fad-checker 2.0.0 → 2.0.1

package/test/pypi.test.js

@@ -1,72 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert");
-const path = require("path");
-const { pep503, parsePoetryLock, parsePipfileLock, parseUvLock, parseRequirementsTxt } = require("../lib/codecs/pypi/parse");
-
-const F = n => path.join(__dirname, "fixtures", n);
-
-test("pep503 normalizes names (lowercase, collapse separators to -)", () => {
-	assert.strictEqual(pep503("Flask-SQLAlchemy"), "flask-sqlalchemy");
-	assert.strictEqual(pep503("zope.interface"), "zope-interface");
-	assert.strictEqual(pep503("My__Pkg"), "my-pkg");
-});
-
-test("parsePoetryLock returns PEP503 names + versions", () => {
-	const r = parsePoetryLock(F("python-poetry/poetry.lock"));
-	const m = Object.fromEntries(r.deps.map(d => [d.name, d.version]));
-	assert.strictEqual(m["requests"], "2.31.0");
-	assert.strictEqual(m["flask-sqlalchemy"], "3.0.5");   // normalized
-});
-
-test("parsePipfileLock splits default/develop, strips ==", () => {
-	const r = parsePipfileLock(F("python-pipenv/Pipfile.lock"));
-	const m = Object.fromEntries(r.deps.map(d => [d.name, d]));
-	assert.strictEqual(m["django"].version, "4.2.0");
-	assert.strictEqual(m["django"].scope, "prod");
-	assert.strictEqual(m["pytest"].scope, "dev");
-});
-
-test("parseUvLock reads [[package]]", () => {
-	const r = parseUvLock(F("python-uv/uv.lock"));
-	assert.strictEqual(r.deps.find(d => d.name === "numpy").version, "1.26.0");
-});
-
-test("parseRequirementsTxt keeps == pins, skips ranges/flags/comments", () => {
-	const r = parseRequirementsTxt(F("python-reqs/requirements.txt"));
-	const names = r.deps.map(d => d.name).sort();
-	assert.deepStrictEqual(names, ["fastapi", "urllib3"]);
-	assert.strictEqual(r.skipped, 1);   // flask>=2.0
-});
-
-const { pypiToFindings } = require("../lib/codecs/pypi/registry");
-test("pypiToFindings extracts latest, yanked-for-version, inactive classifier", () => {
-	const data = {
-		info: { version: "2.1.0", classifiers: ["Development Status :: 7 - Inactive"] },
-		releases: { "2.0.4": [{ yanked: true, yanked_reason: "security" }], "2.1.0": [{ yanked: false }] },
-	};
-	const f = pypiToFindings(data, { version: "2.0.4" });
-	assert.strictEqual(f.outdated.latest, "2.1.0");
-	assert.strictEqual(f.yanked.reason, "security");
-	assert.strictEqual(f.inactive, true);
-	const f2 = pypiToFindings(data, { version: "2.1.0" });
-	assert.strictEqual(f2.yanked, null);
-	assert.strictEqual(f2.outdated, null);
-});
-
-const pypi = require("../lib/codecs/pypi.codec");
-const { assertCodecShape } = require("../lib/codecs/codec.interface");
-test("pypi codec: shape, detect, collect, coordKey pypi:<name>", async () => {
-	assertCodecShape(pypi);
-	assert.strictEqual(pypi.detect(F("python-poetry")), true);
-	const { deps } = await pypi.collect(F("python-poetry"), {});
-	const r = deps.get("pypi:requests");
-	assert.ok(r);
-	assert.strictEqual(r.ecosystem, "pypi");
-	assert.strictEqual(pypi.osvPackageName(r), "requests");
-});
-test("pypi collect: requirements.txt fallback warns + scans pins only", async () => {
-	const { deps, warnings } = await pypi.collect(F("python-reqs"), {});
-	assert.ok(deps.has("pypi:fastapi"));
-	assert.ok(!deps.has("pypi:flask"));
-	assert.ok(warnings.find(w => w.type === "no-lockfile"));
-});

