fad-checker 1.0.6 → 2.0.1

package/test/fixtures/complex-enterprise/dao/pom.xml

@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme.enterprise</groupId>
-		<artifactId>enterprise-root</artifactId>
-		<version>4.2.1</version>
-		<relativePath>..</relativePath>
-	</parent>
-	<artifactId>dao</artifactId>
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>com.acme.enterprise</groupId>
-				<artifactId>build-bom</artifactId>
-				<version>4.2.1</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-	<dependencies>
-		<dependency>
-			<groupId>org.hibernate</groupId>
-			<artifactId>hibernate-core</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.apache.commons</groupId>
-			<artifactId>commons-lang3</artifactId>
-			<version>3.12.0</version>
-		</dependency>
-		<dependency>
-			<groupId>commons-io</groupId>
-			<artifactId>commons-io</artifactId>
-		</dependency>
-	</dependencies>
-</project>

package/test/fixtures/complex-enterprise/pom.xml

@@ -1,66 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>org.springframework.boot</groupId>
-		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>2.7.18</version>
-	</parent>
-	<groupId>com.acme.enterprise</groupId>
-	<artifactId>enterprise-root</artifactId>
-	<version>4.2.1</version>
-	<packaging>pom</packaging>
-	<modules>
-		<module>build</module>
-		<module>api</module>
-		<module>dao</module>
-		<module>web</module>
-	</modules>
-	<properties>
-		<java.version>17</java.version>
-		<hibernate.version>5.6.15.Final</hibernate.version>
-		<jackson.version>2.13.5</jackson.version>
-		<acme-commons.version>3.0.0</acme-commons.version>
-	</properties>
-	<profiles>
-		<profile>
-			<id>dev</id>
-			<activation>
-				<activeByDefault>true</activeByDefault>
-			</activation>
-			<properties>
-				<env.profile>dev</env.profile>
-			</properties>
-			<dependencies>
-				<dependency>
-					<groupId>com.h2database</groupId>
-					<artifactId>h2</artifactId>
-					<version>2.2.224</version>
-				</dependency>
-			</dependencies>
-		</profile>
-		<profile>
-			<id>prod</id>
-			<properties>
-				<env.profile>prod</env.profile>
-			</properties>
-			<dependencies>
-				<dependency>
-					<groupId>org.postgresql</groupId>
-					<artifactId>postgresql</artifactId>
-					<version>42.6.0</version>
-				</dependency>
-			</dependencies>
-		</profile>
-		<profile>
-			<id>oracle</id>
-			<dependencies>
-				<dependency>
-					<groupId>com.acme.private</groupId>
-					<artifactId>acme-oracle-driver</artifactId>
-					<version>1.2.3</version>
-				</dependency>
-			</dependencies>
-		</profile>
-	</profiles>
-</project>

package/test/fixtures/complex-enterprise/web/pom.xml

@@ -1,77 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme.enterprise</groupId>
-		<artifactId>enterprise-root</artifactId>
-		<version>4.2.1</version>
-		<relativePath>..</relativePath>
-	</parent>
-	<artifactId>web</artifactId>
-	<packaging>war</packaging>
-	<profiles>
-		<profile>
-			<id>tomcat</id>
-			<activation>
-				<activeByDefault>true</activeByDefault>
-			</activation>
-			<properties>
-				<servlet.container>tomcat</servlet.container>
-			</properties>
-			<dependencies>
-				<dependency>
-					<groupId>org.apache.tomcat.embed</groupId>
-					<artifactId>tomcat-embed-core</artifactId>
-					<version>9.0.83</version>
-				</dependency>
-			</dependencies>
-		</profile>
-		<profile>
-			<id>jetty</id>
-			<dependencies>
-				<dependency>
-					<groupId>org.eclipse.jetty</groupId>
-					<artifactId>jetty-server</artifactId>
-					<version>9.4.51.v20230217</version>
-				</dependency>
-			</dependencies>
-		</profile>
-	</profiles>
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>com.acme.enterprise</groupId>
-				<artifactId>build-bom</artifactId>
-				<version>4.2.1</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-	<dependencies>
-		<dependency>
-			<groupId>com.acme.enterprise</groupId>
-			<artifactId>api</artifactId>
-			<version>4.2.1</version>
-		</dependency>
-		<dependency>
-			<groupId>com.acme.enterprise</groupId>
-			<artifactId>dao</artifactId>
-			<version>4.2.1</version>
-		</dependency>
-		<dependency>
-			<groupId>org.apache.logging.log4j</groupId>
-			<artifactId>log4j-core</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.codehaus.jackson</groupId>
-			<artifactId>jackson-mapper-asl</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<version>4.13.2</version>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-</project>

