mobbdev 1.0.12 → 1.0.15

package/dist/index.mjs

@@ -51,6 +51,7 @@ var Language = /* @__PURE__ */ ((Language2) => {
   Language2["Csharp"] = "CSHARP";
   Language2["Java"] = "JAVA";
   Language2["Js"] = "JS";
+  Language2["Php"] = "PHP";
   Language2["Python"] = "PYTHON";
   Language2["Sql"] = "SQL";
   Language2["Xml"] = "XML";
@@ -100,6 +101,7 @@ var IssueLanguage_Enum = /* @__PURE__ */ ((IssueLanguage_Enum2) => {
   IssueLanguage_Enum2["Cpp"] = "Cpp";
   IssueLanguage_Enum2["Java"] = "Java";
   IssueLanguage_Enum2["JavaScript"] = "JavaScript";
+  IssueLanguage_Enum2["Php"] = "PHP";
   IssueLanguage_Enum2["Python"] = "Python";
   IssueLanguage_Enum2["Sql"] = "SQL";
   IssueLanguage_Enum2["Xml"] = "XML";
@@ -590,8 +592,8 @@ var GitReferenceDocument = `
 }
     `;
 var AutoPrAnalysisDocument = `
-    mutation autoPrAnalysis($analysisId: String!) {
-  autoPrAnalysis(analysisId: $analysisId) {
+    mutation autoPrAnalysis($analysisId: String!, $commitDirectly: Boolean) {
+  autoPrAnalysis(analysisId: $analysisId, sameBranchCommit: $commitDirectly) {
     __typename
     ... on AutoPrSuccess {
       status
@@ -1740,7 +1742,10 @@ var fixDetailsData = {
   },
   ["STRING_FORMAT_MISUSE" /* StringFormatMisuse */]: void 0,
   ["NON_READONLY_FIELD" /* NonReadonlyField */]: void 0,
-  ["CSRF" /* Csrf */]: void 0,
+  ["CSRF" /* Csrf */]: {
+    issueDescription: "Cross Site Request Forgery is an attack that forces an end user to execute unwanted actions on a web application in which they\u2019re currently authenticated.",
+    fixInstructions: "Configure a CSRF protection mechanism, such as a CSRF token, in your application."
+  },
   ["WEAK_ENCRYPTION" /* WeakEncryption */]: void 0,
   ["CODE_IN_COMMENT" /* CodeInComment */]: void 0,
   ["REGEX_MISSING_TIMEOUT" /* RegexMissingTimeout */]: void 0
@@ -1871,6 +1876,17 @@ var vulnerabilities2 = {
 };
 var java_default = vulnerabilities2;
 
+// src/features/analysis/scm/shared/src/storedFixData/python/csrf.ts
+var csrf = {
+  guidance: () => `Please make sure the CSRF middleware is activated by default in the MIDDLEWARE setting. If you override that setting, remember that \`django.middleware.csrf.CsrfViewMiddleware\` should come before any view middleware that assume that CSRF attacks have been dealt with.
+
+
+If you disabled it, which is not recommended, you can use [\`csrf_protect()\`](https://docs.djangoproject.com/en/5.1/ref/csrf/#django.views.decorators.csrf.csrf_protect) annotation on this particular view.
+
+
+See more information [here](https://docs.djangoproject.com/en/5.1/howto/csrf/).`
+};
+
 // src/features/analysis/scm/shared/src/storedFixData/javascript/hardcodedSecrets.ts
 var hardcodedSecrets = {
   guidance: ({ questions }) => {
@@ -1905,10 +1921,15 @@ var vulnerabilities3 = {
   ["SSRF" /* Ssrf */]: ssrf,
   ["HARDCODED_SECRETS" /* HardcodedSecrets */]: hardcodedSecrets,
   ["PASSWORD_IN_COMMENT" /* PasswordInComment */]: passwordInComment,
-  ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling
+  ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling,
+  ["CSRF" /* Csrf */]: csrf
 };
 var javascript_default = vulnerabilities3;
 