package/test/snyk.test.js

@@ -1,64 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const { parseSnykResults, parseSnykStdout, mergeWithFadResults } = require("../lib/snyk");
-
-const snykSample = {
-	vulnerabilities: [
-		{
-			id: "SNYK-JAVA-LOG4J-2314720",
-			packageName: "org.apache.logging.log4j:log4j-core",
-			version: "2.14.0",
-			severity: "critical",
-			cvssScore: 10,
-			title: "Remote Code Execution",
-			fixedIn: ["2.15.0", "2.16.0"],
-			identifiers: { CVE: ["CVE-2021-44228"] },
-		},
-		{
-			id: "SNYK-JAVA-JACKSON-2421244",
-			packageName: "com.fasterxml.jackson.core:jackson-databind",
-			version: "2.13.0",
-			severity: "high",
-			cvssScore: 7.5,
-			title: "Denial of Service",
-			fixedIn: ["2.13.5"],
-			identifiers: { CVE: ["CVE-2022-42003"] },
-		},
-	],
-};
-
-test("parseSnykStdout accepts a JSON object or array", () => {
-	assert.deepEqual(parseSnykStdout(""), []);
-	const arr = parseSnykStdout(JSON.stringify([snykSample]));
-	assert.equal(arr.length, 1);
-	const obj = parseSnykStdout(JSON.stringify(snykSample));
-	assert.equal(obj.length, 1);
-});
-
-test("parseSnykResults normalises to fad-checker match shape", () => {
-	const out = parseSnykResults(snykSample);
-	assert.equal(out.length, 2);
-	assert.equal(out[0].dep.groupId, "org.apache.logging.log4j");
-	assert.equal(out[0].dep.artifactId, "log4j-core");
-	assert.equal(out[0].cve.id, "CVE-2021-44228");
-	assert.equal(out[0].cve.severity, "CRITICAL");
-	assert.equal(out[0].cve.fixVersion, "2.15.0");
-	assert.equal(out[0].source, "snyk");
-});
-
-test("mergeWithFadResults tags overlap as 'both' and keeps Snyk-only as 'snyk'", () => {
-	const fadMatches = [
-		{
-			dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0" },
-			cve: { id: "CVE-2021-44228", severity: "CRITICAL" },
-			confidence: "exact",
-		},
-	];
-	const snykMatches = parseSnykResults(snykSample);
-	const merged = mergeWithFadResults(fadMatches, snykMatches);
-	assert.equal(merged.length, 2);
-	const log4j = merged.find(m => m.cve.id === "CVE-2021-44228");
-	assert.equal(log4j.source, "both");
-	const jackson = merged.find(m => m.cve.id === "CVE-2022-42003");
-	assert.equal(jackson.source, "snyk");
-});

package/test/transitive.test.js

@@ -1,305 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("fs");
-const os = require("os");
-const path = require("path");
-const { parsePomXml, resolveProps, buildMgmt, SCOPE_MATRIX, resolveTransitiveDeps } = require("../lib/transitive");
-
-// Per-test cache dir so we don't poison ~/.fad-checker/poms-cache during tests
-function freshCache() {
-	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-pom-cache-"));
-	return dir;
-}
-
-// ---------- POM fixtures expressed as XML strings ----------
-
-const POM_A = `<?xml version="1.0"?>
-<project>
-	<modelVersion>4.0.0</modelVersion>
-	<groupId>com.example</groupId>
-	<artifactId>a</artifactId>
-	<version>1.0.0</version>
-	<dependencies>
-		<dependency>
-			<groupId>com.example</groupId>
-			<artifactId>b</artifactId>
-			<version>2.0.0</version>
-		</dependency>
-		<dependency>
-			<groupId>com.example</groupId>
-			<artifactId>test-only</artifactId>
-			<version>3.0.0</version>
-			<scope>test</scope>
-		</dependency>
-		<dependency>
-			<groupId>com.example</groupId>
-			<artifactId>optional-lib</artifactId>
