mobbdev 0.0.169 → 0.0.171

package/dist/index.mjs

@@ -122,6 +122,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["ErroneousStringCompare"] = "ERRONEOUS_STRING_COMPARE";
   IssueType_Enum2["ErrorCondtionWithoutAction"] = "ERROR_CONDTION_WITHOUT_ACTION";
   IssueType_Enum2["GraphqlDepthLimit"] = "GRAPHQL_DEPTH_LIMIT";
+  IssueType_Enum2["HardcodedDomainInHtml"] = "HARDCODED_DOMAIN_IN_HTML";
   IssueType_Enum2["HardcodedSecrets"] = "HARDCODED_SECRETS";
   IssueType_Enum2["HeaderManipulation"] = "HEADER_MANIPULATION";
   IssueType_Enum2["HtmlCommentInJsp"] = "HTML_COMMENT_IN_JSP";
@@ -144,6 +145,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["LogForging"] = "LOG_FORGING";
   IssueType_Enum2["MissingAntiforgeryValidation"] = "MISSING_ANTIFORGERY_VALIDATION";
   IssueType_Enum2["MissingCheckAgainstNull"] = "MISSING_CHECK_AGAINST_NULL";
+  IssueType_Enum2["MissingCspHeader"] = "MISSING_CSP_HEADER";
   IssueType_Enum2["MissingEqualsOrHashcode"] = "MISSING_EQUALS_OR_HASHCODE";
   IssueType_Enum2["MissingHstsHeader"] = "MISSING_HSTS_HEADER";
   IssueType_Enum2["NonFinalPublicStaticField"] = "NON_FINAL_PUBLIC_STATIC_FIELD";
@@ -188,14 +190,14 @@ var Project_Role_Type_Enum = /* @__PURE__ */ ((Project_Role_Type_Enum2) => {
   Project_Role_Type_Enum2["Writer"] = "writer";
   return Project_Role_Type_Enum2;
 })(Project_Role_Type_Enum || {});
-var Vulnerability_Report_Vendor_Enum = /* @__PURE__ */ ((Vulnerability_Report_Vendor_Enum3) => {
-  Vulnerability_Report_Vendor_Enum3["Checkmarx"] = "checkmarx";
-  Vulnerability_Report_Vendor_Enum3["CheckmarxXml"] = "checkmarxXml";
-  Vulnerability_Report_Vendor_Enum3["Codeql"] = "codeql";
-  Vulnerability_Report_Vendor_Enum3["Fortify"] = "fortify";
-  Vulnerability_Report_Vendor_Enum3["Snyk"] = "snyk";
-  Vulnerability_Report_Vendor_Enum3["Sonarqube"] = "sonarqube";
-  return Vulnerability_Report_Vendor_Enum3;
+var Vulnerability_Report_Vendor_Enum = /* @__PURE__ */ ((Vulnerability_Report_Vendor_Enum4) => {
+  Vulnerability_Report_Vendor_Enum4["Checkmarx"] = "checkmarx";
+  Vulnerability_Report_Vendor_Enum4["CheckmarxXml"] = "checkmarxXml";
+  Vulnerability_Report_Vendor_Enum4["Codeql"] = "codeql";
+  Vulnerability_Report_Vendor_Enum4["Fortify"] = "fortify";
+  Vulnerability_Report_Vendor_Enum4["Snyk"] = "snyk";
+  Vulnerability_Report_Vendor_Enum4["Sonarqube"] = "sonarqube";
+  return Vulnerability_Report_Vendor_Enum4;
 })(Vulnerability_Report_Vendor_Enum || {});
 var Vulnerability_Severity_Enum = /* @__PURE__ */ ((Vulnerability_Severity_Enum2) => {
   Vulnerability_Severity_Enum2["Critical"] = "critical";
@@ -308,7 +310,7 @@ var GetAnalsyisDocument = `
 var GetFixesDocument = `
     query getFixes($filters: fix_bool_exp!) {
   fixes: fix(where: $filters) {
-    issueType
+    safeIssueType
     id
     vulnerabilitySeverity
     issueLanguage
@@ -738,7 +740,7 @@ var ReportQueryResultZ = z.object({
       z.object({
         id: z.string().uuid(),
         issueLanguage: z.nativeEnum(IssueLanguage_Enum).nullable(),
-        issueType: z.nativeEnum(IssueType_Enum).nullable(),
+        safeIssueType: z.string(),
         confidence: z.number(),
         effortToApplyFix: z.nativeEnum(Effort_To_Apply_Fix_Enum).nullable(),
         modifiedBy: z.string().nullable(),
@@ -833,7 +835,7 @@ var ReportFixesQueryZ = z.array(
     gitBlameLogin: z.string().nullable(),
     effortToApplyFix: z.nativeEnum(Effort_To_Apply_Fix_Enum).nullable(),
