guardrail-security 1.0.1 → 2.0.0

package/dist/supply-chain/vulnerability-db.js

@@ -2,169 +2,378 @@
 /**
  * Vulnerability Database Integration
  *
- * Integrates with multiple vulnerability databases:
- * - OSV (Open Source Vulnerabilities)
- * - GitHub Security Advisories
- * - NVD (National Vulnerability Database)
+ * Real-time OSV (Open Source Vulnerabilities) integration with:
+ * - Multi-ecosystem support (npm, PyPI, RubyGems, Go)
+ * - Persistent caching with 24h TTL
+ * - Batch request optimization
+ * - CVSS scoring and vectors
+ * - Remediation path analysis
+ * - Optional NVD enrichment for CVE details
+ * - Retry logic with exponential backoff
+ * - Configurable timeouts
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.vulnerabilityDatabase = exports.VulnerabilityDatabase = void 0;
-const vulnerabilityCache = new Map();
-const CACHE_TTL_MS = 6 * 60 * 60 * 1000; // 6 hours
+const fs_1 = require("fs");
+const path_1 = require("path");
+const semver_1 = require("../utils/semver");
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+const CACHE_VERSION = '1.1';
+const DEFAULT_TIMEOUT_MS = 15000;
+const DEFAULT_RETRIES = 3;
+const NVD_API_URL = 'https://services.nvd.nist.gov/rest/json/cves/2.0';
 class VulnerabilityDatabase {
     osvApiUrl = 'https://api.osv.dev/v1';
-    npmAuditUrl = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk';
-    // GitHub API available for future enhancement with authentication
-    // private githubApiUrl = 'https://api.github.com/advisories';
+    cacheDir;
+    cachePath;
+    memoryCache = new Map();
+    cacheHits = 0;
+    cacheMisses = 0;
+    options;
+    constructor(cacheDirOrOptions) {
+        if (typeof cacheDirOrOptions === 'string') {
+            this.options = { cacheDir: cacheDirOrOptions };
+        }
+        else {
+            this.options = cacheDirOrOptions || {};
+        }
+        this.cacheDir = this.options.cacheDir || (0, path_1.join)(process.cwd(), '.guardrail', 'cache');
+        this.cachePath = (0, path_1.join)(this.cacheDir, 'osv.json');
+        if (!this.options.noCache) {
+            this.loadDiskCache();
+        }
+    }
+    /**
+     * Update options at runtime
+     */
+    setOptions(options) {
+        this.options = { ...this.options, ...options };
+        if (options.noCache) {
+            this.memoryCache.clear();
+        }
+    }
+    /**
+     * Load cache from disk
+     */
+    loadDiskCache() {
+        try {
+            if ((0, fs_1.existsSync)(this.cachePath)) {
+                const diskCache = JSON.parse((0, fs_1.readFileSync)(this.cachePath, 'utf-8'));
+                if (diskCache.version === CACHE_VERSION) {
+                    for (const [key, entry] of Object.entries(diskCache.entries)) {
+                        if (Date.now() - entry.fetchedAt < CACHE_TTL_MS) {
+                            this.memoryCache.set(key, entry);
+                        }
+                    }
+                }
+            }
+        }
+        catch (error) {
+            // Cache load failed, start fresh
+        }
+    }
+    /**
+     * Save cache to disk
+     */
+    saveDiskCache() {
+        try {
+            if (!(0, fs_1.existsSync)(this.cacheDir)) {
+                (0, fs_1.mkdirSync)(this.cacheDir, { recursive: true });
+            }
+            const diskCache = {
+                version: CACHE_VERSION,
+                entries: Object.fromEntries(this.memoryCache),
+            };
+            (0, fs_1.writeFileSync)(this.cachePath, JSON.stringify(diskCache, null, 2));
+        }
+        catch (error) {
+            // Cache save failed, continue without caching
+        }
+    }
     /**
      * Check a single package for vulnerabilities
      */
-    async checkPackage(name, version) {
-        const cacheKey = `${name}@${version}`;
-        const cached = vulnerabilityCache.get(cacheKey);
-        if (cached && (Date.now() - cached.fetchedAt.getTime()) < CACHE_TTL_MS) {
-            return this.buildResult(name, version, cached.data);
-        }