package/test/fixtures/cve-samples/cve-non-java.json

@@ -1,19 +0,0 @@
-{
-  "cveMetadata": {
-    "cveId": "CVE-2024-00001"
-  },
-  "containers": {
-    "cna": {
-      "descriptions": [{ "lang": "en", "value": "Some npm package vulnerability — should be excluded from Maven index." }],
-      "metrics": [{ "cvssV3_1": { "baseScore": 5.0, "baseSeverity": "MEDIUM" } }],
-      "affected": [
-        {
-          "vendor": "npm-vendor",
-          "product": "left-pad",
-          "collectionURL": "https://registry.npmjs.org",
-          "versions": [{ "version": "1.0.0", "status": "affected", "lessThan": "1.3.0" }]
-        }
-      ]
-    }
-  }
-}

package/test/fixtures/cve-samples/cve-product-only.json

@@ -1,31 +0,0 @@
-{
-  "cveMetadata": {
-    "cveId": "CVE-2017-5638",
-    "datePublished": "2017-03-10T00:00:00Z"
-  },
-  "containers": {
-    "cna": {
-      "descriptions": [
-        { "lang": "en", "value": "Apache Struts 2 Jakarta Multipart parser arbitrary OS command execution." }
-      ],
-      "metrics": [
-        {
-          "cvssV3_1": {
-            "baseScore": 9.8,
-            "baseSeverity": "CRITICAL"
-          }
-        }
-      ],
-      "affected": [
-        {
-          "vendor": "apache",
-          "product": "struts2-core",
-          "versions": [
-            { "version": "2.3.5", "status": "affected", "lessThan": "2.3.32", "versionType": "maven" },
-            { "version": "2.5.0", "status": "affected", "lessThan": "2.5.10.1", "versionType": "maven" }
-          ]
-        }
-      ]
-    }
-  }
-}

package/test/fixtures/cve-samples/cve-with-packagename.json

@@ -1,37 +0,0 @@
-{
-  "cveMetadata": {
-    "cveId": "CVE-2021-44228",
-    "datePublished": "2021-12-10T00:00:00Z"
-  },
-  "containers": {
-    "cna": {
-      "descriptions": [
-        { "lang": "en", "value": "Apache Log4j2 JNDI features used in configuration do not protect against attacker controlled LDAP and other JNDI related endpoints. (Log4Shell)" }
-      ],
-      "metrics": [
-        {
-          "cvssV3_1": {
-            "baseScore": 10.0,
-            "baseSeverity": "CRITICAL"
-          }
-        }
-      ],
-      "affected": [
-        {
-          "vendor": "apache",
-          "product": "log4j-core",
-          "packageName": "org.apache.logging.log4j:log4j-core",
-          "collectionURL": "https://repo.maven.apache.org/maven2",
-          "versions": [
-            {
-              "version": "2.0",
-              "status": "affected",
-              "versionType": "maven",
-              "lessThan": "2.15.0"
-            }
-          ]
-        }
-      ]
-    }
-  }
-}