     issueLanguage: z.nativeEnum(IssueLanguage_Enum).nullable(),
-    issueType: z.nativeEnum(IssueType_Enum).nullable(),
+    safeIssueType: z.string(),
     vulnerabilitySeverity: z.nativeEnum(Vulnerability_Severity_Enum).nullable().transform((i) => i ?? "low" /* Low */),
     fixReportId: z.string().uuid(),
     filePaths: z.array(
@@ -903,7 +905,8 @@ var FixQueryZ = z.object({
   modifiedBy: z.string().nullable(),
   gitBlameLogin: z.string().nullable(),
   issueLanguage: z.nativeEnum(IssueLanguage_Enum).nullable(),
-  issueType: z.nativeEnum(IssueType_Enum).nullable(),
+  safeIssueType: z.string(),
+  // issueType: z.nativeEnum(IssueType_Enum).nullable(),
   confidence: z.number(),
   fixReportId: z.string().uuid(),
   isExpired: z.boolean().default(false),
@@ -919,7 +922,6 @@ var FixQueryZ = z.object({
   vulnerabilityReportIssues: z.array(
     z.object({
       vendorIssueId: z.string(),
-      issueType: z.string(),
       issueLanguage: z.string()
     })
   ),
@@ -990,7 +992,17 @@ var FixScreenQueryResultZ = z.object({
       }).array()
     })
   }),
-  fix_by_pk: FixQueryZ,
+  fix_by_pk: FixQueryZ.merge(
+    z.object({
+      vulnerabilityReportIssues: z.array(
+        z.object({
+          vendorIssueId: z.string(),
+          issueType: z.string(),
+          issueLanguage: z.string()
+        })
+      )
+    })
+  ),
   fixesWithSameIssueType: z.object({
     fix: z.array(z.object({ id: z.string().uuid() }))
   })
@@ -1529,7 +1541,9 @@ var fixDetailsData = {
   ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: {
     issueDescription: "The lack of a rate limit can allow denial-of-service attacks, in which an attacker can cause the application to crash or become unresponsive by issuing a large number of requests simultaneously.",
     fixInstructions: "Use express-rate-limit npm package to set a rate limit."
-  }
+  },
+  ["MISSING_CSP_HEADER" /* MissingCspHeader */]: void 0,
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/getIssueType.ts
@@ -1605,10 +1619,12 @@ var issueTypeMap = {
   ["POOR_ERROR_HANDLING_EMPTY_CATCH_BLOCK" /* PoorErrorHandlingEmptyCatchBlock */]: "Poor Error Handling: Empty Catch Block",
   ["ERRONEOUS_STRING_COMPARE" /* ErroneousStringCompare */]: "Erroneous String Compare",
   ["UNVALIDATED_PUBLIC_METHOD_ARGUMENT" /* UnvalidatedPublicMethodArgument */]: "Unvalidated Public Method Argument",
-  ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: "Auto-escape False"
+  ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: "Auto-escape False",
+  ["MISSING_CSP_HEADER" /* MissingCspHeader */]: "Missing CSP Header",
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: "Hardcoded Domain in HTML"
 };
 var issueTypeZ = z4.nativeEnum(IssueType_Enum);
-var getIssueType = (issueType) => {
+var getIssueTypeFriendlyString = (issueType) => {
   const issueTypeZParseRes = issueTypeZ.safeParse(issueType);
   if (!issueTypeZParseRes.success) {
     return issueType ? issueType.replaceAll("_", " ") : "Other";
@@ -1643,7 +1659,7 @@ var getCommitDescription = ({
   if (!staticData) {
     return "";
   }
-  const issueTypeString = getIssueType(issueType);
+  const issueTypeString = getIssueTypeFriendlyString(issueType);
   let description = `This change fixes a **${severity} severity** (${severityToEmoji[severity]}) **${issueTypeString}** issue reported by **${capitalizeFirstLetter(
     vendor
   )}**.
