: "CVE-OLD-0001", severity: "CRITICAL", vendor: "apache", product: "log4j-core",
-				  ranges: [{ version: "2.0", lessThan: "2.15.0", status: "affected" }] },
-			],
-		},
-		byProduct: {},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core",
-			version: "2.20.0", versions: ["2.14.0", "2.20.0"], scope: "compile", pomPaths: [],
-		}],
-	]);
-	const matches = matchDepsAgainstCves(deps, idx);
-	assert.equal(matches.length, 1, "vulnerable 2.14.0 must be flagged despite 2.20.0 being highest");
-	assert.equal(matches[0].cve.id, "CVE-OLD-0001");
-	assert.equal(matches[0].dep.version, "2.14.0", "match carries the actually-vulnerable version");
-});
-
-test("collectResolvedDeps --ignore-test drops test-scope deps", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const withTest = collectResolvedDeps(store, props, {});
-	const withoutTest = collectResolvedDeps(store, props, { ignoreTest: true });
-	assert.ok(withTest.has("junit:junit"));
-	assert.ok(!withoutTest.has("junit:junit"));
-});
-
-test("matchDepsAgainstCves: log4j 2.14 is matched as CRITICAL via packageName", async () => {
-	const { store, props } = await pipeline(COMPLEX);
-	const deps = collectResolvedDeps(store, props, {});
-	const idx = buildIndexFromSamples();
-	const matches = matchDepsAgainstCves(deps, idx);
-	const log4j = matches.find(m => m.cve.id === "CVE-2021-44228");
-	assert.ok(log4j, "log4j CVE not matched");
-	assert.equal(log4j.dep.artifactId, "log4j-core");
-	assert.equal(log4j.cve.severity, "CRITICAL");
-	assert.equal(log4j.confidence, "exact");
-});
-
-test("matchDepsAgainstCves dedupes by (dep, cveId)", () => {
-	// Synthesize an index where the same dep+cveId appears twice
-	const idx = {
-		byPackageName: {
-			"org.apache.logging.log4j:log4j-core": [
-				{ id: "CVE-2021-44228", severity: "CRITICAL", ranges: [{ version: "2.0", lessThan: "2.15.0" }], vendor: "apache", product: "log4j-core" },
-			],
-		},
-		byProduct: {
-			"log4j-core": [
-				{ id: "CVE-2021-44228", severity: "CRITICAL", ranges: [{ version: "2.0", lessThan: "2.15.0" }], vendor: "apache", product: "log4j-core" },
-			],
-		},
-	};
-	const deps = new Map([
-		["org.apache.logging.log4j:log4j-core", {
-			groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile", pomPaths: [],
-		}],
-	]);
-	const matches = matchDepsAgainstCves(deps, idx);
-	assert.equal(matches.length, 1, "duplicate (dep, cveId) match should be dedup'd");
-});