-        const vulnerabilities = [];
-        // Query multiple sources in parallel
-        const [osvVulns, npmVulns] = await Promise.allSettled([
-            this.queryOSV(name, version),
-            this.queryNpmAudit(name, version),
-        ]);
-        if (osvVulns.status === 'fulfilled') {
-            vulnerabilities.push(...osvVulns.value);
-        }
-        if (npmVulns.status === 'fulfilled') {
-            vulnerabilities.push(...npmVulns.value);
-        }
-        // Deduplicate by ID
-        const uniqueVulns = this.deduplicateVulnerabilities(vulnerabilities);
-        // Cache the result
-        vulnerabilityCache.set(cacheKey, {
-            data: uniqueVulns,
-            fetchedAt: new Date(),
-        });
-        return this.buildResult(name, version, uniqueVulns);
+    async checkPackage(name, version, ecosystem = 'npm', isDirect = true) {
+        const cacheKey = `${ecosystem}:${name}:${version}`;
+        if (!this.options.noCache) {
+            const cached = this.memoryCache.get(cacheKey);
+            if (cached && (Date.now() - cached.fetchedAt) < CACHE_TTL_MS) {
+                this.cacheHits++;
+                return this.buildResult(name, version, cached.data, ecosystem, isDirect);
+            }
+        }
+        this.cacheMisses++;
+        let vulnerabilities = await this.queryOSVWithRetry(name, version, ecosystem);
+        // Optional NVD enrichment
+        if (this.options.nvdEnrichment && vulnerabilities.length > 0) {
+            vulnerabilities = await this.enrichWithNVD(vulnerabilities);
+        }
+        // Cache the result (unless noCache is set)
+        if (!this.options.noCache) {
+            this.memoryCache.set(cacheKey, {
+                data: vulnerabilities,
+                fetchedAt: Date.now(),
+                ecosystem,
+            });
+            // Persist to disk periodically
+            if ((this.cacheHits + this.cacheMisses) % 10 === 0) {
+                this.saveDiskCache();
+            }
+        }
+        return this.buildResult(name, version, vulnerabilities, ecosystem, isDirect);
     }
     /**
-     * Check multiple packages in bulk
+     * Check multiple packages in bulk with batching
      */
     async checkPackages(packages) {
-        const batchSize = 20;
+        const batchSize = 50;
         const results = [];
-        for (let i = 0; i < packages.length; i += batchSize) {
-            const batch = packages.slice(i, i + batchSize);
-            const batchResults = await Promise.all(batch.map(pkg => this.checkPackage(pkg.name, pkg.version)));
-            results.push(...batchResults);
+        // Group by ecosystem for efficient batching
+        const byEcosystem = new Map();
+        for (const pkg of packages) {
+            const eco = pkg.ecosystem || 'npm';
+            if (!byEcosystem.has(eco)) {
+                byEcosystem.set(eco, []);
+            }
+            byEcosystem.get(eco).push(pkg);
         }
+        // Process each ecosystem in batches
+        for (const [ecosystem, pkgs] of byEcosystem) {
+            for (let i = 0; i < pkgs.length; i += batchSize) {
+                const batch = pkgs.slice(i, i + batchSize);
+                const batchResults = await Promise.all(batch.map(pkg => this.checkPackage(pkg.name, pkg.version, ecosystem, pkg.isDirect ?? true)));
+                results.push(...batchResults);
+            }
+        }
+        // Final cache save
+        this.saveDiskCache();
         return results;
     }
+    /**
+     * Query OSV with retry logic and exponential backoff
+     */
+    async queryOSVWithRetry(packageName, version, ecosystem) {
+        const maxRetries = this.options.retries ?? DEFAULT_RETRIES;
+        const timeout = this.options.timeout ?? DEFAULT_TIMEOUT_MS;
+        for (let attempt = 0; attempt < maxRetries; attempt++) {
+            try {
+                return await this.queryOSV(packageName, version, ecosystem, timeout);
+            }
+            catch {
+                // Exponential backoff: 100ms, 200ms, 400ms...
