fad-checker 2.4.3 → 2.4.4

package/fad-checker.js

@@ -1203,6 +1203,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 6a-bis. Attribute every match to the manifest/module that actually resolves the
+	// version it matched on. A depRecord is coord-wide (versions[] and manifestPaths[]
+	// with no link between them); a match carries ONE version. Must run after ALL match
+	// sources are merged and before anything reads scope/paths (exec summary, charts,
+	// chapters, exports, gate) — otherwise, on a root spanning several independent
+	// projects, every version is reported against every manifest holding the coord.
+	{
+		const { attributeMatchOrigins } = require("./lib/attribution");
+		const reattributed = attributeMatchOrigins(cveMatches);
+		if (reattributed && verbose) console.log(`   re-attributed ${reattributed} match(es) to their resolving manifest/module`);
+	}
+
 	// 6b. Supply-chain risk lane (pure + offline): flag KNOWN-MALICIOUS advisories
 	// (OSV MAL-… already in the match set) always, and detect suspected TYPOSQUATS
 	// (opt-in --typosquat, heuristic — names one edit from a popular package).

package/lib/attribution.js

@@ -0,0 +1,82 @@
+/**
+ * lib/attribution.js — attribute each MATCH to the manifest/module that actually
+ * resolves the version it was matched on.
+ *
+ * A depRecord is COORD-WIDE: the collectors merge every occurrence of a g:a across the
+ * whole scan root into ONE record, so `versions[]` and `manifestPaths[]` are both
+ * coord-wide sets with no link between them, and `scope` is a single merged value. A
+ * MATCH, by contrast, carries exactly ONE version (matchOne clones the record per
+ * version). Left alone that clone inherits the coord-wide manifest list and the merged
+ * scope — so every version is reported against every manifest holding the coord.
+ *
+ * Invisible on a single reactor; wrong on the real-world shape fad is pointed at: an
+ * audit root holding SEVERAL INDEPENDENT projects (each pom with its own external
+ * parent, no shared reactor). Project A pins jackson-databind 2.15.3, project B pins
+ * 2.17.0 → both projects get reported as holding BOTH versions, and each version's CVEs
+ * land on both. Same class of error for a version the per-module overlay recovered: it
+ * is a TRANSITIVE of one module, not the direct declaration the record describes —
+ * unattributed it tops the exec summary's "direct production dependencies" pointing at
+ * the very pom that pins the fixed version.
+ *
+ * Two provenance sources, checked per match:
+ *   - `maskedVersions[]` (lib/version-overlay) — the version is a transitive of ONE
+ *     module: re-stamp scope/via/depth and file it under that module.
+ *   - `versionPaths{}` (lib/dep-record, maintained by the collectors) — the version is
+ *     DECLARED in a known subset of manifests: narrow the match to that subset.
+ * A version with neither (e.g. a global-pass transitive) is left untouched.
+ *
+ * Runs ONCE, after every match source is merged (CVE index, OSV, snyk) and before
+ * anything reads scope/paths (exec summary, charts, chapters, exports, gate).
+ * Pure w.r.t. the scan set: replaces `m.dep` with a clone, never mutating the shared
+ * record — other matches still reference it.
+ */
+
+/** manifestPaths and pomPaths must stay the SAME array (dep-record.js invariant). */
+function withPaths(dep, paths) {
+	const p = paths.slice();
+	return { ...dep, manifestPaths: p, pomPaths: p };
+}
+
+function sameList(a, b) {
+	const x = a || [], y = b || [];
+	return x.length === y.length && x.every((v, i) => v === y[i]);
+}
+
+/**
+ * @param matches the merged match set (mutated: each m.dep may be replaced by a clone)
+ * @returns number of matches re-attributed
+ */
+function attributeMatchOrigins(matches) {
+	let fixed = 0;
+	for (const m of matches || []) {
+		const dep = m && m.dep;
+		if (!dep || !dep.version) continue;
+		const ver = String(dep.version);
+
+		// 1. Recovered by the per-module overlay → a transitive of ONE module.
+		const masked = dep.scope !== "transitive" && Array.isArray(dep.maskedVersions)
+			? dep.maskedVersions.find(x => String(x.version) === ver)
+			: null;
+		if (masked) {
+			m.dep = {
+				...withPaths(dep, masked.module ? [masked.module] : []),
+				scope: "transitive",
+				via: masked.via || [],
+				viaPaths: masked.viaPaths || (masked.via ? [masked.via] : []),
+				depth: masked.depth,
+			};
+			fixed++;
+			continue;
+		}
+
+		// 2. Declared → narrow to the manifest(s) that declare THIS version.
+		const declared = dep.versionPaths && dep.versionPaths[ver];
+		if (Array.isArray(declared) && declared.length && !sameList(declared, dep.manifestPaths)) {
+			m.dep = withPaths(dep, declared);
+			fixed++;
+		}
+	}
+	return fixed;
+}
+
+module.exports = { attributeMatchOrigins };

