fad-checker 2.4.0 → 2.4.2

package/lib/maven-version.js

@@ -103,6 +103,14 @@ function compareMavenVersions(aStr, bStr) {
  * spec shape: { version, status, lessThan, lessThanOrEqual, versionType }
  * Returns true if depVersion is affected.
  */
+// A bound participates in comparisons only if it looks like a version. CVE 5.x
+// records carry placeholders in these fields ("log4j-core*", "*", "unspecified")
+// — comparing those as Maven versions is garbage (alpha sorts below numeric), so
+// CVE-2021-44228's `lessThan: "log4j-core*"` used to unmatch every real version.
+function versionLikeBound(s) {
+	return s != null && /^[0-9]/.test(String(s).trim()) && String(s).trim() !== "0";
+}
+
 function isVersionAffected(depVersion, spec) {
 	if (!spec) return false;
 	if (spec.status && spec.status !== "affected") return false;
@@ -110,27 +118,27 @@ function isVersionAffected(depVersion, spec) {
 	const dep = parseMavenVersion(depVersion);
 	if (!dep.segments.length) return false;
 
-	// Fail-closed: a spec with no version constraints at all carries no information.
+	const lower = versionLikeBound(spec.version) && spec.version !== "*" ? spec.version : null;
+	const upperExcl = versionLikeBound(spec.lessThan) ? spec.lessThan : null;
+	const upperIncl = versionLikeBound(spec.lessThanOrEqual) ? spec.lessThanOrEqual : null;
+
+	// Fail-closed: a spec with no usable version constraint carries no information.
 	// Without this guard the function falls through to `return true` for every input,
-	// which was the H1 cascade described in CRITICAL-REVIEW.md.
-	const hasLower = spec.version && spec.version !== "0" && spec.version !== "*";
-	if (!hasLower && !spec.lessThan && !spec.lessThanOrEqual) return false;
+	// which was the H1 cascade described in CRITICAL-REVIEW.md. A wildcard/placeholder
+	// upper on its own does not count ({version:"*", lessThan:"*"} must stay inert).
+	if (!lower && !upperExcl && !upperIncl) return false;
 
 	// Lower bound (inclusive)
-	if (spec.version && spec.version !== "0" && spec.version !== "*") {
-		if (compareMavenVersions(depVersion, spec.version) < 0) return false;
-	}
+	if (lower && compareMavenVersions(depVersion, lower) < 0) return false;
 	// Upper bound exclusive
-	if (spec.lessThan) {
-		if (compareMavenVersions(depVersion, spec.lessThan) >= 0) return false;
-	}
+	if (upperExcl && compareMavenVersions(depVersion, upperExcl) >= 0) return false;
 	// Upper bound inclusive
-	if (spec.lessThanOrEqual) {
-		if (compareMavenVersions(depVersion, spec.lessThanOrEqual) > 0) return false;
-	}
-	// Exact match with no bounds — only affected if equal
-	if (!spec.lessThan && !spec.lessThanOrEqual && spec.version && spec.version !== "0" && spec.version !== "*") {
-		if (compareMavenVersions(depVersion, spec.version) !== 0) return false;
+	if (upperIncl && compareMavenVersions(depVersion, upperIncl) > 0) return false;
+	// Exact match with no upper of ANY kind (not even a wildcard) — only affected if
+	// equal. A wildcard upper ({version:"2.0", lessThan:"log4j-core*"}) instead means
+	// "from 2.0 onward, unbounded", so it must NOT collapse to an exact match.
+	if (lower && spec.lessThan == null && spec.lessThanOrEqual == null) {
+		if (compareMavenVersions(depVersion, lower) !== 0) return false;
 	}
 	return true;
 }
@@ -160,5 +168,6 @@ module.exports = {
 	parseMavenVersion,
 	compareMavenVersions,
 	isVersionAffected,
+	versionLikeBound,
 	parseRange,
 };

package/lib/osv.js

@@ -31,12 +31,16 @@ function cacheKey(g, a, v, ecosystem = "maven") {
 	return `${ecosystem}__${safeG}__${safeA}__${v}.json`;
 }
 