+                if (attempt < maxRetries - 1) {
+                    await this.delay(100 * Math.pow(2, attempt));
+                }
+            }
+        }
+        // All retries failed
+        return [];
+    }
     /**
      * Query OSV (Open Source Vulnerabilities) API
      */
-    async queryOSV(packageName, version) {
+    async queryOSV(packageName, version, ecosystem, timeout) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
         try {
             const response = await fetch(`${this.osvApiUrl}/query`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
+                    'User-Agent': 'guardrail-cli/1.0',
                 },
                 body: JSON.stringify({
                     package: {
                         name: packageName,
-                        ecosystem: 'npm',
+                        ecosystem: ecosystem,
                     },
                     version: version,
                 }),
-                signal: AbortSignal.timeout(10000),
+                signal: controller.signal,
             });
+            clearTimeout(timeoutId);
             if (!response.ok) {
-                return [];
+                throw new Error(`OSV API returned ${response.status}`);
             }
             const data = await response.json();
-            return this.parseOSVResponse(data);
+            return this.parseOSVResponse(data, version);
         }
         catch (error) {
-            console.error(`OSV query failed for ${packageName}@${version}:`, error);
-            return [];
+            clearTimeout(timeoutId);
+            throw error;
         }
     }
     /**
-     * Parse OSV API response
+     * Enrich vulnerabilities with NVD data (CVSS scores)
      */
-    parseOSVResponse(data) {
-        if (!data.vulns || !Array.isArray(data.vulns)) {
-            return [];
+    async enrichWithNVD(vulnerabilities) {
+        const enriched = [];
+        for (const vuln of vulnerabilities) {
+            // Find CVE alias
+            const cveId = vuln.aliases?.find(a => a.startsWith('CVE-')) ||
+                (vuln.id.startsWith('CVE-') ? vuln.id : null);
+            if (cveId && (!vuln.cvssScore || !vuln.cvssVector)) {
+                try {
+                    const nvdData = await this.queryNVD(cveId);
+                    if (nvdData) {
+                        enriched.push({
+                            ...vuln,
+                            cvssScore: nvdData.cvssScore ?? vuln.cvssScore,
+                            cvssVector: nvdData.cvssVector ?? vuln.cvssVector,
+                            severity: nvdData.severity ?? vuln.severity,
+                        });
+                        continue;
+                    }
+                }
+                catch {
+                    // NVD enrichment failed, continue with original data
+                }
+            }
+            enriched.push(vuln);
         }
-        return data.vulns.map((vuln) => ({
-            id: vuln.id,
-            source: 'osv',
-            severity: this.mapOSVSeverity(vuln.severity),
-            cvssScore: vuln.severity?.[0]?.score,
-            title: vuln.summary || vuln.id,
-            description: vuln.details || '',
-            affectedVersions: this.extractAffectedVersions(vuln.affected),
-            patchedVersions: this.extractPatchedVersions(vuln.affected),
-            references: (vuln.references || []).map((r) => r.url),
-            publishedAt: new Date(vuln.published || Date.now()),
-            updatedAt: new Date(vuln.modified || Date.now()),
-            cwe: vuln.database_specific?.cwe_ids || [],
-        }));
+        return enriched;
     }
     /**
-     * Query npm audit API
+     * Query NVD API for CVE details
      */
-    async queryNpmAudit(packageName, version) {
+    async queryNVD(cveId) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), 5000); // Shorter timeout for enrichment
         try {
-            const response = await fetch(this.npmAuditUrl, {
-                method: 'POST',
+            const response = await fetch(`${NVD_API_URL}?cveId=${encodeURIComponent(cveId)}`, {
+                method: 'GET',
                 headers: {
-                    'Content-Type': 'application/json',
+                    'User-Agent': 'guardrail-cli/1.0',
