fad-checker 2.2.1 → 2.2.3

package/lib/osv-db.js

@@ -0,0 +1,160 @@
+/**
+ * lib/osv-db.js — offline-COMPLETE OSV matching from a locally imported OSV database
+ * (the per-ecosystem `all.zip` exports OSV.dev publishes on its public GCS bucket).
+ *
+ * Why this exists alongside lib/osv.js: the latter queries the OSV.dev API *per
+ * dependency* and caches each response (12 h TTL). Offline, that only covers the deps
+ * that happened to be queried online before — a cold dep has NO OSV data. This module
+ * imports the FULL OSV database once while online (Maven = 9 MB zip, ~6.6 k advisories)
+ * and matches EVERY dep against it offline, deterministically, regardless of the per-dep
+ * cache. That is exactly the model OSV-Scanner uses for air-gapped scans
+ * (`--download-offline-databases`), and it makes fad's offline Maven recall complete and
+ * cache-independent for a PASSI engagement.
+ *
+ * Maven only for now: range matching needs the ecosystem's version ordering, and fad has
+ * a robust Maven comparator (lib/maven-version). npm/PyPI/etc. are a documented follow-up
+ * (they need semver/PEP-440 ordering). The OSV records are full OSV-schema vuln objects —
+ * identical to the API — so lib/osv.js#vulnToMatch is reused verbatim.
+ *
+ * Online (download+index) + cached (~/.fad-checker/osv-db, 24 h) + offline-aware (loads a
+ * present index, never blocks). The index travels in the cache archive automatically.
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { unzipSync } = require("fflate");
+const { compareMavenVersions } = require("./maven-version");
+const { vulnToMatch } = require("./osv");
+
+const OSV_DB_DIR = path.join(os.homedir(), ".fad-checker", "osv-db");
+const BUCKET = "https://osv-vulnerabilities.storage.googleapis.com";
+const TTL_MS = 24 * 3600 * 1000;
+// OSV ecosystem export name per fad codec id. Maven only for now (version ordering).
+const ECO = { maven: "Maven" };
+const indexPath = eco => path.join(OSV_DB_DIR, `${eco}-index.json`);
+
+/** Keep only what vulnToMatch + matching need, so the cached index stays compact. */
+function trimVuln(vuln, affForPkg) {
+	return {
+		id: vuln.id,
+		aliases: vuln.aliases || [],
+		summary: vuln.summary || "",
+		details: (vuln.details || "").slice(0, 2000),
+		severity: vuln.severity || [],
+		...(vuln.database_specific?.severity ? { database_specific: { severity: vuln.database_specific.severity } } : {}),
+		references: (vuln.references || []).slice(0, 20),
+		published: vuln.published || null,
+		modified: vuln.modified || null,
+		affected: affForPkg.map(a => ({ package: a.package, ranges: a.ranges || [], versions: a.versions || [] })),
+	};
+}
+
+/** Build { byPackage: { "g:a"(lower): [trimmedVuln] }, … } from an all.zip buffer. */
+function buildIndexFromZip(buf, ecosystemName) {
+	const files = unzipSync(new Uint8Array(buf));
+	const dec = new TextDecoder();
+	const byPackage = {};
+	let count = 0;
+	for (const name of Object.keys(files)) {
+		let vuln;
+		try { vuln = JSON.parse(dec.decode(files[name])); } catch { continue; }
+		if (!vuln || vuln.withdrawn) continue;
+		// A vuln can list several packages; index it under each (with that package's affected slice).
+		const byPkg = new Map();
+		for (const a of (vuln.affected || [])) {
+			if (a.package?.ecosystem !== ecosystemName) continue;
+			const nm = a.package?.name;
+			if (!nm) continue;
+			if (!byPkg.has(nm)) byPkg.set(nm, []);
+			byPkg.get(nm).push(a);
+		}
+		for (const [nm, affs] of byPkg) {
+			const key = nm.toLowerCase();
+			(byPackage[key] = byPackage[key] || []).push(trimVuln(vuln, affs));
+			count++;
+		}
+	}
+	return { _builtAt: Date.now(), ecosystem: ecosystemName, count, packages: Object.keys(byPackage).length, byPackage };