package/lib/cve-match.js

@@ -83,6 +83,16 @@ function collectResolvedDeps(allPomMetadata, allPropsByPom, opts = {}) {
 				// A dep is "dev" overall only if every occurrence is test/provided.
 				if (!isDev) existing.isDev = false;
 			}
+			// Remember WHICH pom declares THIS version. The record is coord-wide, so
+			// this is the only link back from a scanned version to its manifest —
+			// without it a match on one version is reported against every pom that
+			// declares the coord at any version (lib/attribution.js consumes this).
+			if (concrete) {
+				const rec = out.get(key);
+				if (!rec.versionPaths) rec.versionPaths = {};
+				const paths = rec.versionPaths[concrete] || (rec.versionPaths[concrete] = []);
+				if (!paths.includes(pomPath)) paths.push(pomPath);
+			}
 		}
 	};
 

package/lib/dep-record.js

@@ -55,6 +55,15 @@ function makeDepRecord(input) {
 		name,
 		version: version || null,
 		versions: concrete ? [concrete] : [],
+		// Per-version → the manifest(s) DECLARING that version. `versions[]` and
+		// `manifestPaths[]` are both coord-wide sets with no link between them, so
+		// neither says which manifest declared which version. A match carries ONE
+		// version, so without this link it renders against EVERY manifest holding the
+		// coord: on a scan root spanning several independent projects (A pins
+		// jackson-databind 2.15.3, B pins 2.17.0) both projects are reported as holding
+		// BOTH versions and each version's CVEs land on both. Maintained on merge by the
+		// collectors; consumed by lib/attribution.js.
+		versionPaths: concrete && manifestPath ? { [concrete]: [manifestPath] } : {},
 		coordKey,
 		provenance,
 		hashes,

package/lib/version-overlay.js

@@ -121,27 +121,48 @@ async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
 }
 
 /**
- * The direct dependencies declared by ONE module, with concrete versions resolved
- * (own ${properties} → module's managed map → the global resolved version). These
- * seed the per-module transitive walk.
+ * The direct dependencies of ONE module, with concrete versions resolved (own
+ * ${properties} → module's managed map → the global resolved version). These seed
+ * the per-module transitive walk.
+ *
+ * Includes the <dependencies> INHERITED from the local parent chain. Maven inherits
+ * them into the child, where they stay DIRECT (depth-0) deps and therefore beat any
+ * transitive of the same coord — but core.js#getAllInheritedProps deliberately does
+ * NOT merge parent <dependencies> into propsByPom[child] (collectResolvedDeps merges
+ * them globally by g:a instead). Reading only the module's own <dependencies> would
+ * hide a parent-declared remediation (e.g. commons-compress:1.27.1 overriding the
+ * vulnerable 1.24.0 that minio pulls in) and let the overlay "recover" the very
+ * version that declaration overrides — fabricating CVEs against a version no
+ * classpath holds.
+ *
+ * Chain is child-first, so the closest declaration of a g:a wins, like Maven. `props`
+ * is the child's merged map (parent props as base, child overrides on top), which is
+ * the right context for a parent-declared dep too.
  */
-function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
+function buildModuleDirects(pomPath, store, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
 	const entry = propsByPom[pomPath];
 	if (!entry) return [];
 	const props = entry.properties || {};
 	const out = [];
-	for (const node of entry.dependencies || []) {
-		const d = flattenSafe(node);
-		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
-		if (d.scope === "test" && !opts.includeTestDeps) continue;
-		if (d.scope === "system" || d.scope === "import") continue;
-		// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
-		const gid = resolveDepVersion(d.groupId, props);
-		const aid = resolveDepVersion(d.artifactId, props);
-		let v = resolveDepVersion(d.rawVersion, props);
-		if (!isConcrete(v)) v = moduleMgmt.get(`${gid}:${aid}`) || resolvedDeps.get(`${gid}:${aid}`)?.version || null;
-		if (!isConcrete(v)) continue;
-		out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+	const seen = new Set();
+	const chain = store ? localChain(pomPath, store).chain : [pomPath];
+	for (const pom of chain) {
+		for (const node of (propsByPom[pom] || {}).dependencies || []) {
+			const d = flattenSafe(node);
+			if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
+			if (d.scope === "test" && !opts.includeTestDeps) continue;
+			if (d.scope === "system" || d.scope === "import") continue;
+			// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+			const gid = resolveDepVersion(d.groupId, props);
+			const aid = resolveDepVersion(d.artifactId, props);
+			const key = `${gid}:${aid}`;
+			if (seen.has(key)) continue;
+			let v = resolveDepVersion(d.rawVersion, props);
+			if (!isConcrete(v)) v = moduleMgmt.get(key) || resolvedDeps.get(key)?.version || null;
+			if (!isConcrete(v)) continue;
+			seen.add(key);
+			out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+		}
 	}
 	return out;
 }
@@ -163,7 +184,7 @@ async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}
 
 	for (const pomPath of Object.keys(propsByPom)) {
 		const moduleMgmt = await buildModuleManagement(pomPath, store, propsByPom, tOpts);
-		const directs = buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, tOpts);
+		const directs = buildModuleDirects(pomPath, store, propsByPom, moduleMgmt, resolvedDeps, tOpts);
 		if (!directs.length) continue;
 		modules++;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",