fad-checker 2.0.0 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (139) hide show
  1. package/CHANGELOG.md +65 -0
  2. package/README.md +147 -25
  3. package/completions/fad-checker.bash +1 -1
  4. package/completions/fad-checker.zsh +14 -1
  5. package/data/eol-mapping.json +5 -5
  6. package/data/license-policy.json +97 -0
  7. package/fad-checker-report/cve-report.doc +630 -0
  8. package/fad-checker-report/cve-report.html +748 -0
  9. package/fad-checker.js +556 -245
  10. package/lib/cache-archive.js +3 -0
  11. package/lib/codecs/codec.interface.js +3 -0
  12. package/lib/codecs/composer/parse.js +3 -0
  13. package/lib/codecs/composer/registry.js +13 -5
  14. package/lib/codecs/composer.codec.js +3 -0
  15. package/lib/codecs/go/parse.js +65 -0
  16. package/lib/codecs/go/registry.js +74 -0
  17. package/lib/codecs/go.codec.js +76 -0
  18. package/lib/codecs/index.js +7 -2
  19. package/lib/codecs/maven/jar-scan.js +199 -0
  20. package/lib/codecs/maven.codec.js +17 -1
  21. package/lib/codecs/npm/collect.js +37 -17
  22. package/lib/codecs/npm/parse.js +117 -10
  23. package/lib/codecs/npm/registry.js +14 -5
  24. package/lib/codecs/npm.codec.js +4 -1
  25. package/lib/codecs/nuget/parse.js +3 -0
  26. package/lib/codecs/nuget/registry.js +11 -4
  27. package/lib/codecs/nuget.codec.js +7 -2
  28. package/lib/codecs/pypi/parse.js +111 -14
  29. package/lib/codecs/pypi/registry.js +24 -5
  30. package/lib/codecs/pypi.codec.js +30 -6
  31. package/lib/codecs/recipes.js +28 -1
  32. package/lib/codecs/ruby/parse.js +42 -0
  33. package/lib/codecs/ruby/registry.js +76 -0
  34. package/lib/codecs/ruby.codec.js +66 -0
  35. package/lib/codecs/select.js +3 -0
  36. package/lib/codecs/yarn.codec.js +3 -0
  37. package/lib/config.js +3 -0
  38. package/lib/core.js +38 -1
  39. package/lib/cpe.js +30 -5
  40. package/lib/csaf-export.js +159 -0
  41. package/lib/cve-download.js +3 -0
  42. package/lib/cve-match.js +27 -6
  43. package/lib/cve-report.js +157 -28
  44. package/lib/dep-record.js +15 -2
  45. package/lib/deps-descriptor.js +113 -0
  46. package/lib/epss.js +115 -0
  47. package/lib/gate.js +45 -0
  48. package/lib/json-export.js +110 -0
  49. package/lib/kev.js +88 -0
  50. package/lib/license-policy.js +110 -0
  51. package/lib/maven-license.js +52 -0
  52. package/lib/maven-repo.js +3 -0
  53. package/lib/maven-version.js +8 -3
  54. package/lib/nvd.js +17 -6
  55. package/lib/osv.js +75 -23
  56. package/lib/outdated.js +10 -2
  57. package/lib/priority.js +90 -0
  58. package/lib/purl.js +77 -0
  59. package/lib/retire.js +80 -13
  60. package/lib/sarif-export.js +134 -0
  61. package/lib/sbom-export.js +153 -0
  62. package/lib/scan-completeness.js +3 -0
  63. package/lib/snyk.js +3 -0
  64. package/lib/suppress.js +113 -0
  65. package/lib/transitive.js +6 -3
  66. package/lib/ui.js +90 -0
  67. package/package.json +49 -2
  68. package/CLAUDE.md +0 -147
  69. package/docs/ARCHITECTURE.md +0 -182
  70. package/docs/USAGE.md +0 -187
  71. package/docs/superpowers/plans/2026-05-29-codec-composer.md +0 -556
  72. package/docs/superpowers/plans/2026-05-29-codec-foundation.md +0 -851
  73. package/docs/superpowers/plans/2026-05-29-codec-nuget.md +0 -432
  74. package/docs/superpowers/plans/2026-05-29-codec-pypi.md +0 -450
  75. package/docs/superpowers/specs/2026-05-29-codecs-multi-ecosystem-design.md +0 -251
  76. package/test/cli-ecosystem.test.js +0 -30
  77. package/test/codec-edge-cases.test.js +0 -131
  78. package/test/codec-integration.test.js +0 -119
  79. package/test/codecs.test.js +0 -92
  80. package/test/composer.test.js +0 -71
  81. package/test/core.test.js +0 -153
  82. package/test/cpe.test.js +0 -166
  83. package/test/cve-download.test.js +0 -39
  84. package/test/cve-match.test.js +0 -217
  85. package/test/cve-report.test.js +0 -180
  86. package/test/dep-record.test.js +0 -31