+// src/features/analysis/scm/shared/src/storedFixData/php/index.ts
+var vulnerabilities4 = {};
+var php_default = vulnerabilities4;
+
 // src/features/analysis/scm/shared/src/storedFixData/python/autoEscapeFalse.ts
 var autoEscapeFalse = {
   guidance: () => `This fix enables automatic escaping for HTML. When that's enabled, everything is escaped by default except for values explicitly marked as safe. Variables and expressions can be marked as safe either in:
@@ -1929,10 +1950,11 @@ See more information [here](https://jinja.palletsprojects.com/en/3.1.x/templates
 };
 
 // src/features/analysis/scm/shared/src/storedFixData/python/index.ts
-var vulnerabilities4 = {
-  ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: autoEscapeFalse
+var vulnerabilities5 = {
+  ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: autoEscapeFalse,
+  ["CSRF" /* Csrf */]: csrf
 };
-var python_default = vulnerabilities4;
+var python_default = vulnerabilities5;
 
 // src/features/analysis/scm/shared/src/storedFixData/sql/defaultRightsInObjDefinition.ts
 var defaultRightsInObjDefinition = {
@@ -1940,16 +1962,16 @@ var defaultRightsInObjDefinition = {
 };
 
 // src/features/analysis/scm/shared/src/storedFixData/sql/index.ts
-var vulnerabilities5 = {
+var vulnerabilities6 = {
   ["DEFAULT_RIGHTS_IN_OBJ_DEFINITION" /* DefaultRightsInObjDefinition */]: defaultRightsInObjDefinition
 };
-var sql_default = vulnerabilities5;
+var sql_default = vulnerabilities6;
 
 // src/features/analysis/scm/shared/src/storedFixData/xml/index.ts
-var vulnerabilities6 = {
+var vulnerabilities7 = {
   ["PASSWORD_IN_COMMENT" /* PasswordInComment */]: passwordInComment
 };
-var xml_default = vulnerabilities6;
+var xml_default = vulnerabilities7;
 
 // src/features/analysis/scm/shared/src/storedFixData/index.ts
 var StoredFixDataItemZ = z6.object({
@@ -1961,7 +1983,8 @@ var languages = {
   ["CSharp" /* CSharp */]: csharp_default,
   ["SQL" /* Sql */]: sql_default,
   ["XML" /* Xml */]: xml_default,
-  ["Python" /* Python */]: python_default
+  ["Python" /* Python */]: python_default,
+  ["PHP" /* Php */]: php_default
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/index.ts
@@ -2251,7 +2274,7 @@ var xxe = {
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/csharp/index.ts
-var vulnerabilities7 = {
+var vulnerabilities8 = {
   ["LOG_FORGING" /* LogForging */]: logForging,
   ["SSRF" /* Ssrf */]: ssrf2,
   ["XXE" /* Xxe */]: xxe,
@@ -2271,7 +2294,7 @@ var vulnerabilities7 = {
   ["INSUFFICIENT_LOGGING" /* InsufficientLogging */]: insufficientLogging,
   ["SQL_Injection" /* SqlInjection */]: sqlInjection2
 };
-var csharp_default2 = vulnerabilities7;
+var csharp_default2 = vulnerabilities8;
 
 // src/features/analysis/scm/shared/src/storedQuestionData/java/commandInjection.ts
 var commandInjection = {
@@ -2707,7 +2730,7 @@ var xxe2 = {
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/java/index.ts
-var vulnerabilities8 = {
+var vulnerabilities9 = {
   ["SQL_Injection" /* SqlInjection */]: sqlInjection3,
   ["CMDi_relative_path_command" /* CmDiRelativePathCommand */]: relativePathCommand,
   ["CMDi" /* CmDi */]: commandInjection,
@@ -2731,7 +2754,16 @@ var vulnerabilities8 = {
   ["LEFTOVER_DEBUG_CODE" /* LeftoverDebugCode */]: leftoverDebugCode,
   ["ERRONEOUS_STRING_COMPARE" /* ErroneousStringCompare */]: erroneousStringCompare
 };
-var java_default2 = vulnerabilities8;
+var java_default2 = vulnerabilities9;
+
+// src/features/analysis/scm/shared/src/storedQuestionData/python/csrf.ts
+var csrf2 = {
+  isPythonDjangoTemplate: {
+    content: () => "Is the reported file Python Django template?",
+    description: () => "",
+    guidance: () => ""
+  }
+};
 