                 },
-                body: JSON.stringify({
-                    [packageName]: [version],
-                }),
-                signal: AbortSignal.timeout(10000),
+                signal: controller.signal,
             });
+            clearTimeout(timeoutId);
             if (!response.ok) {
-                return [];
+                return null;
             }
             const data = await response.json();
-            return this.parseNpmAuditResponse(data, packageName);
+            const vulns = data['vulnerabilities'];
+            const cveWrapper = vulns?.[0];
+            const cve = cveWrapper?.['cve'];
+            if (!cve)
+                return null;
+            // Extract CVSS v3.1 or v3.0 metrics
+            const metricsObj = cve['metrics'];
+            const cvssV31 = metricsObj?.['cvssMetricV31'];
+            const cvssV30 = metricsObj?.['cvssMetricV30'];
+            const metrics = cvssV31?.[0] || cvssV30?.[0];
+            if (!metrics)
+                return null;
+            const cvssData = metrics['cvssData'];
+            return {
+                cvssScore: cvssData?.['baseScore'],
+                cvssVector: cvssData?.['vectorString'],
+                severity: this.mapCVSSSeverity(cvssData?.['baseScore']),
+            };
         }
-        catch (error) {
-            console.error(`npm audit query failed for ${packageName}@${version}:`, error);
+        catch {
+            clearTimeout(timeoutId);
+            return null;
+        }
+    }
+    /**
+     * Map CVSS score to severity level
+     */
+    mapCVSSSeverity(score) {
+        if (!score)
+            return 'medium';
+        if (score >= 9.0)
+            return 'critical';
+        if (score >= 7.0)
+            return 'high';
+        if (score >= 4.0)
+            return 'medium';
+        return 'low';
+    }
+    /**
+     * Delay helper for retry backoff
+     */
+    delay(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+    /**
+     * Parse OSV API response
+     */
+    parseOSVResponse(data, currentVersion) {
+        if (!data.vulns || !Array.isArray(data.vulns)) {
             return [];
         }
+        return data.vulns
+            .filter((vuln) => {
+            // Verify this version is actually affected
+            if (!vuln.affected || !Array.isArray(vuln.affected))
+                return false;
+            return this.isVersionAffected(currentVersion, vuln.affected);
+        })
+            .map((vuln) => {
+            const severity = vuln.severity?.[0] || vuln.database_specific?.severity_score;
+            return {
+                id: vuln.id,
+                source: 'osv',
+                severity: this.mapOSVSeverity(severity),
+                cvssScore: severity?.score || severity?.cvss_score,
+                cvssVector: severity?.vector || severity?.cvss_vector,
+                title: vuln.summary || vuln.id,
+                description: vuln.details || '',
+                affectedVersions: this.extractAffectedVersions(vuln.affected),
+                patchedVersions: this.extractPatchedVersions(vuln.affected),
+                references: (vuln.references || []).map((r) => r.url).filter(Boolean),
+                publishedAt: new Date(vuln.published || Date.now()),
+                updatedAt: new Date(vuln.modified || Date.now()),
+                cwe: vuln.database_specific?.cwe_ids || [],
+                aliases: vuln.aliases || [],
+            };
+        });
     }
     /**
-     * Parse npm audit response
+     * Check if a version is affected by vulnerability ranges
      */
-    parseNpmAuditResponse(data, packageName) {
-        const advisories = data[packageName] || [];
-        return advisories.map((advisory) => ({
-            id: `npm-${advisory.id || advisory.github_advisory_id}`,
-            source: 'npm',
-            severity: advisory.severity || 'medium',
-            cvssScore: advisory.cvss?.score,
-            title: advisory.title || 'Security Advisory',
-            description: advisory.overview || advisory.recommendation || '',
-            affectedVersions: [advisory.vulnerable_versions || '*'],
-            patchedVersions: [advisory.patched_versions || 'No patch available'],
-            references: [advisory.url].filter(Boolean),