package/test/fixtures/cve-samples/nvd-log4shell.json

@@ -1,40 +0,0 @@
-{
-	"id": "CVE-2021-44228",
-	"published": "2021-12-10T00:00:00Z",
-	"lastModified": "2022-04-01T00:00:00Z",
-	"descriptions": [
-		{ "lang": "en", "value": "Apache Log4j2 JNDI features used in configuration do not protect against attacker controlled LDAP and other JNDI related endpoints." }
-	],
-	"metrics": {
-		"cvssMetricV31": [
-			{
-				"cvssData": {
-					"baseScore": 10.0,
-					"baseSeverity": "CRITICAL",
-					"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
-				}
-			}
-		]
-	},
-	"references": [
-		{ "url": "https://logging.apache.org/log4j/2.x/security.html", "tags": ["Vendor Advisory"] }
-	],
-	"configurations": [
-		{
-			"operator": "OR",
-			"nodes": [
-				{
-					"operator": "OR",
-					"cpeMatch": [
-						{
-							"vulnerable": true,
-							"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
-							"versionStartIncluding": "2.0.0",
-							"versionEndExcluding": "2.15.0"
-						}
-					]
-				}
-			]
-		}
-	]
-}

package/test/fixtures/cve-samples/nvd-npm-lodash.json

@@ -1,22 +0,0 @@
-{
-	"id": "CVE-2019-10744",
-	"published": "2019-07-26T00:00:00Z",
-	"descriptions": [{ "lang": "en", "value": "Prototype pollution in lodash defaultsDeep." }],
-	"metrics": {
-		"cvssMetricV31": [{ "cvssData": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N" } }]
-	},
-	"references": [{ "url": "https://github.com/lodash/lodash/pull/4336", "tags": ["Patch"] }],
-	"configurations": [
-		{
-			"operator": "OR",
-			"nodes": [
-				{
-					"operator": "OR",
-					"cpeMatch": [
-						{ "vulnerable": true, "criteria": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "4.17.12" }
-					]
-				}
-			]
-		}
-	]
-}

package/test/fixtures/monorepo-mixed/libs/common-bom/pom.xml

@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme</groupId>
-		<artifactId>monorepo-parent</artifactId>
-		<version>1.0.0</version>
-		<relativePath>../../pom.xml</relativePath>
-	</parent>
-	<artifactId>common-bom</artifactId>
-	<packaging>pom</packaging>
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>com.fasterxml.jackson.core</groupId>
-				<artifactId>jackson-databind</artifactId>
-				<version>${jackson.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.apache.logging.log4j</groupId>
-				<artifactId>log4j-core</artifactId>
-				<version>${log4j.version}</version>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-</project>

package/test/fixtures/monorepo-mixed/packages/cli/package.json

@@ -1,14 +0,0 @@
-{
-	"name": "@acme/cli",
-	"version": "0.5.0",
-	"private": true,
-	"dependencies": {
-		"minimist": "1.2.5",
-		"node-fetch": "2.6.6",
-		"chalk": "4.1.2",
-		"@acme/private-utils": "1.0.0"
-	},
-	"devDependencies": {
-		"mocha": "9.0.0"
-	}
-}

package/test/fixtures/monorepo-mixed/packages/cli/yarn.lock

@@ -1,41 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-"@acme/private-utils@1.0.0":
-  version "1.0.0"
-  resolved "https://npm.acme.internal/@acme/private-utils/-/private-utils-1.0.0.tgz"
-  integrity sha512-private-fake-hash
-
-chalk@4.1.2:
-  version "4.1.2"
-  resolved "https://registry.yarnpkg.com/chalk/-/chalk-4.1.2.tgz"
-  integrity sha512-fake-chalk-hash
-  dependencies:
-    ansi-styles "^4.1.0"
-    supports-color "^7.1.0"
-
-ansi-styles@^4.1.0:
-  version "4.3.0"
-  resolved "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-4.3.0.tgz"
-  integrity sha512-fake-ansi-hash
-
-supports-color@^7.1.0:
-  version "7.2.0"
-  resolved "https://registry.yarnpkg.com/supports-color/-/supports-color-7.2.0.tgz"
-  integrity sha512-fake-supports-hash
-
-mocha@9.0.0:
-  version "9.0.0"
-  resolved "https://registry.yarnpkg.com/mocha/-/mocha-9.0.0.tgz"
-  integrity sha512-fake-mocha-hash
-
-minimist@1.2.5:
-  version "1.2.5"
-  resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz"
-  integrity sha512-fake-minimist-hash
-
-node-fetch@2.6.6:
-  version "2.6.6"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.6.tgz"
-  integrity sha512-fake-nodefetch-hash