 // src/features/analysis/scm/shared/src/storedQuestionData/js/commandInjection.ts
 var commandInjection2 = {
@@ -3011,11 +3043,16 @@ var xss3 = {
     content: () => "Is the parameter passed to the $() function a string",
     description: () => "",
     guidance: () => ""
+  },
+  isSanitized: {
+    content: ({ expression }) => `Is the expression \`${expression}\` supposed to be not sanitized in this context?`,
+    description: () => "You are using unsafe string substitution in the template. This means that if the expression can contain maliciously crafted data, it may lead to XSS injection. To apply the fix, you have to make sure the expression is not sanitized on the backend already, and it does not represent an HTML code block.",
+    guidance: () => ""
   }
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/js/index.ts
-var vulnerabilities9 = {
+var vulnerabilities10 = {
   ["CMDi" /* CmDi */]: commandInjection2,
   ["GRAPHQL_DEPTH_LIMIT" /* GraphqlDepthLimit */]: graphqlDepthLimit,
   ["INSECURE_RANDOMNESS" /* InsecureRandomness */]: insecureRandomness2,
@@ -3034,9 +3071,43 @@ var vulnerabilities9 = {
   ["UNCHECKED_LOOP_CONDITION" /* UncheckedLoopCondition */]: uncheckedLoopCondition2,
   ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling2,
   ["MISSING_CSP_HEADER" /* MissingCspHeader */]: cspHeaderValue,
-  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: hardcodedDomainInHtml
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: hardcodedDomainInHtml,
+  ["CSRF" /* Csrf */]: csrf2
 };
-var js_default = vulnerabilities9;
+var js_default = vulnerabilities10;
+
+// src/features/analysis/scm/shared/src/storedQuestionData/python/logForging.ts
+var logForging4 = {
+  isHtmlDisplay: {
+    content: () => "Is the text written to the log going to be displayed as HTML?",
+    description: () => "",
+    guidance: ({ userInputValue }) => {
+      switch (userInputValue) {
+        case "yes":
+          return "We use `html.escape` to decode the HTML";
+        default:
+          return "";
+      }
+    }
+  }
+};
+
+// src/features/analysis/scm/shared/src/storedQuestionData/python/openRedirect.ts
+var openRedirect2 = {
+  allowed_hosts: {
+    content: () => "Allowed domains/paths",
+    description: () => "If external, provide a coma separated list of allowed domains. If internal, provide a coma seperated list of allowed paths",
+    guidance: () => ""
+  }
+};
+
+// src/features/analysis/scm/shared/src/storedQuestionData/python/index.ts
+var vulnerabilities11 = {
+  ["CSRF" /* Csrf */]: csrf2,
+  ["LOG_FORGING" /* LogForging */]: logForging4,
+  ["LOG_FORGING" /* LogForging */]: openRedirect2
+};
+var python_default2 = vulnerabilities11;
 
 // src/features/analysis/scm/shared/src/storedQuestionData/xml/unboundedOccurrences.ts
 var unboundedOccurrences = {
@@ -3050,10 +3121,10 @@ A value too high will cause performance issues up to and including denial of ser
 };
 
 // src/features/analysis/scm/shared/src/storedQuestionData/xml/index.ts
-var vulnerabilities10 = {
+var vulnerabilities12 = {
   ["WEAK_XML_SCHEMA_UNBOUNDED_OCCURRENCES" /* WeakXmlSchemaUnboundedOccurrences */]: unboundedOccurrences
 };
-var xml_default2 = vulnerabilities10;
+var xml_default2 = vulnerabilities12;
 
 // src/features/analysis/scm/shared/src/storedQuestionData/index.ts
 var StoredQuestionDataItemZ = z7.object({
@@ -3065,7 +3136,8 @@ var languages2 = {
   ["Java" /* Java */]: java_default2,
   ["JavaScript" /* JavaScript */]: js_default,
   ["XML" /* Xml */]: xml_default2,
-  ["CSharp" /* CSharp */]: csharp_default2
+  ["CSharp" /* CSharp */]: csharp_default2,
+  ["Python" /* Python */]: python_default2
 };
 var storedQuestionData_default = languages2;
 
