guardrail-security 1.0.0

package/src/supply-chain/vulnerability-db.ts

@@ -0,0 +1,386 @@
+/**
+ * Vulnerability Database Integration
+ * 
+ * Integrates with multiple vulnerability databases:
+ * - OSV (Open Source Vulnerabilities)
+ * - GitHub Security Advisories
+ * - NVD (National Vulnerability Database)
+ */
+
+export interface Vulnerability {
+  id: string;
+  source: 'osv' | 'github' | 'nvd' | 'npm';
+  severity: 'low' | 'medium' | 'high' | 'critical';
+  cvssScore?: number;
+  title: string;
+  description: string;
+  affectedVersions: string[];
+  patchedVersions: string[];
+  references: string[];
+  publishedAt: Date;
+  updatedAt: Date;
+  cwe?: string[];
+}
+
+export interface VulnerabilityCheckResult {
+  package: string;
+  version: string;
+  vulnerabilities: Vulnerability[];
+  isVulnerable: boolean;
+  highestSeverity: 'none' | 'low' | 'medium' | 'high' | 'critical';
+  recommendedVersion?: string;
+}
+
+export interface VulnerabilityReport {
+  projectPath: string;
+  scanDate: Date;
+  totalPackages: number;
+  vulnerablePackages: number;
+  results: VulnerabilityCheckResult[];
+  summary: {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+  };
+}
+
+const vulnerabilityCache = new Map<string, { data: Vulnerability[]; fetchedAt: Date }>();
+const CACHE_TTL_MS = 6 * 60 * 60 * 1000; // 6 hours
+
+export class VulnerabilityDatabase {
+  private osvApiUrl = 'https://api.osv.dev/v1';
+  private npmAuditUrl = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk';
+  // GitHub API available for future enhancement with authentication
+  // private githubApiUrl = 'https://api.github.com/advisories';
+
+  /**
+   * Check a single package for vulnerabilities
+   */
+  async checkPackage(name: string, version: string): Promise<VulnerabilityCheckResult> {
+    const cacheKey = `${name}@${version}`;
+    const cached = vulnerabilityCache.get(cacheKey);
+    
+    if (cached && (Date.now() - cached.fetchedAt.getTime()) < CACHE_TTL_MS) {
+      return this.buildResult(name, version, cached.data);
+    }
+
+    const vulnerabilities: Vulnerability[] = [];
+
+    // Query multiple sources in parallel
+    const [osvVulns, npmVulns] = await Promise.allSettled([
+      this.queryOSV(name, version),
+      this.queryNpmAudit(name, version),
+    ]);
+
+    if (osvVulns.status === 'fulfilled') {
+      vulnerabilities.push(...osvVulns.value);
+    }
+
+    if (npmVulns.status === 'fulfilled') {
+      vulnerabilities.push(...npmVulns.value);
+    }
+
+    // Deduplicate by ID
+    const uniqueVulns = this.deduplicateVulnerabilities(vulnerabilities);
+
+    // Cache the result
+    vulnerabilityCache.set(cacheKey, {
+      data: uniqueVulns,
+      fetchedAt: new Date(),
+    });
+
+    return this.buildResult(name, version, uniqueVulns);
+  }
+
+  /**
+   * Check multiple packages in bulk
+   */
+  async checkPackages(packages: { name: string; version: string }[]): Promise<VulnerabilityCheckResult[]> {
+    const batchSize = 20;
+    const results: VulnerabilityCheckResult[] = [];
+
+    for (let i = 0; i < packages.length; i += batchSize) {
+      const batch = packages.slice(i, i + batchSize);
+      const batchResults = await Promise.all(
+        batch.map(pkg => this.checkPackage(pkg.name, pkg.version))
+      );
+      results.push(...batchResults);
+    }
+
+    return results;
+  }
+
+  /**
+   * Query OSV (Open Source Vulnerabilities) API
+   */
+  private async queryOSV(packageName: string, version: string): Promise<Vulnerability[]> {
+    try {
+      const response = await fetch(`${this.osvApiUrl}/query`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          package: {
+            name: packageName,