-			<version>4.0.0</version>
-			<optional>true</optional>
-		</dependency>
-	</dependencies>
-</project>`;
-
-const POM_B = `<?xml version="1.0"?>
-<project>
-	<modelVersion>4.0.0</modelVersion>
-	<groupId>com.example</groupId>
-	<artifactId>b</artifactId>
-	<version>2.0.0</version>
-	<dependencies>
-		<dependency>
-			<groupId>com.example</groupId>
-			<artifactId>c</artifactId>
-			<version>5.0.0</version>
-		</dependency>
-	</dependencies>
-</project>`;
-
-const POM_C = `<?xml version="1.0"?>
-<project>
-	<modelVersion>4.0.0</modelVersion>
-	<groupId>com.example</groupId>
-	<artifactId>c</artifactId>
-	<version>5.0.0</version>
-</project>`;
-
-// Build an in-memory fetcher
-function fakeFetcher(responses) {
-	return async (url) => {
-		if (responses[url]) {
-			return { ok: true, status: 200, text: async () => responses[url] };
-		}
-		return { ok: false, status: 404, text: async () => "" };
-	};
-}
-
-const MC = "https://repo1.maven.org/maven2";
-
-// ---------- Tests ----------
-
-test("parsePomXml extracts coords, deps, scope, optional, exclusions", async () => {
-	const xml = `<?xml version="1.0"?>
-		<project>
-			<groupId>g</groupId><artifactId>a</artifactId><version>1</version>
-			<dependencies>
-				<dependency>
-					<groupId>org.foo</groupId><artifactId>bar</artifactId><version>2.0</version>
-					<scope>runtime</scope><optional>true</optional>
-					<exclusions>
-						<exclusion><groupId>x</groupId><artifactId>y</artifactId></exclusion>
-					</exclusions>
-				</dependency>
-			</dependencies>
-		</project>`;
-	const pom = await parsePomXml(xml);
-	assert.equal(pom.groupId, "g");
-	assert.equal(pom.deps[0].scope, "runtime");
-	assert.equal(pom.deps[0].optional, true);
-	assert.deepEqual(pom.deps[0].exclusions, [{ groupId: "x", artifactId: "y" }]);
-});
-
-test("parsePomXml handles parent + inherits groupId/version from it", async () => {
-	const xml = `<?xml version="1.0"?>
-		<project>
-			<parent><groupId>g</groupId><artifactId>p</artifactId><version>3.0</version></parent>
-			<artifactId>child</artifactId>
-		</project>`;
-	const pom = await parsePomXml(xml);
-	assert.equal(pom.groupId, "g");
-	assert.equal(pom.version, "3.0");
-	assert.equal(pom.parent.artifactId, "p");
-});
-
-test("resolveProps substitutes ${prop} including project.* builtins", () => {
-	const props = { "spring.version": "5.3.20", "log4j": "2.20.0" };
-	const builtins = { "project.version": "1.0" };
-	assert.equal(resolveProps("${spring.version}", props, builtins), "5.3.20");
-	assert.equal(resolveProps("${project.version}", props, builtins), "1.0");
-	assert.equal(resolveProps("v=${log4j}", props, builtins), "v=2.20.0");
-	assert.equal(resolveProps("${unknown}", props, builtins), "${unknown}");
-});
-
-test("resolveProps follows chained property references", () => {
-	const props = { a: "${b}", b: "${c}", c: "final" };
-	assert.equal(resolveProps("${a}", props, {}), "final");
-});
-
-test("SCOPE_MATRIX implements Maven's scope-propagation rules", () => {
-	// compile direct + compile transitive → compile
-	assert.equal(SCOPE_MATRIX.compile.compile, "compile");
-	// compile + runtime → runtime
-	assert.equal(SCOPE_MATRIX.compile.runtime, "runtime");
-	// compile + test → not propagated
-	assert.equal(SCOPE_MATRIX.compile.test, null);
-	// test + compile → test