package/test/cve-report.test.js

@@ -1,171 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const path = require("path");
-const os = require("os");
-const { generateHtmlReport, generateWordReport, computeStats, writeReports, esc } = require("../lib/cve-report");
-
-const sampleMatches = [
-	{
-		dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
-		cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0" },
-		confidence: "exact",
-	},
-	{
-		dep: { groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind", version: "2.13.0", scope: "compile" },
-		cve: { id: "CVE-2022-42003", severity: "HIGH", score: 7.5, description: "DoS via deep nesting", fixVersion: "2.13.5" },
-		confidence: "exact",
-	},
-];
-
-const projectInfo = { name: "demo", src: "/tmp/demo", generatedAt: "2026-05-21", cveDataDate: null };
-
-test("computeStats counts by severity", () => {
-	const s = computeStats(sampleMatches);
-	assert.equal(s.total, 2);
-	assert.equal(s.critical, 1);
-	assert.equal(s.high, 1);
-	assert.equal(s.medium, 0);
-});
-
-test("computeStats handles undefined/null severity", () => {
-	const s = computeStats([{ cve: { severity: null } }, { cve: {} }]);
-	assert.equal(s.unknown, 2);
-});
-
-test("esc escapes HTML entities", () => {
-	assert.equal(esc(`<script>alert("x")</script>&`), "&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;&amp;");
-});
-
-test("generateHtmlReport produces well-formed self-contained HTML", () => {
-	const html = generateHtmlReport({
-		cveMatches: sampleMatches,
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	assert.ok(html.startsWith("<!doctype html>"));
-	assert.ok(html.includes("CVE-2021-44228"));
-	assert.ok(html.includes("Log4Shell"));
-	assert.ok(html.includes("<style>"), "should have inline CSS");
-	assert.ok(!html.includes("</body>\n<body>"), "no double body");
-});
-
-test("generateWordReport contains Word XML namespaces", () => {
-	const doc = generateWordReport({
-		cveMatches: sampleMatches,
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	assert.ok(doc.includes("xmlns:o=\"urn:schemas-microsoft-com:office:office\""));
-	assert.ok(doc.includes("Word.Document"));
-});
-
-test("generateHtmlReport wraps tables with copy buttons", () => {
-	const html = generateHtmlReport({
-		cveMatches: sampleMatches,
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	// Wrapper div + copy button injected around every table
-	assert.ok(html.includes('class="table-wrap"'), "should wrap tables");
-	assert.ok(html.includes('class="btn-copy"'), "should have copy buttons");
-	assert.ok(html.includes("📋 Copy table"), "button label");
-	// Copy script wired up
-	assert.ok(html.includes("navigator.clipboard"), "should include clipboard script");
-	assert.ok(html.includes("inlineStylesForWord"), "should inline styles for Word paste");
-});
-
-test("generateWordReport does NOT wrap tables (no copy buttons in .doc)", () => {
-	const doc = generateWordReport({
-		cveMatches: sampleMatches,
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	assert.ok(!doc.includes('class="table-wrap"'), "no wrapper in Word output");
-	assert.ok(!doc.includes('class="btn-copy"'), "no copy buttons in Word output");
-});
-
-test("CWE human names are shown in the CVE table and detail panel", () => {
-	const html = generateHtmlReport({
-		cveMatches: sampleMatches.map(m => ({
-			...m,
-			cve: { ...m.cve, cwes: ["CWE-502", "CWE-917"] },
-		})),
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	// Detail panel: full name inline
-	assert.ok(html.includes("Deserialization of Untrusted Data"), "CWE-502 name in panel");
-	assert.ok(html.includes("Expression Language Injection"), "CWE-917 name in panel");
-	// Tooltip on the column link
-	assert.ok(html.includes('title="CWE-502: Deserialization of Untrusted Data"'), "tooltip");
-	// Weaknesses section in detail panel
-	assert.ok(html.includes("Weaknesses (CWE)"), "weaknesses section heading");
-	assert.ok(html.includes('class="cwe-list"'), "CWE list rendered");
-});
-
-test("Executive summary surfaces primary CWE name on each preview row", () => {
-	const html = generateHtmlReport({
-		cveMatches: [{
-			dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
-			cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0", cwes: ["CWE-502", "CWE-917"] },
-			confidence: "exact",
-		}],
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	assert.ok(html.includes('class="exec-cwe"'), "exec-cwe chip in summary");
-	assert.ok(html.includes('class="exec-cwe-id">CWE-502'), "id in chip");
-	assert.ok(html.includes("Deserialization of Untrusted Data"), "human name in chip");
-});
-
-test("Unknown CWE falls back to id-only display", () => {
-	const html = generateHtmlReport({
-		cveMatches: [{
-			dep: { groupId: "x", artifactId: "y", version: "1", scope: "compile" },
-			cve: { id: "CVE-2099-9999", severity: "HIGH", description: "n/a", cwes: ["CWE-99999"] },
-		}],
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	assert.ok(html.includes("CWE-99999"), "unknown CWE id present");
-	assert.ok(html.includes("(unknown weakness)"), "fallback label for unknown CWE in detail panel");
-});
-
-test("generateWordReport applies width:100% to every table for Word page-fit", () => {
-	const doc = generateWordReport({
-		cveMatches: sampleMatches,
-		eolResults: [], obsoleteResults: [], outdatedResults: [],
-		projectInfo,
-	});
-	// Every <table> rewritten with width="100%" + inline style (incl. fixed table-layout)
-	assert.ok(doc.includes('width="100%"'), "tables get width=100% attribute");
-	assert.ok(doc.includes("table-layout:fixed"), "tables get fixed layout");
-	// Word section + landscape page setup
-	assert.ok(doc.includes('class="WordSection1"'), "WordSection1 wrapper");
-	assert.ok(doc.includes("mso-page-orientation: landscape"), "landscape declared via mso-* property");
-	assert.ok(doc.includes("29.7cm 21cm"), "explicit A4 landscape dimensions");
-	// MSO conditional comment block with twips-based <w:sectPr> equivalent
-	assert.ok(doc.includes("w:WordDocument"), "Word document XML block");
-	assert.ok(doc.includes("16838twips"), "twips-based page size in mso conditional");
-	// Colgroups injected so fixed-layout tables have deterministic column widths
-	assert.ok(doc.includes('<colgroup>'), "colgroup injected on tables");
-});
-
-test("writeReports writes both files to disk", async () => {
-	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-rep-"));
-	const r = await writeReports({
-		cveMatches: sampleMatches,
-		eolResults: [{ dep: { groupId: "org.hibernate", artifactId: "hibernate-core", version: "5.6" }, product: "Hibernate ORM", eol: "2025-08-08" }],
-		obsoleteResults: [{ dep: { groupId: "log4j", artifactId: "log4j", version: "1.2" }, severity: "CRITICAL", replacement: "log4j-core 2.x" }],
-		outdatedResults: [],
-		projectInfo,
-		outputDir: tmp,
-	});
-	assert.ok(fs.existsSync(r.htmlPath));
-	assert.ok(fs.existsSync(r.docPath));
-	const html = fs.readFileSync(r.htmlPath, "utf8");
-	assert.ok(html.includes("Hibernate ORM"));
-	assert.ok(html.includes("log4j:log4j"));
-	fs.rmSync(tmp, { recursive: true, force: true });
-});