  87. package/test/fixtures/complex-enterprise/api/pom.xml +0 -32
  88. package/test/fixtures/complex-enterprise/build/pom.xml +0 -46
  89. package/test/fixtures/complex-enterprise/dao/pom.xml +0 -37
  90. package/test/fixtures/complex-enterprise/pom.xml +0 -66
  91. package/test/fixtures/complex-enterprise/web/pom.xml +0 -77
  92. package/test/fixtures/csharp-config/packages.config +0 -4
  93. package/test/fixtures/csharp-csproj/Directory.Packages.props +0 -5
  94. package/test/fixtures/csharp-csproj/app.csproj +0 -7
  95. package/test/fixtures/csharp-lock/packages.lock.json +0 -6
  96. package/test/fixtures/cve-samples/cve-non-java.json +0 -19
  97. package/test/fixtures/cve-samples/cve-product-only.json +0 -31
  98. package/test/fixtures/cve-samples/cve-with-packagename.json +0 -37
  99. package/test/fixtures/cve-samples/nvd-log4shell.json +0 -40
  100. package/test/fixtures/cve-samples/nvd-npm-lodash.json +0 -22
  101. package/test/fixtures/monorepo-mixed/libs/common-bom/pom.xml +0 -26
  102. package/test/fixtures/monorepo-mixed/packages/cli/package.json +0 -14
  103. package/test/fixtures/monorepo-mixed/packages/cli/yarn.lock +0 -41
  104. package/test/fixtures/monorepo-mixed/packages/no-lock/package.json +0 -10
  105. package/test/fixtures/monorepo-mixed/packages/web-app/package-lock.json +0 -71
  106. package/test/fixtures/monorepo-mixed/packages/web-app/package.json +0 -17
  107. package/test/fixtures/monorepo-mixed/pom.xml +0 -29
  108. package/test/fixtures/monorepo-mixed/services/api/pom.xml +0 -27
  109. package/test/fixtures/monorepo-mixed/services/worker/pom.xml +0 -28
  110. package/test/fixtures/php-app/composer.json +0 -5
  111. package/test/fixtures/php-app/composer.lock +0 -10
  112. package/test/fixtures/polyglot/cs/packages.lock.json +0 -1
  113. package/test/fixtures/polyglot/js/package-lock.json +0 -1
  114. package/test/fixtures/polyglot/js/package.json +0 -1
  115. package/test/fixtures/polyglot/mvn/pom.xml +0 -7
  116. package/test/fixtures/polyglot/php/composer.lock +0 -1
  117. package/test/fixtures/polyglot/py/poetry.lock +0 -3
  118. package/test/fixtures/private-lib-detection/core/pom.xml +0 -26
  119. package/test/fixtures/private-lib-detection/plugin/pom.xml +0 -23
  120. package/test/fixtures/private-lib-detection/pom.xml +0 -35
  121. package/test/fixtures/python-pipenv/Pipfile.lock +0 -1
  122. package/test/fixtures/python-poetry/poetry.lock +0 -7
  123. package/test/fixtures/python-reqs/requirements.txt +0 -5
  124. package/test/fixtures/python-uv/uv.lock +0 -3
  125. package/test/fixtures/simple/app/pom.xml +0 -28
  126. package/test/fixtures/simple/lib/pom.xml +0 -18
  127. package/test/fixtures/simple/pom.xml +0 -24
  128. package/test/maven-repo.test.js +0 -111
  129. package/test/maven-version.test.js +0 -57
  130. package/test/monorepo.test.js +0 -132
  131. package/test/npm-registry.test.js +0 -64
  132. package/test/npm.test.js +0 -150
  133. package/test/nuget.test.js +0 -66
  134. package/test/osv.test.js +0 -62
  135. package/test/outdated.test.js +0 -101
  136. package/test/pypi.test.js +0 -72
  137. package/test/snyk.test.js +0 -64
  138. package/test/transitive.test.js +0 -305
  139. package/test/webjar.test.js +0 -33
package/test/cve-report.test.js DELETED
@@ -1,180 +0,0 @@
1
- const { test } = require("node:test");
2
- const assert = require("node:assert/strict");
3
- const fs = require("fs");
4
- const path = require("path");
5
- const os = require("os");
6
- const { generateHtmlReport, generateWordReport, computeStats, writeReports, esc } = require("../lib/cve-report");
7
-
8
- const sampleMatches = [
9
- {
10
- dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
11
- cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0" },
12
- confidence: "exact",
13
- },
14
- {
15
- dep: { groupId: "com.fasterxml.jackson.core", artifactId: "jackson-databind", version: "2.13.0", scope: "compile" },