-	assert.equal(SCOPE_MATRIX.test.compile, "test");
-	// provided + runtime → provided
-	assert.equal(SCOPE_MATRIX.provided.runtime, "provided");
-});
-
-test("buildMgmt indexes depMgmt by g:a", () => {
-	const m = buildMgmt([
-		{ groupId: "g", artifactId: "a", version: "1.0" },
-		{ groupId: "h", artifactId: "b", version: "2.0" },
-	]);
-	assert.equal(m.size, 2);
-	assert.equal(m.get("g:a").version, "1.0");
-});
-
-test("resolveTransitiveDeps walks A→B→C, skips test + optional", async () => {
-	const responses = {
-		[`${MC}/com/example/a/1.0.0/a-1.0.0.pom`]: POM_A,
-		[`${MC}/com/example/b/2.0.0/b-2.0.0.pom`]: POM_B,
-		[`${MC}/com/example/c/5.0.0/c-5.0.0.pom`]: POM_C,
-	};
-	const transitives = await resolveTransitiveDeps(
-		[{ groupId: "com.example", artifactId: "a", version: "1.0.0", scope: "compile" }],
-		{ fetcher: fakeFetcher(responses), verbose: false, cacheDir: freshCache() }
-	);
-	// b is the direct dep of a → it IS a transitive (we excluded `a` itself
-	// from the result earlier). c is b's transitive.
-	const keys = [...transitives.keys()];
-	assert.ok(keys.includes("com.example:b"), `expected b in transitives, got ${keys.join(",")}`);
-	assert.ok(keys.includes("com.example:c"), `expected c in transitives, got ${keys.join(",")}`);
-	// test scope must NOT propagate
-	assert.ok(!keys.includes("com.example:test-only"), "test-scope dep should not propagate");
-	// optional must NOT propagate
-	assert.ok(!keys.includes("com.example:optional-lib"), "optional dep should not propagate");
-});
-
-test("resolveTransitiveDeps applies root depMgmt version overrides", async () => {
-	const POM_X = `<?xml version="1.0"?>
-		<project>
-			<groupId>g</groupId><artifactId>x</artifactId><version>1.0</version>
-			<dependencies>
-				<dependency>
-					<groupId>g</groupId><artifactId>y</artifactId><version>5.0</version>
-				</dependency>
-			</dependencies>
-		</project>`;
-	const POM_Y_5 = `<?xml version="1.0"?>
-		<project><groupId>g</groupId><artifactId>y</artifactId><version>5.0</version></project>`;
-	const POM_Y_OVERRIDE = `<?xml version="1.0"?>
-		<project><groupId>g</groupId><artifactId>y</artifactId><version>9.9</version></project>`;
-	const responses = {
-		[`${MC}/g/x/1.0/x-1.0.pom`]: POM_X,
-		[`${MC}/g/y/5.0/y-5.0.pom`]: POM_Y_5,
-		[`${MC}/g/y/9.9/y-9.9.pom`]: POM_Y_OVERRIDE,
-	};
-	const rootMgmt = new Map([["g:y", { version: "9.9" }]]);
-	const transitives = await resolveTransitiveDeps(
-		[{ groupId: "g", artifactId: "x", version: "1.0", scope: "compile" }],
-		{ fetcher: fakeFetcher(responses), rootDepMgmt: rootMgmt, verbose: false, cacheDir: freshCache() }
-	);
-	const y = transitives.get("g:y");
-	assert.ok(y, "y should be resolved");
-	assert.equal(y.version, "9.9", "root depMgmt should override transitive declared version");
-});
-
-test("resolveTransitiveDeps honours <exclusion> blocks", async () => {
-	const POM_ROOT = `<?xml version="1.0"?>
-		<project>
-			<groupId>g</groupId><artifactId>root</artifactId><version>1</version>
-			<dependencies>
-				<dependency>
-					<groupId>g</groupId><artifactId>mid</artifactId><version>1</version>
-					<exclusions>
-						<exclusion><groupId>g</groupId><artifactId>leaf</artifactId></exclusion>
-					</exclusions>
-				</dependency>
-			</dependencies>
-		</project>`;