@@ -2603,6 +2619,15 @@ Make sure to pick a value large enough to allowed the nessecary amount of nested
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/js/hardcodedDomainInHtml.ts
+var hardcodedDomainInHtml = {
+  isCDNFixedVersion: {
+    content: ({ url }) => `Does the content of \`${url}\` change over time? If it does, we can't offer this fix.`,
+    description: () => "You need to make sure the content of the file you are loading from the external source is persistent. To guarantee the integrity hash does not change over time, please make sure you use a proper CDN and version of the script you are loading is pinned.",
+    guidance: () => ""
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/js/hardcodedSecrets.ts
 var hardcodedSecrets2 = {
   envVarName: {
@@ -2669,6 +2694,43 @@ var logForging3 = {
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/js/missingCSPHeader.ts
+var cspHeaderValue = {
+  cspHeaderValue: {
+    content: () => "Please provide the value for the Content-Security-Policy header",
+    description: () => `The Content-Security-Policy (CSP) header is a critical security measure that helps protect websites from various attacks, particularly Cross-Site Scripting (XSS) and other code injection attacks. Here's a concise explanation:
+    
+     
+ 
+    **What it does**:
+    
+     
+ 
+    CSP lets you specify which content sources the browser should consider valid, essentially creating a whitelist of trusted content. It controls things like:
+    
+     
+ 
+    - Which scripts can execute.    
+     - Where images can be loaded from.    
+     - Which styles can be applied.    
+     - Which forms can be submitted to.    
+     - What domains can be connected to.    
+     
+     Default value explanation:    
+     
+     - default-src 'self: Only allows resources from the same origin by default.    
+     - script-src 'self': Only allows scripts to be loaded from the same origin.    
+     - style-src 'self': Only allows styles from the same origin.    
+&nbsp;    - object-src 'none': Disallows <object>, <embed>, and <applet> elements.    
+&nbsp;    - base-uri 'self': Restricts where the <base> tag can point to.    
+&nbsp;    - frame-ancestors 'self': Ensures that only the same origin can embed the page using an iframe.
+    
+&nbsp;    
+&nbsp;    **This kind of \`CSP\` is more secure but may require adjustments for your specific application, especially if you need to load resources from external domains or use inline scripts/styles.**`,
+    guidance: () => ``
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/js/missingHSTSHeader.ts
 var headerMaxAge = {
   headerMaxAge: {
@@ -2823,7 +2885,9 @@ var vulnerabilities9 = {
   ["HARDCODED_SECRETS" /* HardcodedSecrets */]: hardcodedSecrets2,
   ["MISSING_HSTS_HEADER" /* MissingHstsHeader */]: headerMaxAge,
   ["UNCHECKED_LOOP_CONDITION" /* UncheckedLoopCondition */]: uncheckedLoopCondition2,
-  ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling2
+  ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling2,
+  ["MISSING_CSP_HEADER" /* MissingCspHeader */]: cspHeaderValue,
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: hardcodedDomainInHtml
 };
 var js_default = vulnerabilities9;
 
@@ -2941,12 +3005,20 @@ function getFixGuidances({
   const fixGuidance = storeFixResult.success ? [storeFixResult.data.guidance({ questions, ...extraContext })] : [];
   return libGuidances.concat(fixGuidance).filter((guidance) => !!guidance);
 }
-function getGuidances({
-  questions,
-  issueType,
-  issueLanguage,
-  fixExtraContext
-}) {
+var IssueTypeAndLanguageZ = z8.object({
+  issueType: z8.nativeEnum(IssueType_Enum),