+}
+
+/**
+ * Ensure the local OSV DB index for an ecosystem. Downloads + (re)builds when online and
+ * stale/missing; offline (or on any network failure) loads whatever is present, else null.
+ */
+async function ensureOsvDb(opts = {}) {
+	const { offline, refresh, verbose, fetcher = globalThis.fetch, ecosystem = "maven" } = opts;
+	const ecoName = ECO[ecosystem];
+	if (!ecoName) return null;
+	const ip = indexPath(ecosystem);
+	const loadAny = () => { try { return JSON.parse(fs.readFileSync(ip, "utf8")); } catch { return null; } };
+	const loadFresh = () => { const j = loadAny(); return j && (Date.now() - (j._builtAt || 0) < TTL_MS) ? j : null; };
+
+	if (offline) return loadAny();
+	if (!refresh) { const f = loadFresh(); if (f) return f; }
+	try {
+		const res = await fetcher(`${BUCKET}/${ecoName}/all.zip`, { headers: { "User-Agent": "fad-checker-osv-db" } });
+		if (!res || !res.ok) { if (verbose) console.warn(`osv-db: HTTP ${res?.status}`); return loadAny(); }
+		const buf = Buffer.from(await res.arrayBuffer());
+		const index = buildIndexFromZip(buf, ecoName);
+		fs.mkdirSync(OSV_DB_DIR, { recursive: true });
+		fs.writeFileSync(ip, JSON.stringify(index));
+		return index;
+	} catch (e) { if (verbose) console.warn(`osv-db: ${e.message}`); return loadAny(); }
+}
+
+// ---- OSV range evaluation over Maven version ordering ----
+function inInterval(v, intro, upper, inclusive) {
+	if (intro != null && intro !== "0" && compareMavenVersions(v, intro) < 0) return false;
+	const c = compareMavenVersions(v, upper);
+	return inclusive ? c <= 0 : c < 0;
+}
+function rangeAffects(version, range) {
+	if (!range || range.type === "GIT") return false;
+	let intro = null;
+	for (const e of (range.events || [])) {
+		if (e.introduced !== undefined) intro = e.introduced;
+		else if (e.fixed !== undefined) { if (inInterval(version, intro, e.fixed, false)) return true; intro = null; }
+		else if (e.last_affected !== undefined) { if (inInterval(version, intro, e.last_affected, true)) return true; intro = null; }
+	}
+	if (intro !== null) { // open interval [introduced, ∞)
+		if (intro === "0" || compareMavenVersions(version, intro) >= 0) return true;
+	}
+	return false;
+}
+function vulnAffectsVersion(version, trimmedVuln) {
+	for (const a of (trimmedVuln.affected || [])) {
+		if ((a.versions || []).includes(version)) return true;
+		for (const r of (a.ranges || [])) if (rangeAffects(version, r)) return true;
+	}
+	return false;
+}
+
+/**
+ * Match resolved Maven deps against a local OSV DB index. Returns vulnToMatch-shaped
+ * matches (source 'osv'), one per (coord, version, vuln). Scans every distinct version.
+ */
+function matchOsvDbDeps(resolvedDeps, index) {
+	if (!index || !index.byPackage) return [];
+	const out = [];
+	const seen = new Set();
+	for (const dep of resolvedDeps.values()) {
+		if (dep.ecosystem !== "maven") continue;
+		if (dep.provenance === "embedded" || dep.provenance === "binary") continue;
+		const recs = index.byPackage[`${dep.groupId}:${dep.artifactId}`.toLowerCase()];
+		if (!recs || !recs.length) continue;
+		const versions = (dep.versions && dep.versions.length) ? dep.versions : [dep.version];
+		for (const ver of versions) {
+			if (!ver || /\$\{/.test(String(ver))) continue;
+			for (const rec of recs) {
+				if (!vulnAffectsVersion(ver, rec)) continue;
+				const key = `${dep.groupId}:${dep.artifactId}:${ver}|${rec.id}`;
+				if (seen.has(key)) continue;
+				seen.add(key);
+				out.push(vulnToMatch(ver === dep.version ? dep : { ...dep, version: ver }, rec));
+			}
+		}
+	}
+	return out;
+}
+
+module.exports = { ensureOsvDb, buildIndexFromZip, matchOsvDbDeps, rangeAffects, vulnAffectsVersion, OSV_DB_DIR };