@@ -3193,6 +3265,8 @@ function getGuidances(args) {
 
 // src/features/analysis/scm/shared/src/urlParser/urlParser.ts
 import { z as z9 } from "zod";
+var ADO_PREFIX_PATH = "tfs";
+var NAME_REGEX = /[a-z0-9\-_.+]+/i;
 function detectAdoUrl(args) {
   const { pathname, hostname, scmType } = args;
   const hostnameParts = hostname.split(".");
@@ -3361,10 +3435,6 @@ function getFixUrl({
   return `${appBaseUrl}/organization/${organizationId}/project/${projectId}/report/${analysisId}/fix/${fixId}`;
 }
 
-// src/features/analysis/scm/shared/src/index.ts
-var NAME_REGEX = /[a-z0-9\-_.+]+/i;
-var ADO_PREFIX_PATH = "tfs";
-
 // src/features/analysis/scm/types.ts
 var ReferenceType = /* @__PURE__ */ ((ReferenceType2) => {
   ReferenceType2["BRANCH"] = "BRANCH";
@@ -6947,7 +7017,7 @@ async function addFixCommentsForPr({
 import Debug8 from "debug";
 var debug8 = Debug8("mobbdev:handleAutoPr");
 async function handleAutoPr(params) {
-  const { gqlClient, analysisId, createSpinner: createSpinner5 } = params;
+  const { gqlClient, analysisId, commitDirectly, createSpinner: createSpinner5 } = params;
   const createAutoPrSpinner = createSpinner5(
     "\u{1F504} Waiting for the analysis to finish before initiating automatic pull request creation"
   ).start();
@@ -6956,7 +7026,10 @@ async function handleAutoPr(params) {
       analysisId
     },
     callback: async (analysisId2) => {
-      const autoPrAnalysisRes = await gqlClient.autoPrAnalysis(analysisId2);
+      const autoPrAnalysisRes = await gqlClient.autoPrAnalysis(
+        analysisId2,
+        commitDirectly
+      );
       debug8("auto pr analysis res %o", autoPrAnalysisRes);
       if (autoPrAnalysisRes.autoPrAnalysis?.__typename === "AutoPrError") {
         createAutoPrSpinner.error({
@@ -7412,9 +7485,10 @@ var GQLClient = class {
     }
     return res.analysis;
   }
-  async autoPrAnalysis(analysisId) {
+  async autoPrAnalysis(analysisId, commitDirectly) {
     return this._clientSdk.autoPrAnalysis({
-      analysisId
+      analysisId,
+      commitDirectly
     });
   }
   async getFixes(fixIds) {
@@ -8038,7 +8112,8 @@ async function _scan(params, { skipPrompts = false } = {}) {
     githubToken: githubActionToken,
     command,
     organizationId: userOrganizationId,
-    autoPr
+    autoPr,
+    commitDirectly
   } = params;
   debug15("start %s %s", dirname, repo);
   const { createSpinner: createSpinner5 } = Spinner2({ ci });
@@ -8177,6 +8252,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
     await handleAutoPr({
       gqlClient,
       analysisId: reportUploadInfo.fixReportId,
+      commitDirectly,
       createSpinner: createSpinner5
     });
   }
@@ -8342,6 +8418,7 @@ async function _scan(params, { skipPrompts = false } = {}) {
       await handleAutoPr({
         gqlClient,
         analysisId: reportUploadInfo.fixReportId,
+        commitDirectly,
         createSpinner: createSpinner5
       });
     }
@@ -8447,7 +8524,8 @@ async function analyze({
   srcPath,
   mobbProjectName,
   organizationId,
-  autoPr
+  autoPr,
+  commitDirectly
 }, { skipPrompts = false } = {}) {
   !ci && await showWelcomeMessage(skipPrompts);
   await runAnalysis(
@@ -8462,7 +8540,8 @@ async function analyze({
       srcPath,
       organizationId,
       command: "analyze",
-      autoPr
+      autoPr,
+      commitDirectly
