launchprep 0.1.0 → 0.3.0

package/src/checks.mjs

@@ -1,6 +1,7 @@
 // Tier-1 checks: deterministic, no LLM, no network. Each returns findings with
 // a file:line so the user can go straight to it.
 import { AUTHZ_CHECKS } from './checks-authz.mjs';
+import { INJECTION_CHECKS } from './checks-injection.mjs';
 import { AI_CHECKS } from './checks-ai.mjs';
 import { DEPLOY_CHECKS } from './checks-deploy.mjs';
 import { AUTH_CHECKS } from './checks-auth.mjs';
@@ -75,6 +76,12 @@ const BASE_CHECKS = [
       if (!f.text || /\.(md|lock)$/.test(f.path)) continue;
       if (/\.(example|sample|template|dist)$/i.test(f.path) ||
           /\.env\.(example|sample|template)/i.test(f.path)) continue;
+      // A key in a .env file is not hardcoded - .env IS the environment
+      // variable, and telling someone to "move it to an environment variable"
+      // is advice to do the thing they already did. Whether that file is safe
+      // is a question about .gitignore, and SEC-001 is the check that knows
+      // how to ask it.
+      if (/(^|\/)\.env(\.[A-Za-z0-9_-]+)?$/.test(f.path)) continue;
       for (const [re,label] of PATTERNS){
         let m; re.lastIndex=0;
         while ((m=re.exec(f.text))){
@@ -137,7 +144,12 @@ const BASE_CHECKS = [
     const out=[];
     for (const f of repo.files){
       if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
-      const re=/catch\s*\(\s*(\w+)\s*\)\s*\{[^}]{0,200}?(?:json|send)\s*\(\s*\{[^}]{0,120}?\1(?:\.message|\.stack)?/gs;
+      // \b around the backreference, and it is not cosmetic. The catch
+      // variable is usually `e`, and without boundaries that `e` matched the
+      // one inside the word "error" - so `res.json({ error: 'internal', ref })`,
+      // which is the CORRECT handling, was reported as leaking internals.
+      // Found by writing the test pair this check shipped without.
+      const re=/catch\s*\(\s*(\w+)\s*\)\s*\{[^}]{0,200}?(?:json|send)\s*\(\s*\{[^}]{0,120}?\b\1\b(?:\.message|\.stack)?/gs;
       let m;
       while ((m=re.exec(f.text))){
         out.push(finding('API-002','Internal error details returned to the client','high',
@@ -165,7 +177,7 @@ const BASE_CHECKS = [
 const BASE = BASE_CHECKS.filter(c => c.id !== 'AI-003');
 // the fuller AUTH_CHECKS version supersedes the early inline SEC-001
 const B2 = BASE.filter(c => c.id !== 'SEC-001');
-export const CHECKS = [...B2, ...AUTHZ_CHECKS, ...AI_CHECKS, ...DEPLOY_CHECKS, ...AUTH_CHECKS, ...FRAMEWORK_CHECKS, ...BATCH2_CHECKS, ...BATCH3_CHECKS, ...BATCH4_CHECKS];
+export const CHECKS = [...B2, ...AUTHZ_CHECKS, ...AI_CHECKS, ...DEPLOY_CHECKS, ...AUTH_CHECKS, ...FRAMEWORK_CHECKS, ...BATCH2_CHECKS, ...BATCH3_CHECKS, ...BATCH4_CHECKS, ...INJECTION_CHECKS];
 
 // Test and fixture files are not deployed. A "vulnerability" in a spec file is
 // noise, and noise is what makes people stop reading findings.

package/src/fs-scan.mjs

@@ -1,7 +1,7 @@
 // Cheap repo walk. Everything downstream reads from this one pass so we never
 // hit the disk twice for the same file.
 import { readdirSync, readFileSync, statSync, existsSync, lstatSync, realpathSync } from 'node:fs';
-import { join, relative, extname, resolve, sep } from 'node:path';
+import { join, relative, extname, resolve, sep, dirname, posix } from 'node:path';
 
 const SKIP = new Set([
   'node_modules', '.git', '.next', 'dist', 'build', 'out', 'coverage',
@@ -34,6 +34,98 @@ function containedRealPath(root, full) {
   } catch { return null; }
 }
 