16
- cve: { id: "CVE-2022-42003", severity: "HIGH", score: 7.5, description: "DoS via deep nesting", fixVersion: "2.13.5" },
17
- confidence: "exact",
18
- },
19
- ];
20
-
21
- const projectInfo = { name: "demo", src: "/tmp/demo", generatedAt: "2026-05-21", cveDataDate: null };
22
-
23
- test("computeStats counts by severity", () => {
24
- const s = computeStats(sampleMatches);
25
- assert.equal(s.total, 2);
26
- assert.equal(s.critical, 1);
27
- assert.equal(s.high, 1);
28
- assert.equal(s.medium, 0);
29
- });
30
-
31
- test("computeStats handles undefined/null severity", () => {
32
- const s = computeStats([{ cve: { severity: null } }, { cve: {} }]);
33
- assert.equal(s.unknown, 2);
34
- });
35
-
36
- test("esc escapes HTML entities", () => {
37
- assert.equal(esc(`<script>alert("x")</script>&`), "&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;&amp;");
38
- });
39
-
40
- test("generateHtmlReport produces well-formed self-contained HTML", () => {
41
- const html = generateHtmlReport({
42
- cveMatches: sampleMatches,
43
- eolResults: [], obsoleteResults: [], outdatedResults: [],
44
- projectInfo,
45
- });
46
- assert.ok(html.startsWith("<!doctype html>"));
47
- assert.ok(html.includes("CVE-2021-44228"));
48
- assert.ok(html.includes("Log4Shell"));
49
- assert.ok(html.includes("<style>"), "should have inline CSS");
50
- assert.ok(!html.includes("</body>\n<body>"), "no double body");
51
- });
52
-
53
- test("generateWordReport contains Word XML namespaces", () => {
54
- const doc = generateWordReport({
55
- cveMatches: sampleMatches,
56
- eolResults: [], obsoleteResults: [], outdatedResults: [],
57
- projectInfo,
58
- });
59
- assert.ok(doc.includes("xmlns:o=\"urn:schemas-microsoft-com:office:office\""));
60
- assert.ok(doc.includes("Word.Document"));
61
- });
62
-
63
- test("generateHtmlReport wraps tables with copy buttons", () => {
64
- const html = generateHtmlReport({
65
- cveMatches: sampleMatches,
66
- eolResults: [], obsoleteResults: [], outdatedResults: [],
67
- projectInfo,
68
- });
69
- // Wrapper div + copy button injected around every table
70
- assert.ok(html.includes('class="table-wrap"'), "should wrap tables");
71
- assert.ok(html.includes('class="btn-copy"'), "should have copy buttons");
72
- assert.ok(html.includes("📋 Copy table"), "button label");
73
- // Copy script wired up
74
- assert.ok(html.includes("navigator.clipboard"), "should include clipboard script");
75
- assert.ok(html.includes("inlineStylesForWord"), "should inline styles for Word paste");
76
- });
77
-
78
- test("generateWordReport does NOT wrap tables (no copy buttons in .doc)", () => {
79
- const doc = generateWordReport({
80
- cveMatches: sampleMatches,
81
- eolResults: [], obsoleteResults: [], outdatedResults: [],
82
- projectInfo,
83
- });
84
- assert.ok(!doc.includes('class="table-wrap"'), "no wrapper in Word output");
85
- assert.ok(!doc.includes('class="btn-copy"'), "no copy buttons in Word output");
86
- });
87
-
88
- test("CWE human names are shown in the CVE table and detail panel", () => {
89
- const html = generateHtmlReport({
90
- cveMatches: sampleMatches.map(m => ({
91
- ...m,
92
- cve: { ...m.cve, cwes: ["CWE-502", "CWE-917"] },
93
- })),
94
- eolResults: [], obsoleteResults: [], outdatedResults: [],
95
- projectInfo,
96
- });
97
- // Detail panel: full name inline
98
- assert.ok(html.includes("Deserialization of Untrusted Data"), "CWE-502 name in panel");
99
- assert.ok(html.includes("Expression Language Injection"), "CWE-917 name in panel");
100
- // Tooltip on the column link
101
- assert.ok(html.includes('title="CWE-502: Deserialization of Untrusted Data"'), "tooltip");
102
- // Weaknesses section in detail panel
103
- assert.ok(html.includes("Weaknesses (CWE)"), "weaknesses section heading");
104
- assert.ok(html.includes('class="cwe-list"'), "CWE list rendered");