-            publishedAt: new Date(advisory.created || Date.now()),
-            updatedAt: new Date(advisory.updated || Date.now()),
-            cwe: advisory.cwe ? [advisory.cwe] : [],
-        }));
+    isVersionAffected(version, affected) {
+        for (const aff of affected) {
+            if (aff.ranges) {
+                for (const range of aff.ranges) {
+                    if (range.type === 'SEMVER' && range.events) {
+                        let introduced = '0.0.0';
+                        let fixed = null;
+                        for (const event of range.events) {
+                            if (event.introduced)
+                                introduced = event.introduced;
+                            if (event.fixed)
+                                fixed = event.fixed;
+                        }
+                        const afterIntroduced = (0, semver_1.compareSemver)(version, introduced) >= 0;
+                        const beforeFixed = !fixed || (0, semver_1.compareSemver)(version, fixed) < 0;
+                        if (afterIntroduced && beforeFixed) {
+                            return true;
+                        }
+                    }
+                }
+            }
+            // Also check explicit versions
+            if (aff.versions && Array.isArray(aff.versions)) {
+                if (aff.versions.includes(version)) {
+                    return true;
+                }
+            }
+        }
+        return false;
     }
     /**
      * Map OSV severity to standard levels
      */
     mapOSVSeverity(severity) {
-        if (!severity || !Array.isArray(severity) || severity.length === 0) {
+        if (!severity)
             return 'medium';
+        // Handle array format
+        if (Array.isArray(severity) && severity.length > 0) {
+            severity = severity[0];
         }
-        const score = severity[0]?.score || 0;
+        const score = severity.score || severity.cvss_score || 0;
         if (score >= 9.0)
             return 'critical';
         if (score >= 7.0)
@@ -222,22 +431,46 @@ class VulnerabilityDatabase {
         return versions;
     }
     /**
-     * Deduplicate vulnerabilities by ID
+     * Calculate remediation path for a vulnerability
      */
-    deduplicateVulnerabilities(vulns) {
-        const seen = new Set();
-        return vulns.filter(vuln => {
-            if (seen.has(vuln.id)) {
-                return false;
-            }
-            seen.add(vuln.id);
-            return true;
+    calculateRemediationPath(currentVersion, patchedVersions) {
+        if (patchedVersions.length === 0) {
+            return {
+                action: 'remove',
+                breakingChange: false,
+                description: 'No fix available. Consider removing or replacing this dependency.',
+            };
+        }
+        // Find nearest non-breaking upgrade
+        const currentParts = currentVersion.split('.').map(Number);
+        const currentMajor = currentParts[0] || 0;
+        const nonBreaking = patchedVersions.filter(v => {
+            const parts = v.split('.').map(Number);
+            return (parts[0] || 0) === currentMajor;
         });
+        if (nonBreaking.length > 0) {
+            // Sort and pick the lowest non-breaking version
+            const sorted = nonBreaking.sort(semver_1.compareSemver);
+            return {
+                action: 'upgrade',
+                targetVersion: sorted[0],
+                breakingChange: false,
+                description: `Upgrade to ${sorted[0]} (non-breaking)`,
+            };
+        }
+        // Breaking change required
+        const sorted = patchedVersions.sort(semver_1.compareSemver);
+        return {
+            action: 'upgrade',
+            targetVersion: sorted[0],
+            breakingChange: true,
+            description: `Upgrade to ${sorted[0]} (breaking change - major version bump)`,
+        };
     }
     /**
      * Build result object
      */
-    buildResult(name, version, vulnerabilities) {
+    buildResult(name, version, vulnerabilities, _ecosystem, isDirect) {
         const severityOrder = { critical: 4, high: 3, medium: 2, low: 1, none: 0 };
         let highestSeverity = 'none';
         for (const vuln of vulnerabilities) {
@@ -245,9 +478,13 @@ class VulnerabilityDatabase {
