fad-checker 2.4.1 → 2.4.3

package/lib/maven-bom.js

@@ -15,6 +15,76 @@
  * skips it offline). Pure except for the injected/real effectivePom fetch.
  */
 const transitive = require("./transitive");
+const core = require("./core");
+
+/**
+ * Walk each parsed pom's LOCAL parent chain and collect the distinct EXTERNAL parent
+ * coordinates — the parent POMs referenced by a `<parent>` element but NOT present in
+ * the source tree (e.g. `spring-boot-starter-parent`, whose own parent
+ * `spring-boot-dependencies` holds the managed-version table). Maven inherits their
+ * `<dependencyManagement>` into the child, which is how a versionless
+ * `spring-boot-starter-actuator` gets its version — but core.js only follows LOCAL
+ * parents, so without this those versions stay unresolved and drop out of the scan.
+ *
+ * Deduped by g:a:v; unresolved (`${…}`) or incomplete coords are skipped. The result
+ * is fed to resolveBomManagedVersions/backfillVersions exactly like an import BOM.
+ * @param store the metadata store (byPath[pom].parentInfo + byId), as built by core.js
+ * @returns [{ groupId, artifactId, version }]
+ */
+function collectExternalParents(store) {
+	if (!store || !store.byPath) return [];
+	const seen = new Set();
+	const out = [];
+	for (const pomPath of Object.keys(store.byPath)) {
+		let cur = pomPath;
+		const localSeen = new Set();
+		while (cur && !localSeen.has(cur)) {
+			localSeen.add(cur);
+			const meta = store.byPath[cur];
+			if (!meta) break;
+			const parentPath = core.resolveParentPath(cur, meta.parentInfo, store);
+			if (parentPath) { cur = parentPath; continue; }   // local parent → keep climbing
+			// No local parent POM: if a <parent> is declared, it's EXTERNAL.
+			const p = meta.parentInfo;
+			if (p && p.groupId && p.artifactId && p.version && !/\$\{/.test(String(p.version))) {
+				const k = `${p.groupId}:${p.artifactId}:${p.version}`;
+				if (!seen.has(k)) { seen.add(k); out.push({ groupId: p.groupId, artifactId: p.artifactId, version: p.version }); }
+			}
+			break;
+		}
+	}
+	return out;
+}
+
+/**
+ * Collect the version-property OVERRIDES a project declares in its own `<properties>`
+ * blocks — the Maven mechanism for patching a coord managed by an external parent
+ * (e.g. `<log4j2.version>2.17.1</log4j2.version>` overrides spring-boot-dependencies'
+ * default). Fed to effectivePom as `propertyOverrides` so the parent's managed table
+ * resolves to the version actually on the classpath, not the framework default.
+ *
+ * Source is each pom's OWN declared props (store.byPath[pom].properties, raw xml2js
+ * `{name:[value]}`) — NOT the merged/inherited map — so we never mistake an inherited
+ * builtin for an override. `project.*`/`pom.*` model expressions and unresolved `${…}`
+ * values are excluded. Merged across modules (last wins); real-world overrides live in
+ * the root and are consistent, so the common case is exact.
+ * @returns { [propName]: value }
+ */
+function collectPropertyOverrides(store) {
+	const out = {};
+	if (!store || !store.byPath) return out;
+	for (const meta of Object.values(store.byPath)) {
+		const raw = meta && meta.properties;
+		if (!raw || typeof raw !== "object") continue;
+		for (const [k, val] of Object.entries(raw)) {
+			if (k.startsWith("project.") || k.startsWith("pom.")) continue;
+			const v = Array.isArray(val) ? val[0] : val;
+			if (typeof v !== "string" || /\$\{/.test(v)) continue;
+			out[k] = v;
+		}
+	}
+	return out;
+}
 