105
- });
106
-
107
- test("Executive summary surfaces primary CWE name on each preview row", () => {
108
- const html = generateHtmlReport({
109
- cveMatches: [{
110
- dep: { groupId: "org.apache.logging.log4j", artifactId: "log4j-core", version: "2.14.0", scope: "compile" },
111
- cve: { id: "CVE-2021-44228", severity: "CRITICAL", score: 10, description: "Log4Shell", fixVersion: "2.15.0", cwes: ["CWE-502", "CWE-917"] },
112
- confidence: "exact",
113
- }],
114
- eolResults: [], obsoleteResults: [], outdatedResults: [],
115
- projectInfo,
116
- });
117
- assert.ok(html.includes('class="exec-cwe"'), "exec-cwe chip in summary");
118
- assert.ok(html.includes('class="exec-cwe-id">CWE-502'), "id in chip");
119
- assert.ok(html.includes("Deserialization of Untrusted Data"), "human name in chip");
120
- });
121
-
122
- test("Unknown CWE falls back to id-only display", () => {
123
- const html = generateHtmlReport({
124
- cveMatches: [{
125
- dep: { groupId: "x", artifactId: "y", version: "1", scope: "compile" },
126
- cve: { id: "CVE-2099-9999", severity: "HIGH", description: "n/a", cwes: ["CWE-99999"] },
127
- }],
128
- eolResults: [], obsoleteResults: [], outdatedResults: [],
129
- projectInfo,
130
- });
131
- assert.ok(html.includes("CWE-99999"), "unknown CWE id present");
132
- assert.ok(html.includes("(unknown weakness)"), "fallback label for unknown CWE in detail panel");
133
- });
134
-
135
- test("generateWordReport applies width:100% to every table for Word page-fit", () => {
136
- const doc = generateWordReport({
137
- cveMatches: sampleMatches,
138
- eolResults: [], obsoleteResults: [], outdatedResults: [],
139
- projectInfo,
140
- });
141
- // Every <table> rewritten with width="100%" + inline style (incl. fixed table-layout)
142
- assert.ok(doc.includes('width="100%"'), "tables get width=100% attribute");
143
- assert.ok(doc.includes("table-layout:fixed"), "tables get fixed layout");
144
- // Word section + landscape page setup
145
- assert.ok(doc.includes('class="WordSection1"'), "WordSection1 wrapper");
146
- assert.ok(doc.includes("mso-page-orientation: landscape"), "landscape declared via mso-* property");
147
- assert.ok(doc.includes("29.7cm 21cm"), "explicit A4 landscape dimensions");
148
- // MSO conditional comment block with twips-based <w:sectPr> equivalent
149
- assert.ok(doc.includes("w:WordDocument"), "Word document XML block");
150
- assert.ok(doc.includes("16838twips"), "twips-based page size in mso conditional");
151
- // Colgroups injected so fixed-layout tables have deterministic column widths
152
- assert.ok(doc.includes('<colgroup>'), "colgroup injected on tables");
153
- });
154
-
155
- test("writeReports writes both files to disk", async () => {
156
- const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "fad-checker-rep-"));
157
- const r = await writeReports({
158
- cveMatches: sampleMatches,
159
- eolResults: [{ dep: { groupId: "org.hibernate", artifactId: "hibernate-core", version: "5.6" }, product: "Hibernate ORM", eol: "2025-08-08" }],
160
- obsoleteResults: [{ dep: { groupId: "log4j", artifactId: "log4j", version: "1.2" }, severity: "CRITICAL", replacement: "log4j-core 2.x" }],
161
- outdatedResults: [],
162
- projectInfo,
163
- outputDir: tmp,
164
- });
165
- assert.ok(fs.existsSync(r.htmlPath));
166
- assert.ok(fs.existsSync(r.docPath));
167
- const html = fs.readFileSync(r.htmlPath, "utf8");
168
- assert.ok(html.includes("Hibernate ORM"));
169
- assert.ok(html.includes("log4j:log4j"));
170
- fs.rmSync(tmp, { recursive: true, force: true });
171
- });
172
-
173
- const { depDisplayName, depDisplayParts } = require("../lib/cve-report");
174
-
175
- test("depDisplayName delegates to codec and preserves legacy display", () => {
176
- assert.strictEqual(depDisplayName({ ecosystem: "maven", ecosystemType: "maven", namespace: "org.apache", name: "log4j", groupId: "org.apache", artifactId: "log4j" }), "org.apache:log4j");