package/test/fixtures/monorepo-mixed/packages/no-lock/package.json

@@ -1,9 +0,0 @@
-{
-	"name": "@acme/no-lock",
-	"version": "0.1.0",
-	"private": true,
-	"dependencies": {
-		"left-pad": "^1.0.0",
-		"chalk": "^4.0.0"
-	}
-}

package/test/fixtures/monorepo-mixed/packages/web-app/package-lock.json

@@ -1,71 +0,0 @@
-{
-	"name": "@acme/web-app",
-	"version": "1.0.0",
-	"lockfileVersion": 3,
-	"requires": true,
-	"packages": {
-		"": {
-			"name": "@acme/web-app",
-			"version": "1.0.0",
-			"dependencies": {
-				"axios": "0.21.0",
-				"lodash": "4.17.15",
-				"express": "4.17.1"
-			},
-			"devDependencies": {
-				"jest": "27.0.0",
-				"eslint": "7.32.0"
-			},
-			"peerDependencies": {
-				"react": "17.0.2"
-			}
-		},
-		"node_modules/axios": {
-			"version": "0.21.0",
-			"resolved": "https://registry.npmjs.org/axios/-/axios-0.21.0.tgz",
-			"integrity": "sha512-fakehash1",
-			"dependencies": { "follow-redirects": "1.13.0" }
-		},
-		"node_modules/follow-redirects": {
-			"version": "1.13.0",
-			"resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz",
-			"integrity": "sha512-fakehash2"
-		},
-		"node_modules/lodash": {
-			"version": "4.17.15",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
-			"integrity": "sha512-fakehash3"
-		},
-		"node_modules/express": {
-			"version": "4.17.1",
-			"resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz",
-			"integrity": "sha512-fakehash4",
-			"dependencies": {
-				"qs": "6.7.0"
-			}
-		},
-		"node_modules/qs": {
-			"version": "6.7.0",
-			"resolved": "https://registry.npmjs.org/qs/-/qs-6.7.0.tgz",
-			"integrity": "sha512-fakehash5"
-		},
-		"node_modules/jest": {
-			"version": "27.0.0",
-			"dev": true,
-			"resolved": "https://registry.npmjs.org/jest/-/jest-27.0.0.tgz",
-			"integrity": "sha512-fakehash6"
-		},
-		"node_modules/eslint": {
-			"version": "7.32.0",
-			"dev": true,
-			"resolved": "https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz",
-			"integrity": "sha512-fakehash7"
-		},
-		"node_modules/react": {
-			"version": "17.0.2",
-			"peer": true,
-			"resolved": "https://registry.npmjs.org/react/-/react-17.0.2.tgz",
-			"integrity": "sha512-fakehash8"
-		}
-	}
-}

package/test/fixtures/monorepo-mixed/packages/web-app/package.json

@@ -1,17 +0,0 @@
-{
-	"name": "@acme/web-app",
-	"version": "1.0.0",
-	"private": true,
-	"dependencies": {
-		"axios": "0.21.0",
-		"lodash": "4.17.15",
-		"express": "4.17.1"
-	},
-	"devDependencies": {
-		"jest": "27.0.0",
-		"eslint": "7.32.0"
-	},
-	"peerDependencies": {
-		"react": "17.0.2"
-	}
-}