+            ecosystem: 'npm',
+          },
+          version: version,
+        }),
+        signal: AbortSignal.timeout(10000),
+      });
+
+      if (!response.ok) {
+        return [];
+      }
+
+      const data = await response.json();
+      return this.parseOSVResponse(data);
+    } catch (error) {
+      console.error(`OSV query failed for ${packageName}@${version}:`, error);
+      return [];
+    }
+  }
+
+  /**
+   * Parse OSV API response
+   */
+  private parseOSVResponse(data: any): Vulnerability[] {
+    if (!data.vulns || !Array.isArray(data.vulns)) {
+      return [];
+    }
+
+    return data.vulns.map((vuln: any) => ({
+      id: vuln.id,
+      source: 'osv' as const,
+      severity: this.mapOSVSeverity(vuln.severity),
+      cvssScore: vuln.severity?.[0]?.score,
+      title: vuln.summary || vuln.id,
+      description: vuln.details || '',
+      affectedVersions: this.extractAffectedVersions(vuln.affected),
+      patchedVersions: this.extractPatchedVersions(vuln.affected),
+      references: (vuln.references || []).map((r: any) => r.url),
+      publishedAt: new Date(vuln.published || Date.now()),
+      updatedAt: new Date(vuln.modified || Date.now()),
+      cwe: vuln.database_specific?.cwe_ids || [],
+    }));
+  }
+
+  /**
+   * Query npm audit API
+   */
+  private async queryNpmAudit(packageName: string, version: string): Promise<Vulnerability[]> {
+    try {
+      const response = await fetch(this.npmAuditUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          [packageName]: [version],
+        }),
+        signal: AbortSignal.timeout(10000),
+      });
+
+      if (!response.ok) {
+        return [];
+      }
+
+      const data = await response.json();
+      return this.parseNpmAuditResponse(data, packageName);
+    } catch (error) {
+      console.error(`npm audit query failed for ${packageName}@${version}:`, error);
+      return [];
+    }
+  }
+
+  /**
+   * Parse npm audit response
+   */
+  private parseNpmAuditResponse(data: any, packageName: string): Vulnerability[] {
+    const advisories = data[packageName] || [];
+    
+    return advisories.map((advisory: any) => ({
+      id: `npm-${advisory.id || advisory.github_advisory_id}`,
+      source: 'npm' as const,
+      severity: advisory.severity || 'medium',
+      cvssScore: advisory.cvss?.score,
+      title: advisory.title || 'Security Advisory',
+      description: advisory.overview || advisory.recommendation || '',
+      affectedVersions: [advisory.vulnerable_versions || '*'],
+      patchedVersions: [advisory.patched_versions || 'No patch available'],
+      references: [advisory.url].filter(Boolean),
+      publishedAt: new Date(advisory.created || Date.now()),
+      updatedAt: new Date(advisory.updated || Date.now()),
+      cwe: advisory.cwe ? [advisory.cwe] : [],
+    }));
+  }
+
+  /**
+   * Map OSV severity to standard levels
+   */
+  private mapOSVSeverity(severity: any): 'low' | 'medium' | 'high' | 'critical' {
+    if (!severity || !Array.isArray(severity) || severity.length === 0) {
+      return 'medium';
+    }
+
+    const score = severity[0]?.score || 0;
+    if (score >= 9.0) return 'critical';
+    if (score >= 7.0) return 'high';
+    if (score >= 4.0) return 'medium';
+    return 'low';
+  }
+
+  /**
+   * Extract affected versions from OSV format
+   */
+  private extractAffectedVersions(affected: any[]): string[] {
+    if (!affected || !Array.isArray(affected)) {
+      return ['*'];
+    }
+
+    const versions: string[] = [];
+    for (const aff of affected) {
+      if (aff.versions) {
+        versions.push(...aff.versions);
+      }
+      if (aff.ranges) {