177
- assert.strictEqual(depDisplayName({ ecosystem: "npm", ecosystemType: "npm", namespace: "", name: "lodash", artifactId: "lodash" }), "npm:lodash");
178
- const parts = depDisplayParts({ ecosystem: "npm", ecosystemType: "npm", namespace: "", name: "lodash", artifactId: "lodash" });
179
- assert.deepStrictEqual(parts, { groupLine: "npm:", nameLine: "lodash" });
180
- });
package/test/dep-record.test.js DELETED
@@ -1,31 +0,0 @@
1
- const test = require("node:test");
2
- const assert = require("node:assert");
3
- const { makeDepRecord, coordKeyFor } = require("../lib/dep-record");
4
-
5
- test("maven depRecord builds bare g:a coordKey and keeps groupId/artifactId aliases", () => {
6
- const d = makeDepRecord({ ecosystem: "maven", namespace: "org.apache", name: "log4j", version: "2.14.0", manifestPath: "/p/pom.xml", scope: "compile" });
7
- assert.strictEqual(d.coordKey, "org.apache:log4j"); // clé Maven brute (pas de préfixe)
8
- assert.strictEqual(d.groupId, "org.apache"); // alias rétro-compat
9
- assert.strictEqual(d.artifactId, "log4j"); // alias rétro-compat
10
- assert.deepStrictEqual(d.versions, ["2.14.0"]);
11
- assert.strictEqual(d.isDev, false);
12
- });
13
-
14
- test("npm depRecord has empty namespace and npm-prefixed coordKey", () => {
15
- const d = makeDepRecord({ ecosystem: "npm", namespace: "", name: "lodash", version: "4.17.20", manifestPath: "/p/package-lock.json", scope: "prod" });
16
- assert.strictEqual(d.coordKey, "npm:lodash");
17
- assert.strictEqual(d.groupId, "");
18
- assert.strictEqual(d.artifactId, "lodash");
19
- });
20
-
21
- test("coordKeyFor composes ecosystem + namespace + name", () => {
22
- assert.strictEqual(coordKeyFor("composer", "guzzlehttp", "guzzle"), "composer:guzzlehttp/guzzle");
23
- assert.strictEqual(coordKeyFor("pypi", "", "requests"), "pypi:requests");
24
- assert.strictEqual(coordKeyFor("nuget", "", "Newtonsoft.Json"), "nuget:newtonsoft.json");
25
- });
26
-
27
- test("pomPaths shares the manifestPaths array reference (push stays in sync)", () => {
28
- const d = makeDepRecord({ ecosystem: "maven", namespace: "g", name: "a", version: "1.0", manifestPath: "/p/pom.xml" });
29
- d.manifestPaths.push("/q/pom.xml");
30
- assert.deepStrictEqual(d.pomPaths, ["/p/pom.xml", "/q/pom.xml"]);
31
- });
package/test/fixtures/complex-enterprise/api/pom.xml DELETED
@@ -1,32 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <project xmlns="http://maven.apache.org/POM/4.0.0">
3
- <modelVersion>4.0.0</modelVersion>
4
- <parent>
5
- <groupId>com.acme.enterprise</groupId>
6
- <artifactId>enterprise-root</artifactId>
7
- <version>4.2.1</version>
8
- <relativePath>..</relativePath>
9
- </parent>
10
- <artifactId>api</artifactId>
11
- <dependencyManagement>
12
- <dependencies>
13
- <dependency>
14
- <groupId>com.acme.enterprise</groupId>
15
- <artifactId>build-bom</artifactId>
16
- <version>4.2.1</version>
17
- <type>pom</type>
18
- <scope>import</scope>
19
- </dependency>
20
- </dependencies>
21
- </dependencyManagement>
22
- <dependencies>
23
- <dependency>
24
- <groupId>com.fasterxml.jackson.core</groupId>
25
- <artifactId>jackson-databind</artifactId>
26
- </dependency>
27
- <dependency>
28
- <groupId>com.acme.private</groupId>
29
- <artifactId>acme-commons</artifactId>
30
- </dependency>
31
- </dependencies>
32
- </project>
package/test/fixtures/complex-enterprise/build/pom.xml DELETED
@@ -1,46 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <project xmlns="http://maven.apache.org/POM/4.0.0">
3
- <modelVersion>4.0.0</modelVersion>
4
- <parent>
5
- <groupId>com.acme.enterprise</groupId>
6
- <artifactId>enterprise-root</artifactId>
7
- <version>4.2.1</version>
8
- <relativePath>..</relativePath>
9
- </parent>
10
- <artifactId>build-bom</artifactId>
11
- <packaging>pom</packaging>
12
- <dependencyManagement>