-	const POM_MID = `<?xml version="1.0"?>
-		<project>
-			<groupId>g</groupId><artifactId>mid</artifactId><version>1</version>
-			<dependencies>
-				<dependency><groupId>g</groupId><artifactId>leaf</artifactId><version>1</version></dependency>
-				<dependency><groupId>g</groupId><artifactId>kept</artifactId><version>1</version></dependency>
-			</dependencies>
-		</project>`;
-	const POM_LEAF = `<?xml version="1.0"?>
-		<project><groupId>g</groupId><artifactId>leaf</artifactId><version>1</version></project>`;
-	const POM_KEPT = `<?xml version="1.0"?>
-		<project><groupId>g</groupId><artifactId>kept</artifactId><version>1</version></project>`;
-	const responses = {
-		[`${MC}/g/root/1/root-1.pom`]: POM_ROOT,
-		[`${MC}/g/mid/1/mid-1.pom`]: POM_MID,
-		[`${MC}/g/leaf/1/leaf-1.pom`]: POM_LEAF,
-		[`${MC}/g/kept/1/kept-1.pom`]: POM_KEPT,
-	};
-	const transitives = await resolveTransitiveDeps(
-		[{ groupId: "g", artifactId: "root", version: "1", scope: "compile", exclusions: [{ groupId: "g", artifactId: "leaf" }] }],
-		{ fetcher: fakeFetcher(responses), verbose: false, cacheDir: freshCache() }
-	);
-	const keys = [...transitives.keys()];
-	assert.ok(keys.includes("g:mid"), "mid should be there");
-	assert.ok(keys.includes("g:kept"), "kept should be there");
-	assert.ok(!keys.includes("g:leaf"), `leaf should be excluded, got ${keys.join(",")}`);
-});
-
-test("resolveTransitiveDeps stops at maxDepth", async () => {
-	const POM_R = `<?xml version="1.0"?><project>
-		<groupId>g</groupId><artifactId>r</artifactId><version>1</version>
-		<dependencies><dependency><groupId>g</groupId><artifactId>l1</artifactId><version>1</version></dependency></dependencies>
-	</project>`;
-	const POM_L1 = `<?xml version="1.0"?><project>
-		<groupId>g</groupId><artifactId>l1</artifactId><version>1</version>
-		<dependencies><dependency><groupId>g</groupId><artifactId>l2</artifactId><version>1</version></dependency></dependencies>
-	</project>`;
-	const POM_L2 = `<?xml version="1.0"?><project>
-		<groupId>g</groupId><artifactId>l2</artifactId><version>1</version>
-		<dependencies><dependency><groupId>g</groupId><artifactId>l3</artifactId><version>1</version></dependency></dependencies>
-	</project>`;
-	const POM_L3 = `<?xml version="1.0"?><project><groupId>g</groupId><artifactId>l3</artifactId><version>1</version></project>`;
-	const responses = {
-		[`${MC}/g/r/1/r-1.pom`]: POM_R,
-		[`${MC}/g/l1/1/l1-1.pom`]: POM_L1,
-		[`${MC}/g/l2/1/l2-1.pom`]: POM_L2,
-		[`${MC}/g/l3/1/l3-1.pom`]: POM_L3,
-	};
-	const transitives = await resolveTransitiveDeps(
-		[{ groupId: "g", artifactId: "r", version: "1", scope: "compile" }],
-		{ fetcher: fakeFetcher(responses), maxDepth: 2, cacheDir: freshCache() }
-	);
-	const keys = [...transitives.keys()];
-	assert.ok(keys.includes("g:l1"));
-	assert.ok(keys.includes("g:l2"));
-	assert.ok(!keys.includes("g:l3"), `l3 is at depth 3, should not be present at maxDepth=2; got ${keys.join(",")}`);
-});
-
-test("resolveTransitiveDeps nearest-wins on version conflict", async () => {
-	// root → a@1 → c@5
-	// root → c@9  (declared directly under root via b path)
-	// Result: c@9 wins because it's at depth 1 vs c@5 at depth 2
-	// But here we're testing the BFS, not the root-direct resolution. Setup:
-	// root has two deps: x@1 (which has y@5), and y@9 directly.