-function readCache(name) {
+// OFFLINE bypasses the TTL (same rule as lib/nvd.js): the warmed cache is the
+// ONLY source on an air-gapped box, so a >12h-old entry must still be served —
+// expiring it there silently reported "0 OSV vulns" for every ecosystem.
+// Online keeps enforcing the TTL so entries refresh normally.
+function readCache(name, { ignoreTtl = false } = {}) {
 	const p = path.join(OSV_CACHE_DIR, name);
 	if (!fs.existsSync(p)) return null;
 	try {
 		const data = JSON.parse(fs.readFileSync(p, "utf8"));
-		if (Date.now() - data._fetchedAt < OSV_CACHE_TTL_MS) return data.body;
+		if (ignoreTtl || Date.now() - data._fetchedAt < OSV_CACHE_TTL_MS) return data.body;
 	} catch { /* ignore */ }
 	return null;
 }
@@ -223,7 +227,7 @@ async function queryBatch(deps, opts = {}) {
 	for (let i = 0; i < deps.length; i++) {
 		const d = deps[i];
 		const ck = cacheKey(d.groupId, d.artifactId, d.version, d.ecosystem || "maven");
-		const hit = readCache(ck);
+		const hit = readCache(ck, { ignoreTtl: !!offline });
 		if (hit !== null) {
 			indexMap[i] = { cached: hit };
 		} else {
@@ -297,7 +301,7 @@ async function queryBatch(deps, opts = {}) {
 	const liveIds = [];
 	for (const id of allIds) {
 		const detailCacheKey = `vuln_${id}.json`;
-		const hit = readCache(detailCacheKey);
+		const hit = readCache(detailCacheKey, { ignoreTtl: !!offline });
 		if (hit) { detailById.set(id, hit); continue; }
 		if (offline) continue;
 		liveIds.push(id);

package/lib/provenance.js

@@ -109,6 +109,8 @@ function runConfiguration(options = {}) {
 		allLibs: options.allLibs !== false,
 		licenses: !!options.licenses,
 		typosquat: !!options.typosquat,
+		certs: options.certs !== false,
+		certExpiryDays: options.certExpiryDays != null ? String(options.certExpiryDays) : null,
 		failOn: options.failOn || "none",
 		ignoreFile: options.ignore || null,
 		vexFile: options.vex || null,

package/lib/sarif-export.js

@@ -42,12 +42,25 @@ function depCoord(dep) {
 	return name;
 }
 
+// Certificate / key-material finding-type metadata → SARIF rule + level. Keyed by
+// the analyze.js issue `type`. security-severity is a CVSS-like number for GitHub.
+const CERT_RULES = {
+	"private-key-committed": { level: "error", score: "9.8", desc: "Committed private key" },
+	"keystore-committed": { level: "warning", score: "5.0", desc: "Committed keystore" },
+	"public-key-committed": { level: "note", score: "2.0", desc: "Committed public key" },
+	"cert-expired": { level: "error", score: "7.5", desc: "Expired certificate" },
+	"cert-expiring": { level: "warning", score: "4.0", desc: "Certificate expiring soon" },
+	"cert-weak-key": { level: "error", score: "7.5", desc: "Weak certificate key" },
+	"cert-weak-signature": { level: "error", score: "7.5", desc: "Weak certificate signature algorithm" },
+	"cert-self-signed": { level: "note", score: "2.0", desc: "Self-signed certificate" },
+};
+
 /**
  * Build a SARIF 2.1.0 object from matches.
- * opts: { projectInfo, toolVersion }
+ * opts: { projectInfo, toolVersion, certFindings }
  */
 function buildSarif(matches, opts = {}) {
-	const { projectInfo = {}, toolVersion = "0" } = opts;
+	const { projectInfo = {}, toolVersion = "0", certFindings = [] } = opts;
 	const srcRoot = projectInfo.src && projectInfo.src.startsWith("(") ? null : projectInfo.src;
 
 	const rulesById = new Map();
@@ -108,6 +121,39 @@ function buildSarif(matches, opts = {}) {
 		});
 	}
 
+	// Certificate / key-material findings: one rule per finding-type, one result per
+	// (file, issue). Located at the file itself (not a manifest).
+	for (const c of certFindings || []) {
+		for (const issue of c.issues || []) {
+			const meta = CERT_RULES[issue.type];
+			if (!meta) continue;
+			const ruleId = `FAD-${issue.type.toUpperCase()}`;
+			if (!rulesById.has(ruleId)) {
+				rulesById.set(ruleId, {
+					id: ruleId, name: ruleId,
+					shortDescription: { text: meta.desc },
+					properties: { "security-severity": meta.score, tags: ["security", "cryptography", "key-material"] },
+				});
+			}
+			const uri = relUri(c.path, srcRoot);
+			const vis = c.keyVisibility ? ` [${c.keyVisibility} key]` : "";
+			results.push({
+				ruleId,
+				level: meta.level,
+				message: { text: `${meta.desc}${vis}: ${issue.message} — ${uri || c.path}` },
+				...(uri ? { locations: [{ physicalLocation: { artifactLocation: { uri } } }] } : {}),
+				partialFingerprints: { fadKey: `${c.sha256 || c.path}|${issue.type}` },
+				properties: {
+					kind: c.kind,
+					...(c.keyVisibility ? { keyVisibility: c.keyVisibility } : {}),
+					...(c.algorithm ? { algorithm: c.algorithm } : {}),
+					...(c.format ? { format: c.format } : {}),
+					...(c.sha256 ? { sha256: c.sha256 } : {}),
+				},
+			});
+		}
+	}
+
 	return {
 		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
 		version: "2.1.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",