13
- <dependencies>
14
- <dependency>
15
- <groupId>org.hibernate</groupId>
16
- <artifactId>hibernate-core</artifactId>
17
- <version>${hibernate.version}</version>
18
- </dependency>
19
- <dependency>
20
- <groupId>com.fasterxml.jackson.core</groupId>
21
- <artifactId>jackson-databind</artifactId>
22
- <version>${jackson.version}</version>
23
- </dependency>
24
- <dependency>
25
- <groupId>org.apache.logging.log4j</groupId>
26
- <artifactId>log4j-core</artifactId>
27
- <version>2.14.0</version>
28
- </dependency>
29
- <dependency>
30
- <groupId>com.acme.private</groupId>
31
- <artifactId>acme-commons</artifactId>
32
- <version>${acme-commons.version}</version>
33
- </dependency>
34
- <dependency>
35
- <groupId>commons-io</groupId>
36
- <artifactId>commons-io</artifactId>
37
- <version>2.7</version>
38
- </dependency>
39
- <dependency>
40
- <groupId>org.codehaus.jackson</groupId>
41
- <artifactId>jackson-mapper-asl</artifactId>
42
- <version>1.9.13</version>
43
- </dependency>
44
- </dependencies>
45
- </dependencyManagement>
46
- </project>
package/test/fixtures/complex-enterprise/dao/pom.xml DELETED
@@ -1,37 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <project xmlns="http://maven.apache.org/POM/4.0.0">
3
- <modelVersion>4.0.0</modelVersion>
4
- <parent>
5
- <groupId>com.acme.enterprise</groupId>
6
- <artifactId>enterprise-root</artifactId>
7
- <version>4.2.1</version>
8
- <relativePath>..</relativePath>
9
- </parent>
10
- <artifactId>dao</artifactId>
11
- <dependencyManagement>
12
- <dependencies>
13
- <dependency>
14
- <groupId>com.acme.enterprise</groupId>
15
- <artifactId>build-bom</artifactId>
16
- <version>4.2.1</version>
17
- <type>pom</type>
18
- <scope>import</scope>
19
- </dependency>
20
- </dependencies>
21
- </dependencyManagement>
22
- <dependencies>
23
- <dependency>
24
- <groupId>org.hibernate</groupId>
25
- <artifactId>hibernate-core</artifactId>
26
- </dependency>
27
- <dependency>
28
- <groupId>org.apache.commons</groupId>
29
- <artifactId>commons-lang3</artifactId>
30
- <version>3.12.0</version>
31
- </dependency>
32
- <dependency>
33
- <groupId>commons-io</groupId>
34
- <artifactId>commons-io</artifactId>
35
- </dependency>
36
- </dependencies>
37
- </project>
package/test/fixtures/complex-enterprise/pom.xml DELETED
@@ -1,66 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <project xmlns="http://maven.apache.org/POM/4.0.0">
3
- <modelVersion>4.0.0</modelVersion>
4
- <parent>
5
- <groupId>org.springframework.boot</groupId>
6
- <artifactId>spring-boot-starter-parent</artifactId>
7
- <version>2.7.18</version>
8
- </parent>
9
- <groupId>com.acme.enterprise</groupId>
10
- <artifactId>enterprise-root</artifactId>
11
- <version>4.2.1</version>
12
- <packaging>pom</packaging>
13
- <modules>
14
- <module>build</module>
15
- <module>api</module>
16
- <module>dao</module>
17
- <module>web</module>
18
- </modules>
19
- <properties>
20
- <java.version>17</java.version>
21
- <hibernate.version>5.6.15.Final</hibernate.version>
22
- <jackson.version>2.13.5</jackson.version>
23
- <acme-commons.version>3.0.0</acme-commons.version>
24
- </properties>
25
- <profiles>
26
- <profile>
27
- <id>dev</id>
28
- <activation>
29
- <activeByDefault>true</activeByDefault>
30
- </activation>
31
- <properties>
32
- <env.profile>dev</env.profile>
33
- </properties>
34
- <dependencies>
35
- <dependency>
36
- <groupId>com.h2database</groupId>
37
- <artifactId>h2</artifactId>
38
- <version>2.2.224</version>
39
- </dependency>
40
- </dependencies>
41
- </profile>
42
- <profile>
43
- <id>prod</id>
44
- <properties>
45
- <env.profile>prod</env.profile>
46
- </properties>
47
- <dependencies>
48
- <dependency>
49
- <groupId>org.postgresql</groupId>
50
- <artifactId>postgresql</artifactId>
51
- <version>42.6.0</version>
52
- </dependency>
53
- </dependencies>
54
- </profile>
55
- <profile>
56
- <id>oracle</id>
