luasec 0.2.0

package/README.md

@@ -0,0 +1,20 @@
+# luasec (npm launcher)
+
+luasec is a static security scanner for Lua in embedded firmware: it finds
+remote code execution without installing Lua tooling.
+
+```sh
+npx luasec <path>
+```
+
+Requirements: macOS or Linux; Lua 5.3+ on PATH, or `make` plus a C compiler
+so the launcher can build the bundled Lua once.
+
+The launcher downloads the release tarball matching this package's version
+once and extracts it into `$LUASEC_CACHE` (else `$XDG_CACHE_HOME/luasec`,
+else `~/.cache/luasec`), then runs the cached `bin/luasec` with your
+arguments. Set `LUASEC_TARBALL=<path>` to install from a local tarball
+instead of downloading (tests, offline installs) and `LUASEC_CACHE=<dir>`
+to choose the cache directory.
+
+See the [main README](https://github.com/Vaibhav91one/luasec#readme) for scanner usage.

package/bin/luasec.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+'use strict';
+// npx luasec: fetch the luasec release that matches this package's version into
+// a cache directory once, then run it. Nothing but Node built-ins, the system
+// tar, and (only when no Lua 5.3+ is on PATH) make and a C compiler.
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const https = require('https');
+const os = require('os');
+const path = require('path');
+
+const { version } = require('../package.json');
+const name = `luasec-${version}`;
+const url = `https://github.com/Vaibhav91one/luasec/releases/download/v${version}/${name}.tar.gz`;
+const cache = process.env.LUASEC_CACHE
+  || path.join(process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache'), 'luasec');
+const root = path.join(cache, name);
+const entry = path.join(root, 'bin', 'luasec');
+
+function fail(message) {
+  process.stderr.write(`luasec (npm): ${message}\n`);
+  process.exit(2);
+}
+
+function download(from, to, redirects = 5) {
+  return new Promise((resolve, reject) => {
+    https.get(from, (res) => {
+      if ([301, 302, 303, 307, 308].includes(res.statusCode) && res.headers.location && redirects > 0) {
+        res.resume();
+        resolve(download(res.headers.location, to, redirects - 1));
+        return;
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        reject(new Error(`GET ${from}: HTTP ${res.statusCode}`));
+        return;
+      }
+      const out = fs.createWriteStream(to);
+      res.pipe(out);
+      out.on('finish', () => out.close(resolve));
+      out.on('error', reject);
+    }).on('error', reject);
+  });
+}
+
+function hasLua() {
+  const probe = spawnSync('lua', ['-e', 'os.exit(tonumber(_VERSION:match("%d+%.%d+")) >= 5.3 and 0 or 1)']);
+  return probe.status === 0;
+}
+
+async function install() {
+  fs.mkdirSync(cache, { recursive: true });
+  const staging = fs.mkdtempSync(path.join(cache, '.staging-'));
+  const tarball = process.env.LUASEC_TARBALL || path.join(staging, `${name}.tar.gz`);
+  if (!process.env.LUASEC_TARBALL) {
+    process.stderr.write(`luasec (npm): downloading ${url}\n`);
+    await download(url, tarball);
+  }
+  const untar = spawnSync('tar', ['xzf', tarball, '-C', staging], { stdio: 'inherit' });
+  if (untar.status !== 0) fail(`cannot extract ${tarball}`);
+  if (!fs.existsSync(path.join(staging, name, 'bin', 'luasec'))) fail(`${tarball} has no ${name}/bin/luasec`);
+  if (!hasLua()) {
+    process.stderr.write('luasec (npm): no Lua 5.3+ on PATH; building Lua once with make (needs a C compiler)\n');
+    const built = spawnSync('make', ['lua'], { cwd: path.join(staging, name), stdio: ['ignore', 2, 2] });
+    if (built.status !== 0) fail('building Lua failed; install Lua 5.3+ or a C compiler and try again');
+  }
+  try {
+    fs.renameSync(path.join(staging, name), root);
+  } catch (error) {
+    // Another first run finished installing the same version while this one
+    // was extracting: use its copy.
+    if (!fs.existsSync(entry)) throw error;
+  }
+  fs.rmSync(staging, { recursive: true, force: true });
+}
+
+(async () => {
+  if (!fs.existsSync(entry)) {
+    try {
+      await install();
+    } catch (error) {
+      fail(error.message);
+    }
+  }
+  const result = spawnSync(entry, process.argv.slice(2), { stdio: 'inherit' });
+  if (result.error) fail(result.error.message);
+  process.exit(result.status === null ? 2 : result.status);
+})();

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "luasec",
+  "version": "0.2.0",
+  "description": "Static security scanner for Lua in embedded firmware: finds remote code execution. Runs luasec without installing Lua tooling.",
+  "bin": { "luasec": "bin/luasec.js" },
+  "files": ["bin/luasec.js", "README.md"],
+  "engines": { "node": ">=18" },
+  "os": ["darwin", "linux"],
+  "repository": { "type": "git", "url": "git+https://github.com/Vaibhav91one/luasec.git" },
+  "homepage": "https://github.com/Vaibhav91one/luasec",
+  "license": "MIT",
+  "keywords": ["lua", "security", "static-analysis", "firmware", "sarif", "openwrt"]
+}