fad-checker 2.4.3 → 2.4.5

package/lib/version-overlay.js

@@ -121,27 +121,48 @@ async function buildModuleManagement(pomPath, store, propsByPom, opts = {}) {
 }
 
 /**
- * The direct dependencies declared by ONE module, with concrete versions resolved
- * (own ${properties} → module's managed map → the global resolved version). These
- * seed the per-module transitive walk.
+ * The direct dependencies of ONE module, with concrete versions resolved (own
+ * ${properties} → module's managed map → the global resolved version). These seed
+ * the per-module transitive walk.
+ *
+ * Includes the <dependencies> INHERITED from the local parent chain. Maven inherits
+ * them into the child, where they stay DIRECT (depth-0) deps and therefore beat any
+ * transitive of the same coord — but core.js#getAllInheritedProps deliberately does
+ * NOT merge parent <dependencies> into propsByPom[child] (collectResolvedDeps merges
+ * them globally by g:a instead). Reading only the module's own <dependencies> would
+ * hide a parent-declared remediation (e.g. commons-compress:1.27.1 overriding the
+ * vulnerable 1.24.0 that minio pulls in) and let the overlay "recover" the very
+ * version that declaration overrides — fabricating CVEs against a version no
+ * classpath holds.
+ *
+ * Chain is child-first, so the closest declaration of a g:a wins, like Maven. `props`
+ * is the child's merged map (parent props as base, child overrides on top), which is
+ * the right context for a parent-declared dep too.
  */
-function buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
+function buildModuleDirects(pomPath, store, propsByPom, moduleMgmt, resolvedDeps, opts = {}) {
 	const entry = propsByPom[pomPath];
 	if (!entry) return [];
 	const props = entry.properties || {};
 	const out = [];
-	for (const node of entry.dependencies || []) {
-		const d = flattenSafe(node);
-		if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
-		if (d.scope === "test" && !opts.includeTestDeps) continue;
-		if (d.scope === "system" || d.scope === "import") continue;
-		// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
-		const gid = resolveDepVersion(d.groupId, props);
-		const aid = resolveDepVersion(d.artifactId, props);
-		let v = resolveDepVersion(d.rawVersion, props);
-		if (!isConcrete(v)) v = moduleMgmt.get(`${gid}:${aid}`) || resolvedDeps.get(`${gid}:${aid}`)?.version || null;
-		if (!isConcrete(v)) continue;
-		out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+	const seen = new Set();
+	const chain = store ? localChain(pomPath, store).chain : [pomPath];
+	for (const pom of chain) {
+		for (const node of (propsByPom[pom] || {}).dependencies || []) {
+			const d = flattenSafe(node);
+			if (!d || !d.groupId || !d.artifactId || d.optional || d.isImport) continue;
+			if (d.scope === "test" && !opts.includeTestDeps) continue;
+			if (d.scope === "system" || d.scope === "import") continue;
+			// Interpolate ${…} in the coordinate (e.g. ${project.groupId}) like the version.
+			const gid = resolveDepVersion(d.groupId, props);
+			const aid = resolveDepVersion(d.artifactId, props);
+			const key = `${gid}:${aid}`;
+			if (seen.has(key)) continue;
+			let v = resolveDepVersion(d.rawVersion, props);
+			if (!isConcrete(v)) v = moduleMgmt.get(key) || resolvedDeps.get(key)?.version || null;
+			if (!isConcrete(v)) continue;
+			seen.add(key);
+			out.push({ groupId: gid, artifactId: aid, version: String(v), scope: d.scope, exclusions: d.exclusions });
+		}
 	}
 	return out;
 }
@@ -163,7 +184,7 @@ async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}
 
 	for (const pomPath of Object.keys(propsByPom)) {
 		const moduleMgmt = await buildModuleManagement(pomPath, store, propsByPom, tOpts);
-		const directs = buildModuleDirects(pomPath, propsByPom, moduleMgmt, resolvedDeps, tOpts);
+		const directs = buildModuleDirects(pomPath, store, propsByPom, moduleMgmt, resolvedDeps, tOpts);
 		if (!directs.length) continue;
 		modules++;
 
@@ -173,7 +194,17 @@ async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}
 				...tOpts,
 				rootDepMgmt: moduleMgmt,
 				maxDepth: opts.maxDepth || 6,
-				includedScopes: ["compile", "runtime", "provided"],
+				// Maven: `test → compile = test`. A version reachable only through a
+				// test-scoped dep is on that module's TEST classpath, and the global pass
+				// masks it exactly like any other per-module version. Recovering it is the
+				// whole point of this overlay, so "test" has to be an accepted propagated
+				// scope whenever test deps are in scope at all. Measured on Apache Dubbo
+				// 2.7.8: this single omission accounted for ALL 78 findings OSV-Scanner
+				// reported that fad missed (jackson-databind:2.8.4:test in registry-sofa,
+				// hibernate-validator:5.2.4.Final:test in filter-validation, …).
+				includedScopes: opts.includeTestDeps
+					? ["compile", "runtime", "provided", "test"]
+					: ["compile", "runtime", "provided"],
 			});
 		} catch { continue; }
 
@@ -184,11 +215,25 @@ async function expandPerModuleOverlay(resolvedDeps, store, propsByPom, opts = {}
 			if (!existing) continue;                               // additive to coords already scanned
 			if (existing.provenance === "embedded" || existing.provenance === "binary") continue;
 			if (!Array.isArray(existing.versions)) existing.versions = isConcrete(existing.version) ? [existing.version] : [];
-			if (existing.versions.includes(String(v))) continue;   // already scanned this version
-			existing.versions.push(String(v));
+			// Record provenance even when the version is ALREADY in the scan set. Several
+			// modules routinely resolve the same version, and they can disagree on scope —
+			// on Dubbo, jackson-databind:2.10.4 arrives test-scoped in dubbo-config-spring
+			// and COMPILE-scoped in dubbo-configcenter-nacos. Bailing out on the first
+			// module to reach a version left only that module's entry, so
+			// lib/attribution.js saw a single test-scoped provenance and demoted a genuine
+			// production finding to dev. Only the `versions[]` push is conditional.
+			const alreadyScanned = existing.versions.includes(String(v));
+			if (!alreadyScanned) existing.versions.push(String(v));
 			existing.maskedVersions = existing.maskedVersions || [];
-			existing.maskedVersions.push({ version: String(v), via: t.via, viaPaths: t.viaPaths, module: pomPath, depth: t.depth });
-			recovered.push({ coord: key, version: String(v), module: pomPath, had: existing.version });
+			if (existing.maskedVersions.some(x => String(x.version) === String(v) && x.module === pomPath)) continue;
+			// `scope` travels with the recovered version: the record is coord-wide, so this
+			// is the only thing that tells lib/attribution.js whether THIS version sits on a
+			// test classpath. Without it a test-only version inherits the coord's production
+			// flag and inflates the production count.
+			existing.maskedVersions.push({ version: String(v), via: t.via, viaPaths: t.viaPaths, module: pomPath, depth: t.depth, scope: t.scope });
+			// `recovered` reports versions ADDED to the scan set, so a provenance-only entry
+			// for a version another module already contributed must not inflate the count.
+			if (!alreadyScanned) recovered.push({ coord: key, version: String(v), module: pomPath, had: existing.version });
 		}
 	}
 	return { appended: recovered.length, modules, recovered };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.3",
+  "version": "2.4.5",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",