57
- <dependencies>
58
- <dependency>
59
- <groupId>com.acme.private</groupId>
60
- <artifactId>acme-oracle-driver</artifactId>
61
- <version>1.2.3</version>
62
- </dependency>
63
- </dependencies>
64
- </profile>
65
- </profiles>
66
- </project>
package/test/fixtures/complex-enterprise/web/pom.xml DELETED
@@ -1,77 +0,0 @@
1
- <?xml version="1.0" encoding="UTF-8"?>
2
- <project xmlns="http://maven.apache.org/POM/4.0.0">
3
- <modelVersion>4.0.0</modelVersion>
4
- <parent>
5
- <groupId>com.acme.enterprise</groupId>
6
- <artifactId>enterprise-root</artifactId>
7
- <version>4.2.1</version>
8
- <relativePath>..</relativePath>
9
- </parent>
10
- <artifactId>web</artifactId>
11
- <packaging>war</packaging>
12
- <profiles>
13
- <profile>
14
- <id>tomcat</id>
15
- <activation>
16
- <activeByDefault>true</activeByDefault>
17
- </activation>
18
- <properties>
19
- <servlet.container>tomcat</servlet.container>
20
- </properties>
21
- <dependencies>
22
- <dependency>
23
- <groupId>org.apache.tomcat.embed</groupId>
24
- <artifactId>tomcat-embed-core</artifactId>
25
- <version>9.0.83</version>
26
- </dependency>
27
- </dependencies>
28
- </profile>
29
- <profile>
30
- <id>jetty</id>
31
- <dependencies>
32
- <dependency>
33
- <groupId>org.eclipse.jetty</groupId>
34
- <artifactId>jetty-server</artifactId>
35
- <version>9.4.51.v20230217</version>
36
- </dependency>
37
- </dependencies>
38
- </profile>
39
- </profiles>
40
- <dependencyManagement>
41
- <dependencies>
42
- <dependency>
43
- <groupId>com.acme.enterprise</groupId>
44
- <artifactId>build-bom</artifactId>
45
- <version>4.2.1</version>
46
- <type>pom</type>
47
- <scope>import</scope>
48
- </dependency>
49
- </dependencies>
50
- </dependencyManagement>
51
- <dependencies>
52
- <dependency>
53
- <groupId>com.acme.enterprise</groupId>
54
- <artifactId>api</artifactId>
55
- <version>4.2.1</version>
56
- </dependency>
57
- <dependency>
58
- <groupId>com.acme.enterprise</groupId>
59
- <artifactId>dao</artifactId>
60
- <version>4.2.1</version>
61
- </dependency>
62
- <dependency>
63
- <groupId>org.apache.logging.log4j</groupId>
64
- <artifactId>log4j-core</artifactId>
65
- </dependency>
66
- <dependency>
67
- <groupId>org.codehaus.jackson</groupId>
68
- <artifactId>jackson-mapper-asl</artifactId>
69
- </dependency>
70
- <dependency>
71
- <groupId>junit</groupId>
72
- <artifactId>junit</artifactId>
73
- <version>4.13.2</version>
74
- <scope>test</scope>
75
- </dependency>
76
- </dependencies>
77
- </project>
package/test/fixtures/csharp-config/packages.config DELETED
@@ -1,4 +0,0 @@
1
- <?xml version="1.0" encoding="utf-8"?>
2
- <packages>
3
- <package id="EntityFramework" version="6.4.4" targetFramework="net48" />
4
- </packages>
package/test/fixtures/csharp-csproj/Directory.Packages.props DELETED
@@ -1,5 +0,0 @@
1
- <Project>
2
- <ItemGroup>
3
- <PackageVersion Include="Managed" Version="6.0.0" />
4
- </ItemGroup>
5
- </Project>
package/test/fixtures/csharp-csproj/app.csproj DELETED
@@ -1,7 +0,0 @@
1
- <Project Sdk="Microsoft.NET.Sdk">
2
- <ItemGroup>
3
- <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
4
- <PackageReference Include="Floating" Version="1.*" />
5
- <PackageReference Include="Managed" />
6
- </ItemGroup>
7
- </Project>
package/test/fixtures/csharp-lock/packages.lock.json DELETED
@@ -1,6 +0,0 @@
1
- { "version": 1, "dependencies": {
2
- "net6.0": {
3
- "Newtonsoft.Json": { "type": "Direct", "resolved": "13.0.1" },
4
- "Serilog": { "type": "Direct", "resolved": "2.12.0" },
5
- "System.Buffers": { "type": "Transitive", "resolved": "4.5.1" }
6
- } } }
package/test/fixtures/cve-samples/cve-non-java.json DELETED
@@ -1,19 +0,0 @@
1
- {
2
- "cveMetadata": {
3
- "cveId": "CVE-2024-00001"
4
- },
5
- "containers": {
6
- "cna": {
7
- "descriptions": [{ "lang": "en", "value": "Some npm package vulnerability — should be excluded from Maven index." }],
8