+
+// ---- the whole ignore chain, not just the file at the scan root ------------
+// .gitignore is resolved against the GIT repository root, which is often above
+// the directory being scanned. Reading only `<scanroot>/.gitignore` told us our
+// own api/.env was unprotected when the rule excluding it sits one level up, in
+// the repo root - a CRITICAL finding that was simply wrong. Same shape as every
+// other false positive we have had: it judged the file without the context that
+// decides it.
+//
+// Read-only, and it reads .git directly rather than shelling out to git, which
+// verify-readonly.mjs forbids.
+function gitRoot(from) {
+  let d = resolve(from);
+  for (let i = 0; i < 40; i++) {
+    if (existsSync(join(d, '.git'))) return d;
+    const up = dirname(d);
+    if (up === d) return null;
+    d = up;
+  }
+  return null;
+}
+
+// Enough of the gitignore syntax to answer "is this path excluded": globs,
+// anchoring, directory-only rules and negation. Not the whole spec - but the
+// alternative was a regex that guessed, and guessing is what produced the bug.
+function toRegExp(pattern) {
+  let p = pattern;
+  const anchored = p.startsWith('/') || p.slice(0, -1).includes('/');
+  if (p.startsWith('/')) p = p.slice(1);
+  if (p.endsWith('/')) p = p.slice(0, -1);
+  let re = '';
+  for (let i = 0; i < p.length; i++) {
+    const c = p[i];
+    if (c === '*') {
+      if (p[i + 1] === '*') { re += '.*'; i++; if (p[i + 1] === '/') i++; }
+      else re += '[^/]*';
+    }
+    else if (c === '?') re += '[^/]';
+    else re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp('^' + (anchored ? '' : '(?:.*/)?') + re + '(?:/.*)?$');
+}
+
+// Each rule is kept with the directory its .gitignore was written in, because
+// that is what its paths are relative to. Exported so the test shim builds its
+// matcher the same way rather than approximating it.
+export function buildIgnore(rootAbs, sources) {
+  const rules = [];
+  for (const { dir, text } of sources) {
+    for (const raw of String(text ?? '').split('\n')) {
+      const line = raw.trim();
+      if (!line || line.startsWith('#')) continue;
+      const negate = line.startsWith('!');
+      const pattern = negate ? line.slice(1) : line;
+      if (!pattern) continue;
+      rules.push({ dir, re: toRegExp(pattern), negate });
+    }
+  }
+  // last matching rule wins, which is what git does
+  return (relPath) => {
+    const abs = resolve(rootAbs, relPath);
+    let ignored = false;
+    for (const r of rules) {
+      const rel = relative(r.dir, abs);
+      if (!rel || rel.startsWith('..')) continue;
+      if (r.re.test(rel.split(sep).join(posix.sep))) ignored = !r.negate;
+    }
+    return ignored;
+  };
+}
+
+// Every .gitignore from the git root down to the scan root, plus .git/info/exclude.
+export function ignoreChain(root) {
+  const rootAbs = resolve(root);
+  const gr = gitRoot(rootAbs);
+  const dirs = [];
+  if (gr) { let d = rootAbs; while (true) { dirs.unshift(d); if (d === gr) break; const up = dirname(d); if (up === d) break; d = up; } }
+  else dirs.push(rootAbs);
+
+  const sources = [];
+  const readAt = (dir, rel) => { try { return readFileSync(join(dir, rel), 'utf8'); } catch { return null; } };
+  for (const d of dirs) {
+    const t = readAt(d, '.gitignore');
+    if (t !== null) sources.push({ dir: d, text: t });
+  }
+  if (gr) {
+    const t = readAt(gr, join('.git', 'info', 'exclude'));
+    if (t !== null) sources.push({ dir: gr, text: t });
+  }
+  return buildIgnore(rootAbs, sources);
+}
+
 export function scanRepo(root, { maxFiles = 6000 } = {}) {
   const files = [];
   const rootAbs = resolve(root);
@@ -74,6 +166,7 @@ export function scanRepo(root, { maxFiles = 6000 } = {}) {
       files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
     exists: (rel) => existsSync(join(root, rel)),
     read: (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
+    isIgnored: ignoreChain(root),
   };
 }
 

package/src/index.mjs

@@ -5,9 +5,38 @@ import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
 import { runChecks, runRootChecks } from './checks.mjs';
 import { render } from './report.mjs';
+import { existsSync, statSync } from 'node:fs';
 
-const target = process.argv[2] || process.cwd();
-const asJson = process.argv.includes('--json');
+const args = process.argv.slice(2);
+const target = args.find(a => !a.startsWith('-')) || process.cwd();
+const asJson = args.includes('--json');
+
+// --fail-on <severity>: the CI gate. Findings at or above the threshold turn
+// the exit code to 1 so a pipeline can stop the deploy. Opt-in on purpose —
+// a person reading the report in a terminal gets information, a robot gets a
+// verdict only when asked for one.
+const RANK_GATE = { critical: 0, high: 1, medium: 2, low: 3, any: 3 };
+let failOn = null;
+{
+  const i = args.indexOf('--fail-on');
+  if (i !== -1) {
+    failOn = args[i + 1];
+    if (!(failOn in RANK_GATE)) {
+      process.stderr.write(`\n  --fail-on must be one of: critical, high, medium, low, any\n\n`);
+      process.exit(2);
+    }
+  }
+}
+
+// A path that does not exist must be a loud error, never a clean report. A
+// scan of nothing looks exactly like a scan that found nothing, and telling
+// someone they are safe because they mistyped a folder name is the one thing
+// this tool must never do.
+if (!existsSync(target) || !statSync(target).isDirectory()) {
+  process.stderr.write(`\n  \x1b[31mThat path does not exist: ${target}\x1b[0m\n`);
+  process.stderr.write(`  \x1b[2mNothing was scanned. Check the folder name and run it again.\x1b[0m\n\n`);
+  process.exit(2);
+}
 
 const repo = scanRepo(target, { maxFiles: 12000 });
 const packages = splitWorkspaces(repo);
@@ -69,3 +98,9 @@ if (asJson) {
 } else {
   process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
 }
+
+// The gate, after the full report has printed: the human still sees
+// everything, and the pipeline sees the verdict it asked for.
+if (failOn && findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
+  process.exit(1);
+}