 /**
  * Extract the distinct external import-BOM coordinates from the parsed poms' merged
@@ -57,6 +127,10 @@ function collectImportBoms(propsByPom) {
  */
 async function resolveBomManagedVersions(boms, opts = {}) {
 	const effectivePom = opts.effectivePom || transitive.effectivePom;
+	// `via` labels where the managed version came from: "bom" (import BOM, the default)
+	// or "parent" (an external <parent> chain). Only stamped when non-default so the
+	// import-BOM entry shape stays byte-identical to before.
+	const via = opts.via && opts.via !== "bom" ? opts.via : null;
 	const map = new Map();
 	for (const bom of boms) {
 		let eff = null;
@@ -68,7 +142,7 @@ async function resolveBomManagedVersions(boms, opts = {}) {
 			if (!d.groupId || !d.artifactId) continue;
 			const k = `${d.groupId}:${d.artifactId}`;
 			if (map.has(k)) continue;
-			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, { version: String(d.version), bom: bomCoord });
+			if (d.version && !/\$\{/.test(String(d.version))) map.set(k, { version: String(d.version), bom: bomCoord, ...(via ? { via } : {}) });
 		}
 	}
 	return map;
@@ -94,7 +168,7 @@ function backfillVersions(resolvedDeps, mgmtMap) {
 		dep.version = v;
 		if (!Array.isArray(dep.versions)) dep.versions = [];
 		if (!dep.versions.includes(v)) dep.versions.push(v);
-		dep.versionSource = { via: "bom", bom: entry.bom };
+		dep.versionSource = { via: entry.via || "bom", bom: entry.bom };
 		filled++;
 	}
 	return filled;
@@ -113,4 +187,4 @@ async function resolveAndBackfill(propsByPom, resolvedDeps, opts = {}) {
 	return { boms: boms.length, filled, mgmtSize: map.size };
 }
 
-module.exports = { collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };
+module.exports = { collectExternalParents, collectPropertyOverrides, collectImportBoms, resolveBomManagedVersions, backfillVersions, resolveAndBackfill };

package/lib/maven-version.js

@@ -103,6 +103,14 @@ function compareMavenVersions(aStr, bStr) {
  * spec shape: { version, status, lessThan, lessThanOrEqual, versionType }
  * Returns true if depVersion is affected.
  */
+// A bound participates in comparisons only if it looks like a version. CVE 5.x
+// records carry placeholders in these fields ("log4j-core*", "*", "unspecified")
+// — comparing those as Maven versions is garbage (alpha sorts below numeric), so
+// CVE-2021-44228's `lessThan: "log4j-core*"` used to unmatch every real version.
+function versionLikeBound(s) {
+	return s != null && /^[0-9]/.test(String(s).trim()) && String(s).trim() !== "0";
+}
+
 function isVersionAffected(depVersion, spec) {
 	if (!spec) return false;
 	if (spec.status && spec.status !== "affected") return false;
@@ -110,27 +118,27 @@ function isVersionAffected(depVersion, spec) {
 	const dep = parseMavenVersion(depVersion);
 	if (!dep.segments.length) return false;
 
-	// Fail-closed: a spec with no version constraints at all carries no information.
+	const lower = versionLikeBound(spec.version) && spec.version !== "*" ? spec.version : null;
+	const upperExcl = versionLikeBound(spec.lessThan) ? spec.lessThan : null;
+	const upperIncl = versionLikeBound(spec.lessThanOrEqual) ? spec.lessThanOrEqual : null;
+
+	// Fail-closed: a spec with no usable version constraint carries no information.
 	// Without this guard the function falls through to `return true` for every input,
-	// which was the H1 cascade described in CRITICAL-REVIEW.md.
-	const hasLower = spec.version && spec.version !== "0" && spec.version !== "*";
-	if (!hasLower && !spec.lessThan && !spec.lessThanOrEqual) return false;
+	// which was the H1 cascade described in CRITICAL-REVIEW.md. A wildcard/placeholder
+	// upper on its own does not count ({version:"*", lessThan:"*"} must stay inert).
+	if (!lower && !upperExcl && !upperIncl) return false;
 
 	// Lower bound (inclusive)
-	if (spec.version && spec.version !== "0" && spec.version !== "*") {
-		if (compareMavenVersions(depVersion, spec.version) < 0) return false;
-	}
+	if (lower && compareMavenVersions(depVersion, lower) < 0) return false;
 	// Upper bound exclusive
-	if (spec.lessThan) {
-		if (compareMavenVersions(depVersion, spec.lessThan) >= 0) return false;
-	}
+	if (upperExcl && compareMavenVersions(depVersion, upperExcl) >= 0) return false;
 	// Upper bound inclusive
-	if (spec.lessThanOrEqual) {
-		if (compareMavenVersions(depVersion, spec.lessThanOrEqual) > 0) return false;
-	}
-	// Exact match with no bounds — only affected if equal
-	if (!spec.lessThan && !spec.lessThanOrEqual && spec.version && spec.version !== "0" && spec.version !== "*") {
-		if (compareMavenVersions(depVersion, spec.version) !== 0) return false;
+	if (upperIncl && compareMavenVersions(depVersion, upperIncl) > 0) return false;
+	// Exact match with no upper of ANY kind (not even a wildcard) — only affected if
+	// equal. A wildcard upper ({version:"2.0", lessThan:"log4j-core*"}) instead means
+	// "from 2.0 onward, unbounded", so it must NOT collapse to an exact match.
+	if (lower && spec.lessThan == null && spec.lessThanOrEqual == null) {
+		if (compareMavenVersions(depVersion, lower) !== 0) return false;
 	}
 	return true;
 }
@@ -160,5 +168,6 @@ module.exports = {
 	parseMavenVersion,
 	compareMavenVersions,
 	isVersionAffected,
+	versionLikeBound,
 	parseRange,
 };

package/lib/osv.js

@@ -31,12 +31,16 @@ function cacheKey(g, a, v, ecosystem = "maven") {
 	return `${ecosystem}__${safeG}__${safeA}__${v}.json`;
 }
 