- "metrics": [{ "cvssV3_1": { "baseScore": 5.0, "baseSeverity": "MEDIUM" } }],
9
- "affected": [
10
- {
11
- "vendor": "npm-vendor",
12
- "product": "left-pad",
13
- "collectionURL": "https://registry.npmjs.org",
14
- "versions": [{ "version": "1.0.0", "status": "affected", "lessThan": "1.3.0" }]
15
- }
16
- ]
17
- }
18
- }
19
- }
package/test/fixtures/cve-samples/cve-product-only.json DELETED
@@ -1,31 +0,0 @@
1
- {
2
- "cveMetadata": {
3
- "cveId": "CVE-2017-5638",
4
- "datePublished": "2017-03-10T00:00:00Z"
5
- },
6
- "containers": {
7
- "cna": {
8
- "descriptions": [
9
- { "lang": "en", "value": "Apache Struts 2 Jakarta Multipart parser arbitrary OS command execution." }
10
- ],
11
- "metrics": [
12
- {
13
- "cvssV3_1": {
14
- "baseScore": 9.8,
15
- "baseSeverity": "CRITICAL"
16
- }
17
- }
18
- ],
19
- "affected": [
20
- {
21
- "vendor": "apache",
22
- "product": "struts2-core",
23
- "versions": [
24
- { "version": "2.3.5", "status": "affected", "lessThan": "2.3.32", "versionType": "maven" },
25
- { "version": "2.5.0", "status": "affected", "lessThan": "2.5.10.1", "versionType": "maven" }
26
- ]
27
- }
28
- ]
29
- }
30
- }
31
- }
package/test/fixtures/cve-samples/cve-with-packagename.json DELETED
@@ -1,37 +0,0 @@
1
- {
2
- "cveMetadata": {
3
- "cveId": "CVE-2021-44228",
4
- "datePublished": "2021-12-10T00:00:00Z"
5
- },
6
- "containers": {
7
- "cna": {
8
- "descriptions": [
9
- { "lang": "en", "value": "Apache Log4j2 JNDI features used in configuration do not protect against attacker controlled LDAP and other JNDI related endpoints. (Log4Shell)" }
10
- ],
11
- "metrics": [
12
- {
13
- "cvssV3_1": {
14
- "baseScore": 10.0,
15
- "baseSeverity": "CRITICAL"
16
- }
17
- }
18
- ],
19
- "affected": [
20
- {
21
- "vendor": "apache",
22
- "product": "log4j-core",
23
- "packageName": "org.apache.logging.log4j:log4j-core",
24
- "collectionURL": "https://repo.maven.apache.org/maven2",
25
- "versions": [
26
- {
27
- "version": "2.0",
28
- "status": "affected",
29
- "versionType": "maven",
30
- "lessThan": "2.15.0"
31
- }
32
- ]
33
- }
34
- ]
35
- }
36
- }
37
- }
package/test/fixtures/cve-samples/nvd-log4shell.json DELETED
@@ -1,40 +0,0 @@
1
- {
2
- "id": "CVE-2021-44228",
3
- "published": "2021-12-10T00:00:00Z",
4
- "lastModified": "2022-04-01T00:00:00Z",
5
- "descriptions": [
6
- { "lang": "en", "value": "Apache Log4j2 JNDI features used in configuration do not protect against attacker controlled LDAP and other JNDI related endpoints." }
7
- ],
8
- "metrics": {
9
- "cvssMetricV31": [
10
- {
11
- "cvssData": {
12
- "baseScore": 10.0,
13
- "baseSeverity": "CRITICAL",
14
- "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
15
- }
16
- }
17
- ]
18
- },
19
- "references": [
20
- { "url": "https://logging.apache.org/log4j/2.x/security.html", "tags": ["Vendor Advisory"] }
21
- ],
22
- "configurations": [
23
- {
24
- "operator": "OR",
25
- "nodes": [
26
- {
27
- "operator": "OR",
28
- "cpeMatch": [
29
- {
30
- "vulnerable": true,
31
- "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
32
- "versionStartIncluding": "2.0.0",
33
- "versionEndExcluding": "2.15.0"
34
- }
35
- ]
36
- }
37
- ]
38
- }
39
- ]
40
- }
package/test/fixtures/cve-samples/nvd-npm-lodash.json DELETED
@@ -1,22 +0,0 @@
1
- {
2
- "id": "CVE-2019-10744",
3
- "published": "2019-07-26T00:00:00Z",
4
- "descriptions": [{ "lang": "en", "value": "Prototype pollution in lodash defaultsDeep." }],
5
- "metrics": {
6
- "cvssMetricV31": [{ "cvssData": { "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N" } }]
7
- },
8
- "references": [{ "url": "https://github.com/lodash/lodash/pull/4336", "tags": ["Patch"] }],
9
- "configurations": [
10
- {
11
- "operator": "OR",
12
- "nodes": [
13
- {
14
- "operator": "OR",
15
- "cpeMatch": [
16
- { "vulnerable": true, "criteria": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "4.17.12" }
17
- ]
18
- }
19
- ]
20
- }
21
- ]
22
- }