package/test/fixtures/complex-enterprise/api/pom.xml

@@ -1,32 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme.enterprise</groupId>
-		<artifactId>enterprise-root</artifactId>
-		<version>4.2.1</version>
-		<relativePath>..</relativePath>
-	</parent>
-	<artifactId>api</artifactId>
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>com.acme.enterprise</groupId>
-				<artifactId>build-bom</artifactId>
-				<version>4.2.1</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-	<dependencies>
-		<dependency>
-			<groupId>com.fasterxml.jackson.core</groupId>
-			<artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>com.acme.private</groupId>
-			<artifactId>acme-commons</artifactId>
-		</dependency>
-	</dependencies>
-</project>

package/test/fixtures/complex-enterprise/build/pom.xml

@@ -1,46 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme.enterprise</groupId>
-		<artifactId>enterprise-root</artifactId>
-		<version>4.2.1</version>
-		<relativePath>..</relativePath>
-	</parent>
-	<artifactId>build-bom</artifactId>
-	<packaging>pom</packaging>
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>org.hibernate</groupId>
-				<artifactId>hibernate-core</artifactId>
-				<version>${hibernate.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>${jackson.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.logging.log4j</groupId>
-				<artifactId>log4j-core</artifactId>
-				<version>2.14.0</version>
-			</dependency>
-			<dependency>
-				<groupId>com.acme.private</groupId>
-				<artifactId>acme-commons</artifactId>
-				<version>${acme-commons.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>commons-io</groupId>
-				<artifactId>commons-io</artifactId>
-				<version>2.7</version>
-			</dependency>
-			<dependency>
-				<groupId>org.codehaus.jackson</groupId>
-				<artifactId>jackson-mapper-asl</artifactId>
-				<version>1.9.13</version>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-</project>