     },
     { skipPrompts }
   );
@@ -8663,6 +8742,13 @@ var autoPrOption = {
   type: "boolean",
   default: false
 };
+var commitDirectlyOption = {
+  describe: chalk6.bold(
+    "Commit directly to the scanned branch instead of creating a pull request"
+  ),
+  type: "boolean",
+  default: false
+};
 var scmTypeOption = {
   demandOption: true,
   describe: chalk6.bold("SCM type"),
@@ -8767,7 +8853,7 @@ function analyzeBuilder(yargs2) {
     alias: "commit-hash",
     describe: chalk8.bold("Hash of the commit"),
     type: "string"
-  }).option("mobb-project-name", mobbProjectNameOption).option("y", yesOption).option("ci", ciOption).option("org", organizationIdOptions).option("api-key", apiKeyOption).option("commit-hash", commitHashOption).option("auto-pr", autoPrOption).example(
+  }).option("mobb-project-name", mobbProjectNameOption).option("y", yesOption).option("ci", ciOption).option("org", organizationIdOptions).option("api-key", apiKeyOption).option("commit-hash", commitHashOption).option("auto-pr", autoPrOption).option("commit-directly", commitDirectlyOption).example(
     "npx mobbdev@latest analyze -r https://github.com/WebGoat/WebGoat -f <your_vulnerability_report_path>",
     "analyze an existing repository"
   ).help();
@@ -8787,6 +8873,11 @@ Can't access ${chalk8.bold(argv.f)}`);
   if (argv.ci && !argv.apiKey) {
     throw new CliError("--ci flag requires --api-key to be provided as well");
   }
+  if (argv.commitDirectly && !argv["auto-pr"]) {
+    throw new CliError(
+      "--commit-directly flag requires --auto-pr to be provided as well"
+    );
+  }
   validateReportFileFormat(argv.f);
 }
 async function analyzeHandler(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.0.12",
+  "version": "1.0.15",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.js",
@@ -29,9 +29,9 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@gitbeaker/core": "41.3.0",
-    "@gitbeaker/requester-utils": "41.3.0",
-    "@gitbeaker/rest": "41.3.0",
+    "@gitbeaker/core": "42.0.2",
+    "@gitbeaker/requester-utils": "42.0.2",
+    "@gitbeaker/rest": "42.0.2",
     "@octokit/core": "5.2.0",
     "@octokit/graphql": "5.0.6",
     "@octokit/plugin-rest-endpoint-methods": "7.2.3",
@@ -51,7 +51,7 @@
     "graphql": "16.10.0",
     "graphql-request": "6.1.0",
     "graphql-tag": "2.12.6",
-    "graphql-ws": "5.16.0",
+    "graphql-ws": "5.16.2",
     "inquirer": "9.2.23",
     "isomorphic-ws": "5.0.0",
     "istextorbinary": "6.0.0",
@@ -63,7 +63,7 @@
     "parse-diff": "0.11.1",
     "semver": "7.6.3",
     "simple-git": "3.27.0",
-    "snyk": "1.1294.3",
+    "snyk": "1.1295.0",
     "supports-color": "9.4.0",
     "tar": "6.2.1",
     "tmp": "0.2.3",
@@ -79,7 +79,7 @@
     "@graphql-codegen/typescript-graphql-request": "6.2.0",
     "@graphql-codegen/typescript-operations": "4.4.0",
     "@octokit/request-error": "3.0.3",
-    "@octokit/types": "13.6.2",
+    "@octokit/types": "13.7.0",
     "@types/adm-zip": "0.5.7",
     "@types/chalk-animation": "1.6.3",
     "@types/configstore": "6.0.2",
@@ -97,7 +97,7 @@
     "@vitest/ui": "2.1.8",
     "eslint": "8.57.0",
     "eslint-plugin-import": "2.31.0",
-    "eslint-plugin-prettier": "5.2.1",
+    "eslint-plugin-prettier": "5.2.2",
     "eslint-plugin-simple-import-sort": "10.0.0",
     "prettier": "3.4.2",
     "tsup": "7.2.0",