package/lib/transitive.js

@@ -183,12 +183,18 @@ function resolveProps(value, props, builtins, depth = 0) {
 async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 	const key = `${g}:${a}:${v}`;
 	if (seen.has(key)) return null;
+	// Opt-in cross-call memo (used by the per-module overlay, which resolves the
+	// same shared parents/BOMs once per module). Immutable POMs → the effective
+	// result for a g:a:v is stable, so caching the finished object is safe; callers
+	// only READ eff.depMgmt/eff.deps. Only active when opts.effCache is supplied,
+	// so existing single-shot callers are byte-for-byte unchanged.
+	if (opts.effCache && opts.effCache.has(key)) return opts.effCache.get(key);
 	seen.add(key);
 
 	const xml = await fetchPom(g, a, v, opts);
-	if (!xml) return null;
+	if (!xml) { if (opts.effCache) opts.effCache.set(key, null); return null; }
 	const pom = await parsePomXml(xml);
-	if (!pom) return null;
+	if (!pom) { if (opts.effCache) opts.effCache.set(key, null); return null; }
 
 	let merged = {
 		groupId: pom.groupId,
@@ -243,6 +249,7 @@ async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 	}
 	merged.depMgmt = expanded;
 
+	if (opts.effCache) opts.effCache.set(key, merged);
 	return merged;
 }
 

package/lib/version-overlay.js

@@ -0,0 +1,197 @@
+/**
+ * lib/version-overlay.js — recover transitive dependency versions that Maven's
+ * PER-MODULE mediation keeps but fad's GLOBAL transitive pass masks.
+ *
+ * The problem: `expandWithTransitives` (cve-match.js) resolves the whole reactor as
+ * ONE tree with ONE global `rootDepMgmt` (the highest version of every coord seen
+ * anywhere). So a `<dependencyManagement>` pin in module A is force-applied to a
+ * transitive of the unrelated module B — e.g. `controller` pins poi 5.4.1 and the
+ * stress-tests island's `jmeter → poi 3.11` gets rewritten to 5.4.1, hiding
+ * CVE-2017-12626. Maven applies depMgmt only inside the subtree that declares it.
+ *
+ * The fix (additive overlay): keep the global pass UNCHANGED as the base (no
+ * regression), then re-resolve EACH module independently with ONLY that module's
+ * own effective depMgmt (its local parent chain + its external parent/import-BOMs),
+ * and APPEND any (g:a, version) it finds that isn't already in the coord's
+ * `versions[]`. Never removes, never reseeds — so it can only ADD coverage, and the
+ * per-module version it finds is the one genuinely on that module's classpath
+ * (so it's a true positive, not a force-elevated one).
+ *
+ * Offline-aware (cache-first via transitive.js#fetchPom) and memoised across modules
+ * with a shared `effCache` so 25 modules stay fast.
+ */
+const core = require("./core");
+const { resolveTransitiveDeps, effectivePom } = require("./transitive");
+const { resolveDepVersion } = require("./cve-match");
+
+const coord = core.coord;
+const isConcrete = v => v != null && !/\$\{/.test(String(v));
+
+/** xml2js dependency node → flat descriptor (groupId/artifactId/version/scope/…). */
+function flattenDep(d) {
+	return {
+		groupId: coord(d.groupId?.[0]),
+		artifactId: coord(d.artifactId?.[0]),
+		rawVersion: coord(d.version?.[0]),
+		scope: coord(d.scope?.[0]) || "compile",
+		optional: d.optional?.[0] === "true",
+		isImport: d.scope?.[0] === "import",
+		exclusions: (d.exclusions?.[0]?.exclusion || []).map(e => ({
+			groupId: coord(e.groupId?.[0]),
+			artifactId: coord(e.artifactId?.[0]),
+		})),
+	};
+}
+
+/**
+ * Walk a module's LOCAL parent chain (child first). Stops at the first external
+ * parent (one not present in the source tree) and reports it separately, so the
+ * caller can resolve its managed table from Maven Central.
+ * @returns { chain: [pomPath, parentPath, …], externalParent: {groupId,artifactId,version}|null }
+ */
+function localChain(pomPath, store) {
+	const chain = [];
+	const seen = new Set();
+	let cur = pomPath;
+	let externalParent = null;
+	while (cur && !seen.has(cur)) {
+		seen.add(cur);
+		chain.push(cur);
+		const meta = store.byPath[cur];
+		if (!meta) break;
+		const parentPath = core.resolveParentPath(cur, meta.parentInfo, store);
+		if (!parentPath) {
+			const p = meta.parentInfo;
+			if (p?.groupId && p?.artifactId && p?.version) externalParent = { groupId: p.groupId, artifactId: p.artifactId, version: p.version };
+			break;
+		}
+		cur = parentPath;
+	}
+	return { chain, externalParent };
+}
+
+/**
+ * Build the EFFECTIVE managed-version map for ONE module — exactly the depMgmt that
+ * Maven would apply when resolving THIS module's dependencies, and no other module's.
+ * Closest-declared pin wins (set-if-absent while climbing child → parent).
+ *
+ * Sources, in precedence order:
+ *   1. each local pom in the parent chain's own <dependencyManagement> (local
+ *      scope=import BOMs are already expanded inline by core.getAllInheritedProps);
+ *   2. the chain's external <parent> (e.g. spring-boot-starter-parent) managed table;
+ *   3. external scope=import BOMs (e.g. spring-boot-dependencies) declared in the chain.
+ * @returns Map<"g:a", version>
+ */
+async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
+	const map = new Map();