+        for (const range of aff.ranges) {
+          if (range.events) {
+            const introduced = range.events.find((e: any) => e.introduced);
+            const fixed = range.events.find((e: any) => e.fixed);
+            if (introduced) {
+              versions.push(`>=${introduced.introduced}${fixed ? ` <${fixed.fixed}` : ''}`);
+            }
+          }
+        }
+      }
+    }
+
+    return versions.length > 0 ? versions : ['*'];
+  }
+
+  /**
+   * Extract patched versions from OSV format
+   */
+  private extractPatchedVersions(affected: any[]): string[] {
+    if (!affected || !Array.isArray(affected)) {
+      return [];
+    }
+
+    const versions: string[] = [];
+    for (const aff of affected) {
+      if (aff.ranges) {
+        for (const range of aff.ranges) {
+          if (range.events) {
+            const fixed = range.events.find((e: any) => e.fixed);
+            if (fixed) {
+              versions.push(fixed.fixed);
+            }
+          }
+        }
+      }
+    }
+
+    return versions;
+  }
+
+  /**
+   * Deduplicate vulnerabilities by ID
+   */
+  private deduplicateVulnerabilities(vulns: Vulnerability[]): Vulnerability[] {
+    const seen = new Set<string>();
+    return vulns.filter(vuln => {
+      if (seen.has(vuln.id)) {
+        return false;
+      }
+      seen.add(vuln.id);
+      return true;
+    });
+  }
+
+  /**
+   * Build result object
+   */
+  private buildResult(name: string, version: string, vulnerabilities: Vulnerability[]): VulnerabilityCheckResult {
+    const severityOrder = { critical: 4, high: 3, medium: 2, low: 1, none: 0 };
+    
+    let highestSeverity: 'none' | 'low' | 'medium' | 'high' | 'critical' = 'none';
+    for (const vuln of vulnerabilities) {
+      if (severityOrder[vuln.severity] > severityOrder[highestSeverity]) {
+        highestSeverity = vuln.severity;
+      }
+    }
+
+    // Find recommended version from patches
+    const patchedVersions = vulnerabilities.flatMap(v => v.patchedVersions).filter(Boolean);
+    const recommendedVersion = patchedVersions.length > 0 ? patchedVersions[0] : undefined;
+
+    return {
+      package: name,
+      version,
+      vulnerabilities,
+      isVulnerable: vulnerabilities.length > 0,
+      highestSeverity,
+      recommendedVersion,
+    };
+  }
+
+  /**
+   * Generate a full vulnerability report for a project
+   */
+  async generateReport(projectPath: string, packages: { name: string; version: string }[]): Promise<VulnerabilityReport> {
+    const results = await this.checkPackages(packages);
+    
+    const summary = {
+      critical: 0,
+      high: 0,
+      medium: 0,
+      low: 0,
+    };
+
+    for (const result of results) {
+      for (const vuln of result.vulnerabilities) {
+        summary[vuln.severity]++;
+      }
+    }
+
+    const vulnerablePackages = results.filter(r => r.isVulnerable).length;
+
+    return {
+      projectPath,
+      scanDate: new Date(),
+      totalPackages: packages.length,
+      vulnerablePackages,
+      results,
+      summary,
+    };
+  }
+
+  /**
+   * Clear vulnerability cache
+   */
+  clearCache(): void {
+    vulnerabilityCache.clear();
+  }
+
+  /**
+   * Get cache statistics
+   */
+  getCacheStats(): { size: number; oldestEntry: Date | null } {
+    let oldest: Date | null = null;
+    for (const entry of vulnerabilityCache.values()) {
+      if (!oldest || entry.fetchedAt < oldest) {
+        oldest = entry.fetchedAt;
+      }
+    }
+    return {
+      size: vulnerabilityCache.size,
+      oldestEntry: oldest,
+    };
+  }
+}
+
+// Export singleton
+export const vulnerabilityDatabase = new VulnerabilityDatabase();