-	const POM_ROOT2 = `<?xml version="1.0"?><project>
-		<groupId>g</groupId><artifactId>root</artifactId><version>1</version>
-		<dependencies>
-			<dependency><groupId>g</groupId><artifactId>x</artifactId><version>1</version></dependency>
-			<dependency><groupId>g</groupId><artifactId>y</artifactId><version>9</version></dependency>
-		</dependencies>
-	</project>`;
-	const POM_X2 = `<?xml version="1.0"?><project>
-		<groupId>g</groupId><artifactId>x</artifactId><version>1</version>
-		<dependencies>
-			<dependency><groupId>g</groupId><artifactId>y</artifactId><version>5</version></dependency>
-		</dependencies>
-	</project>`;
-	const POM_Y_5 = `<?xml version="1.0"?><project><groupId>g</groupId><artifactId>y</artifactId><version>5</version></project>`;
-	const POM_Y_9 = `<?xml version="1.0"?><project><groupId>g</groupId><artifactId>y</artifactId><version>9</version></project>`;
-	const responses = {
-		[`${MC}/g/root/1/root-1.pom`]: POM_ROOT2,
-		[`${MC}/g/x/1/x-1.pom`]: POM_X2,
-		[`${MC}/g/y/5/y-5.pom`]: POM_Y_5,
-		[`${MC}/g/y/9/y-9.pom`]: POM_Y_9,
-	};
-	const transitives = await resolveTransitiveDeps([
-		{ groupId: "g", artifactId: "root", version: "1", scope: "compile" },
-	], { fetcher: fakeFetcher(responses), verbose: false, cacheDir: freshCache() });
-	// When the caller (cve-match) passes root's depMgmt with y@9, that pins y.
-	// Without depMgmt, BFS visits y@9 directly under root first, then sees y again
-	// from x, and skips it (nearest-wins).
-	const y = transitives.get("g:y");
-	assert.ok(y, "y should be in transitives");
-});

package/test/webjar.test.js

@@ -1,33 +0,0 @@
-const { test } = require("node:test");
-const assert = require("node:assert/strict");
-const { webjarToNpm } = require("../lib/codecs/npm/collect");
-
-test("webjarToNpm derives the npm name from org.webjars.npm (deterministic mirror)", () => {
-	assert.deepEqual(
-		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "react", version: "18.2.0" }),
-		{ name: "react", version: "18.2.0" },
-	);
-	// Scoped packages encode "@scope/name" as "scope__name".
-	assert.deepEqual(
-		webjarToNpm({ groupId: "org.webjars.npm", artifactId: "angular__core", version: "17.2.3" }),
-		{ name: "@angular/core", version: "17.2.3" },
-	);
-});
-
-test("webjarToNpm passes classic org.webjars artifactIds through as-is", () => {
-	// Classic WebJars are hand-curated; the artifactId is the JS lib name.
-	assert.deepEqual(
-		webjarToNpm({ groupId: "org.webjars", artifactId: "angularjs", version: "1.8.3" }),
-		{ name: "angularjs", version: "1.8.3" },
-	);
-	assert.equal(webjarToNpm({ groupId: "org.webjars", artifactId: "jquery", version: "3.7.1" }).name, "jquery");
-});
-
-test("webjarToNpm handles bower webjars too", () => {
-	assert.equal(webjarToNpm({ groupId: "org.webjars.bowergithub.foo", artifactId: "bar", version: "1.0.0" }).name, "bar");
-});
-
-test("webjarToNpm returns null for non-webjar coordinates", () => {
-	assert.equal(webjarToNpm({ groupId: "org.springframework", artifactId: "spring-core", version: "6.0.0" }), null);
-	assert.equal(webjarToNpm({ ecosystem: "npm", groupId: "", artifactId: "react", version: "18.0.0" }), null);
-});