                 highestSeverity = vuln.severity;
             }
         }
-        // Find recommended version from patches
+        // Collect all patched versions
         const patchedVersions = vulnerabilities.flatMap(v => v.patchedVersions).filter(Boolean);
         const recommendedVersion = patchedVersions.length > 0 ? patchedVersions[0] : undefined;
+        // Calculate remediation path
+        const remediationPath = vulnerabilities.length > 0
+            ? this.calculateRemediationPath(version, patchedVersions)
+            : undefined;
         return {
             package: name,
             version,
@@ -255,12 +492,14 @@ class VulnerabilityDatabase {
             isVulnerable: vulnerabilities.length > 0,
             highestSeverity,
             recommendedVersion,
+            isDirect,
+            remediationPath,
         };
     }
     /**
      * Generate a full vulnerability report for a project
      */
-    async generateReport(projectPath, packages) {
+    async generateReport(projectPath, packages, ecosystem = 'npm') {
         const results = await this.checkPackages(packages);
         const summary = {
             critical: 0,
@@ -268,12 +507,23 @@ class VulnerabilityDatabase {
             medium: 0,
             low: 0,
         };
+        let directVulnerabilities = 0;
+        let transitiveVulnerabilities = 0;
         for (const result of results) {
             for (const vuln of result.vulnerabilities) {
                 summary[vuln.severity]++;
+                if (result.isDirect) {
+                    directVulnerabilities++;
+                }
+                else {
+                    transitiveVulnerabilities++;
+                }
             }
         }
         const vulnerablePackages = results.filter(r => r.isVulnerable).length;
+        const cacheHitRate = this.cacheHits + this.cacheMisses > 0
+            ? this.cacheHits / (this.cacheHits + this.cacheMisses)
+            : 0;
         return {
             projectPath,
             scanDate: new Date(),
@@ -281,27 +531,66 @@ class VulnerabilityDatabase {
             vulnerablePackages,
             results,
             summary,
+            ecosystem,
+            directVulnerabilities,
+            transitiveVulnerabilities,
+            cacheHitRate,
         };
     }
     /**
      * Clear vulnerability cache
      */
     clearCache() {
-        vulnerabilityCache.clear();
+        this.memoryCache.clear();
+        this.cacheHits = 0;
+        this.cacheMisses = 0;
+        try {
+            if ((0, fs_1.existsSync)(this.cachePath)) {
+                (0, fs_1.writeFileSync)(this.cachePath, JSON.stringify({ version: CACHE_VERSION, entries: {} }));
+            }
+        }
+        catch {
+            // Ignore
+        }
+    }
+    /**
+     * Clear entire cache directory
+     */
+    static clearCacheDirectory(cacheDir) {
+        const targetDir = cacheDir || (0, path_1.join)(process.cwd(), '.guardrail', 'cache');
+        try {
+            if ((0, fs_1.existsSync)(targetDir)) {
+                (0, fs_1.rmSync)(targetDir, { recursive: true, force: true });
+                (0, fs_1.mkdirSync)(targetDir, { recursive: true });
+            }
+            return { success: true, path: targetDir };
+        }
+        catch (error) {
+            return {
+                success: false,
+                path: targetDir,
+                error: error instanceof Error ? error.message : 'Unknown error'
+            };
+        }
     }
     /**
      * Get cache statistics
      */
     getCacheStats() {
         let oldest = null;
-        for (const entry of vulnerabilityCache.values()) {
-            if (!oldest || entry.fetchedAt < oldest) {
-                oldest = entry.fetchedAt;
+        for (const entry of this.memoryCache.values()) {
+            const date = new Date(entry.fetchedAt);
+            if (!oldest || date < oldest) {
+                oldest = date;
             }
         }
+        const hitRate = this.cacheHits + this.cacheMisses > 0
+            ? this.cacheHits / (this.cacheHits + this.cacheMisses)
+            : 0;
         return {
-            size: vulnerabilityCache.size,
+            size: this.memoryCache.size,
             oldestEntry: oldest,
+            hitRate,
         };
     }
 }