package/test/fixtures/monorepo-mixed/pom.xml

@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<groupId>com.acme</groupId>
-	<artifactId>monorepo-parent</artifactId>
-	<version>1.0.0</version>
-	<packaging>pom</packaging>
-	<modules>
-		<module>services/api</module>
-		<module>services/worker</module>
-		<module>libs/common-bom</module>
-	</modules>
-	<properties>
-		<jackson.version>2.9.10</jackson.version>
-		<log4j.version>2.14.0</log4j.version>
-		<spring.version>5.3.20</spring.version>
-	</properties>
-	<dependencyManagement>
-		<dependencies>
-			<dependency>
-				<groupId>com.acme</groupId>
-				<artifactId>common-bom</artifactId>
-				<version>1.0.0</version>
-				<type>pom</type>
-				<scope>import</scope>
-			</dependency>
-		</dependencies>
-	</dependencyManagement>
-</project>

package/test/fixtures/monorepo-mixed/services/api/pom.xml

@@ -1,27 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme</groupId>
-		<artifactId>monorepo-parent</artifactId>
-		<version>1.0.0</version>
-		<relativePath>../../pom.xml</relativePath>
-	</parent>
-	<artifactId>api</artifactId>
-	<dependencies>
-		<dependency>
-			<groupId>com.fasterxml.jackson.core</groupId>
-			<artifactId>jackson-databind</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.springframework</groupId>
-			<artifactId>spring-web</artifactId>
-			<version>${spring.version}</version>
-		</dependency>
-		<dependency>
-			<groupId>com.acme.private</groupId>
-			<artifactId>internal-auth</artifactId>
-			<version>1.2.3</version>
-		</dependency>
-	</dependencies>
-</project>

package/test/fixtures/monorepo-mixed/services/worker/pom.xml

@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.acme</groupId>
-		<artifactId>monorepo-parent</artifactId>
-		<version>1.0.0</version>
-		<relativePath>../../pom.xml</relativePath>
-	</parent>
-	<artifactId>worker</artifactId>
-	<dependencies>
-		<dependency>
-			<groupId>org.apache.logging.log4j</groupId>
-			<artifactId>log4j-core</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.yaml</groupId>
-			<artifactId>snakeyaml</artifactId>
-			<version>1.30</version>
-		</dependency>
-		<dependency>
-			<groupId>junit</groupId>
-			<artifactId>junit</artifactId>
-			<version>4.12</version>
-			<scope>test</scope>
-		</dependency>
-	</dependencies>
-</project>

package/test/fixtures/private-lib-detection/core/pom.xml

@@ -1,26 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.client.app</groupId>
-		<artifactId>secret-monolith</artifactId>
-		<version>1.0.0</version>
-		<relativePath>..</relativePath>
-	</parent>
-	<artifactId>core</artifactId>
-	<dependencies>
-		<dependency>
-			<groupId>org.springframework</groupId>
-			<artifactId>spring-context</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>com.client.private</groupId>
-			<artifactId>secret-lib</artifactId>
-		</dependency>
-		<dependency>
-			<groupId>org.megacorp.private</groupId>
-			<artifactId>megacorp-utils</artifactId>
-			<version>2.1.0</version>
-		</dependency>
-	</dependencies>
-</project>

package/test/fixtures/private-lib-detection/plugin/pom.xml

@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0">
-	<modelVersion>4.0.0</modelVersion>
-	<parent>
-		<groupId>com.client.app</groupId>
-		<artifactId>secret-monolith</artifactId>
-		<version>1.0.0</version>
-		<relativePath>..</relativePath>
-	</parent>
-	<artifactId>plugin</artifactId>
-	<dependencies>
-		<dependency>
-			<groupId>com.client.app</groupId>
-			<artifactId>core</artifactId>
-			<version>1.0.0</version>
-		</dependency>
-		<dependency>
-			<groupId>com.googlecode.json-simple</groupId>
-			<artifactId>json-simple</artifactId>
-			<version>1.1.1</version>
-		</dependency>
-	</dependencies>
-</project>