+	const setIf = (k, v) => { if (k && isConcrete(v) && !map.has(k)) map.set(k, String(v)); };
+	const { chain, externalParent } = localChain(pomPath, store);
+	const externalBoms = [];
+
+	for (const pom of chain) {
+		const entry = propsByPom[pom];
+		if (!entry) continue;
+		const props = entry.properties || {};
+		for (const node of entry.dependencyManagement || []) {
+			// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+			const g = resolveDepVersion(coord(node.groupId?.[0]), props);
+			const a = resolveDepVersion(coord(node.artifactId?.[0]), props);
+			if (!g || !a) continue;
+			const v = resolveDepVersion(coord(node.version?.[0]), props);
+			if (node.scope?.[0] === "import") {
+				// Local import BOMs are already expanded inline by getAllInheritedProps;
+				// only chase EXTERNAL ones (not present in the source tree).
+				const local = (v && store.byId[`${g}:${a}:${v}`]) || store.byId[`${g}:${a}`];
+				if (!local && isConcrete(v)) externalBoms.push({ groupId: g, artifactId: a, version: v });
+				continue;
+			}
+			setIf(`${g}:${a}`, v);
+		}
+	}
+
+	// External parent + external import BOMs: pull their managed tables from Maven
+	// Central (cache-first, memoised). Closest local pins already set win.
+	const externals = externalParent ? [externalParent, ...externalBoms] : externalBoms;
+	for (const ext of externals) {
+		let eff = null;
+		try { eff = await effectivePom(ext.groupId, ext.artifactId, ext.version, opts); } catch { eff = null; }
+		if (eff?.depMgmt) for (const d of eff.depMgmt) setIf(`${d.groupId}:${d.artifactId}`, d.version);
+	}
+	return map;
+}
+
+/**
+ * The direct dependencies declared by ONE module, with concrete versions resolved
+ * (own ${properties} → module's managed map → the global resolved version). These
+ * seed the per-module transitive walk.
+ */
+function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
+	const entry = propsByPom[pomPath];
+	if (!entry) return [];
+	const props = entry.properties || {};
+	const out = [];
+	for (const node of entry.dependencies || []) {
+		const d = flattenSafe(node);
+		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
+		if (d.scope === "test" && !opts.includeTestDeps) continue;
+		if (d.scope === "system" || d.scope === "import") continue;
+		// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+		const gid = resolveDepVersion(d.groupId, props);
+		const aid = resolveDepVersion(d.artifactId, props);
+		let v = resolveDepVersion(d.rawVersion, props);
+		if (!isConcrete(v)) v = moduleMgmt.get(`${gid}:${aid}`) || resolvedDeps.get(`${gid}:${aid}`)?.version || null;
+		if (!isConcrete(v)) continue;
+		out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+	}
+	return out;
+}
+// flattenSafe guards against malformed nodes (xml2js can yield odd shapes).
+function flattenSafe(node) { try { return flattenDep(node); } catch { return null; } }
+
+/**
+ * Additive per-module overlay. Mutates `resolvedDeps`: for every coord already in
+ * the scan set, appends any concrete version found by a faithful per-module
+ * resolution that the global pass masked. Returns a small diagnostics object incl.
+ * the (g:a, version) pairs recovered (used for the false-positive measurement).
+ */
+async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}) {
+	if (!store || !propsByPom) return { appended: 0, modules: 0, recovered: [] };
+	const effCache = opts.effCache || new Map();
+	const tOpts = { ...opts, effCache };
+	const recovered = [];
+	let modules = 0;
+
+	for (const pomPath of Object.keys(propsByPom)) {
+		const moduleMgmt = await buildModuleManagement(pomPath, store, propsByPom, tOpts);
+		const directs = buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, tOpts);
+		if (!directs.length) continue;
+		modules++;
+
+		let trans;
+		try {
+			trans = await resolveTransitiveDeps(directs, {
+				...tOpts,
+				rootDepMgmt: moduleMgmt,
+				maxDepth: opts.maxDepth || 6,
+				includedScopes: ["compile", "runtime", "provided"],
+			});
+		} catch { continue; }
+
+		for (const [key, t] of trans) {
+			const v = t.version;
+			if (!isConcrete(v)) continue;
+			const existing = resolvedDeps.get(key);
+			if (!existing) continue;                               // additive to coords already scanned
+			if (existing.provenance === "embedded" || existing.provenance === "binary") continue;
+			if (!Array.isArray(existing.versions)) existing.versions = isConcrete(existing.version) ? [existing.version] : [];
+			if (existing.versions.includes(String(v))) continue;   // already scanned this version
+			existing.versions.push(String(v));
+			existing.maskedVersions = existing.maskedVersions || [];
+			existing.maskedVersions.push({ version: String(v), via: t.via, viaPaths: t.viaPaths, module: pomPath, depth: t.depth });
+			recovered.push({ coord: key, version: String(v), module: pomPath, had: existing.version });
+		}
+	}
+	return { appended: recovered.length, modules, recovered };
+}
+
+module.exports = { expandPerModuleOverlay, buildModuleManagement, buildModuleDirects, localChain };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Scan ALL Maven, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",