-function readCache(name) {
+// OFFLINE bypasses the TTL (same rule as lib/nvd.js): the warmed cache is the
+// ONLY source on an air-gapped box, so a >12h-old entry must still be served —
+// expiring it there silently reported "0 OSV vulns" for every ecosystem.
+// Online keeps enforcing the TTL so entries refresh normally.
+function readCache(name, { ignoreTtl = false } = {}) {
 	const p = path.join(OSV_CACHE_DIR, name);
 	if (!fs.existsSync(p)) return null;
 	try {
 		const data = JSON.parse(fs.readFileSync(p, "utf8"));
-		if (Date.now() - data._fetchedAt < OSV_CACHE_TTL_MS) return data.body;
+		if (ignoreTtl || Date.now() - data._fetchedAt < OSV_CACHE_TTL_MS) return data.body;
 	} catch { /* ignore */ }
 	return null;
 }
@@ -223,7 +227,7 @@ async function queryBatch(deps, opts = {}) {
 	for (let i = 0; i < deps.length; i++) {
 		const d = deps[i];
 		const ck = cacheKey(d.groupId, d.artifactId, d.version, d.ecosystem || "maven");
-		const hit = readCache(ck);
+		const hit = readCache(ck, { ignoreTtl: !!offline });
 		if (hit !== null) {
 			indexMap[i] = { cached: hit };
 		} else {
@@ -297,7 +301,7 @@ async function queryBatch(deps, opts = {}) {
 	const liveIds = [];
 	for (const id of allIds) {
 		const detailCacheKey = `vuln_${id}.json`;
-		const hit = readCache(detailCacheKey);
+		const hit = readCache(detailCacheKey, { ignoreTtl: !!offline });
 		if (hit) { detailById.set(id, hit); continue; }
 		if (offline) continue;
 		liveIds.push(id);

package/lib/provenance.js

@@ -109,6 +109,8 @@ function runConfiguration(options = {}) {
 		allLibs: options.allLibs !== false,
 		licenses: !!options.licenses,
 		typosquat: !!options.typosquat,
+		certs: options.certs !== false,
+		certExpiryDays: options.certExpiryDays != null ? String(options.certExpiryDays) : null,
 		failOn: options.failOn || "none",
 		ignoreFile: options.ignore || null,
 		vexFile: options.vex || null,

package/lib/sarif-export.js

@@ -42,12 +42,25 @@ function depCoord(dep) {
 	return name;
 }
 
+// Certificate / key-material finding-type metadata → SARIF rule + level. Keyed by
+// the analyze.js issue `type`. security-severity is a CVSS-like number for GitHub.
+const CERT_RULES = {
+	"private-key-committed": { level: "error", score: "9.8", desc: "Committed private key" },
+	"keystore-committed": { level: "warning", score: "5.0", desc: "Committed keystore" },
+	"public-key-committed": { level: "note", score: "2.0", desc: "Committed public key" },
+	"cert-expired": { level: "error", score: "7.5", desc: "Expired certificate" },
+	"cert-expiring": { level: "warning", score: "4.0", desc: "Certificate expiring soon" },
+	"cert-weak-key": { level: "error", score: "7.5", desc: "Weak certificate key" },
+	"cert-weak-signature": { level: "error", score: "7.5", desc: "Weak certificate signature algorithm" },
+	"cert-self-signed": { level: "note", score: "2.0", desc: "Self-signed certificate" },
+};
+
 /**
  * Build a SARIF 2.1.0 object from matches.
- * opts: { projectInfo, toolVersion }
+ * opts: { projectInfo, toolVersion, certFindings }
  */
 function buildSarif(matches, opts = {}) {
-	const { projectInfo = {}, toolVersion = "0" } = opts;
+	const { projectInfo = {}, toolVersion = "0", certFindings = [] } = opts;
 	const srcRoot = projectInfo.src && projectInfo.src.startsWith("(") ? null : projectInfo.src;
 
 	const rulesById = new Map();
@@ -108,6 +121,39 @@ function buildSarif(matches, opts = {}) {
 		});
 	}
 