+  issueLanguage: z8.nativeEnum(IssueLanguage_Enum)
+});
+function getGuidances(args) {
+  const safeIssueTypeAndLanguage = IssueTypeAndLanguageZ.safeParse({
+    issueType: args.issueType,
+    issueLanguage: args.issueLanguage
+  });
+  if (!safeIssueTypeAndLanguage.success) {
+    return [];
+  }
+  const { questions, fixExtraContext } = args;
+  const { issueType, issueLanguage } = safeIssueTypeAndLanguage.data;
   const fixGuidances = getFixGuidances({
     issueType,
     issueLanguage,
@@ -2957,8 +3029,8 @@ function getGuidances({
     let questionGuidance = question.guidance;
     if (!questionGuidance && issueType && issueLanguage) {
       const getFixInformation = curriedQuestionInformationByQuestion({
-        issueType: z8.nativeEnum(IssueType_Enum).parse(issueType),
-        language: z8.nativeEnum(IssueLanguage_Enum).parse(issueLanguage)
+        issueType,
+        language: issueLanguage
       });
       const { guidance } = getFixInformation(question);
       questionGuidance = guidance({
@@ -5819,10 +5891,12 @@ async function getAdoSdk(params) {
       try {
         const branchStatus = await git.getBranch(repo, branch, projectName);
         if (!branchStatus || !branchStatus.commit) {
+          console.log(`no branch status: ${JSON.stringify(branchStatus)}`);
           throw new InvalidRepoUrlError("no branch status");
         }
         return branchStatus.name === branch;
       } catch (e) {
+        console.error(`error in getAdoIsRemoteBranch: ${JSON.stringify(e)}`);
         return false;
       }
     },
@@ -6252,20 +6326,33 @@ Refresh the page in order to see the changes.`,
     redirectUrl: commentRes.data.html_url,
     commentId
   });
-  const issueType = getIssueType(fix.issueType ?? null);
+  const issueType = getIssueTypeFriendlyString(fix.safeIssueType);
   const title = `# ${MobbIconMarkdown} ${issueType} fix is ready`;
   const patchAndQuestions = await PatchAndQuestionsZ.parseAsync(
     fix.patchAndQuestions
   );
+  const validFixParseRes = z18.object({
+    vulnerabilitySeverity: z18.nativeEnum(Vulnerability_Severity_Enum),
+    issueLanguage: z18.nativeEnum(IssueLanguage_Enum),
+    safeIssueType: z18.nativeEnum(IssueType_Enum)
+  }).safeParse(fix);
+  if (!validFixParseRes.success) {
+    debug5(
+      `fix ${fixId} does not have all the required fields to create a comment`,
+      validFixParseRes.error
+    );
+    return;
+  }
+  const validFix = validFixParseRes.data;
   const subTitle = getCommitDescription({
-    issueType: fix.issueType,
+    issueType: validFix.safeIssueType,
     vendor: scanner,
-    severity: fix.vulnerabilitySeverity,
-    issueLanguage: fix.issueLanguage,
+    severity: validFix.vulnerabilitySeverity,
+    issueLanguage: validFix.issueLanguage,
     guidances: getGuidances({
       questions: patchAndQuestions.questions.map(toQuestion),
-      issueType: fix.issueType,
-      issueLanguage: fix.issueLanguage,
+      issueType: validFix.safeIssueType,
+      issueLanguage: validFix.issueLanguage,
       fixExtraContext: patchAndQuestions.extraContext
     })
   });
@@ -6297,7 +6384,7 @@ function buildAnalysisSummaryComment(params) {
         if (!fix) {
           throw new Error(`fix ${vulnerabilityReportIssue.fixId} not found`);
         }
-        const issueType = getIssueType(fix.issueType ?? null);
+        const issueType = getIssueTypeFriendlyString(fix.safeIssueType);
         const vulnerabilityReportIssueCount = (result[issueType] || 0) + 1;
         return {
           ...result,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "0.0.169",
+  "version": "0.0.171",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.js",