+	// Certificate / key-material findings: one rule per finding-type, one result per
+	// (file, issue). Located at the file itself (not a manifest).
+	for (const c of certFindings || []) {
+		for (const issue of c.issues || []) {
+			const meta = CERT_RULES[issue.type];
+			if (!meta) continue;
+			const ruleId = `FAD-${issue.type.toUpperCase()}`;
+			if (!rulesById.has(ruleId)) {
+				rulesById.set(ruleId, {
+					id: ruleId, name: ruleId,
+					shortDescription: { text: meta.desc },
+					properties: { "security-severity": meta.score, tags: ["security", "cryptography", "key-material"] },
+				});
+			}
+			const uri = relUri(c.path, srcRoot);
+			const vis = c.keyVisibility ? ` [${c.keyVisibility} key]` : "";
+			results.push({
+				ruleId,
+				level: meta.level,
+				message: { text: `${meta.desc}${vis}: ${issue.message} — ${uri || c.path}` },
+				...(uri ? { locations: [{ physicalLocation: { artifactLocation: { uri } } }] } : {}),
+				partialFingerprints: { fadKey: `${c.sha256 || c.path}|${issue.type}` },
+				properties: {
+					kind: c.kind,
+					...(c.keyVisibility ? { keyVisibility: c.keyVisibility } : {}),
+					...(c.algorithm ? { algorithm: c.algorithm } : {}),
+					...(c.format ? { format: c.format } : {}),
+					...(c.sha256 ? { sha256: c.sha256 } : {}),
+				},
+			});
+		}
+	}
+
 	return {
 		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
 		version: "2.1.0",

package/lib/transitive.js

@@ -181,7 +181,14 @@ function resolveProps(value, props, builtins, depth = 0) {
  * BOM imports inside depMgmt are recursively expanded.
  */
 async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
-	const key = `${g}:${a}:${v}`;
+	// A downstream project inheriting this POM as its <parent> can override a version
+	// property in its own <properties> (the Spring Boot way to patch a managed coord).
+	// opts.propertyOverrides models that: they win over this chain's own property values
+	// when resolving depMgmt. They're part of the cache key so an override-free resolution
+	// (import-BOM path) and an overridden one (parent path) don't collide in effCache.
+	const ovKeys = opts.propertyOverrides ? Object.keys(opts.propertyOverrides) : [];
+	const ovSuffix = ovKeys.length ? "|ov:" + ovKeys.sort().map(k => `${k}=${opts.propertyOverrides[k]}`).join(",") : "";
+	const key = `${g}:${a}:${v}${ovSuffix}`;
 	if (seen.has(key)) return null;
 	// Opt-in cross-call memo (used by the per-module overlay, which resolves the
 	// same shared parents/BOMs once per module). Immutable POMs → the effective
@@ -227,21 +234,28 @@ async function effectivePom(g, a, v, opts = {}, seen = new Set()) {
 		"pom.artifactId": merged.artifactId,
 		"pom.version": merged.version,
 	};
+	// Child overrides win over this chain's own property values (Maven: a child's
+	// <properties> override an inherited parent's). Applies to the PARENT chain only —
+	// import-BOM managed versions resolve in the BOM's own context (stripped below).
+	const effProps = ovKeys.length ? { ...merged.properties, ...opts.propertyOverrides } : merged.properties;
 	const resolveDep = d => ({
 		...d,
-		groupId: resolveProps(d.groupId, merged.properties, builtins),
-		artifactId: resolveProps(d.artifactId, merged.properties, builtins),
-		version: resolveProps(d.version, merged.properties, builtins),
+		groupId: resolveProps(d.groupId, effProps, builtins),
+		artifactId: resolveProps(d.artifactId, effProps, builtins),
+		version: resolveProps(d.version, effProps, builtins),
 	});
 	merged.depMgmt = merged.depMgmt.map(resolveDep);
 	merged.deps = merged.deps.map(resolveDep);
 
 	// Expand BOM imports inside depMgmt: any entry with scope=import + type=pom
-	// is replaced by the depMgmt entries from that imported POM.
+	// is replaced by the depMgmt entries from that imported POM. A <scope>import</scope>
+	// BOM resolves its managed versions in ITS OWN property context — the importing
+	// project's overrides do NOT reach it — so drop propertyOverrides across this boundary.
+	const importOpts = ovKeys.length ? { ...opts, propertyOverrides: undefined } : opts;
 	const expanded = [];
 	for (const dm of merged.depMgmt) {
 		if (dm.scope === "import") {
-			const imported = await effectivePom(dm.groupId, dm.artifactId, dm.version, opts, new Set(seen));
+			const imported = await effectivePom(dm.groupId, dm.artifactId, dm.version, importOpts, new Set(seen));
 			if (imported) expanded.push(...imported.depMgmt);
 		} else {
 			expanded.push(dm);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",