mobbdev 1.0.50 → 1.0.53

package/dist/index.mjs

@@ -154,6 +154,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["MissingCspHeader"] = "MISSING_CSP_HEADER";
   IssueType_Enum2["MissingEqualsOrHashcode"] = "MISSING_EQUALS_OR_HASHCODE";
   IssueType_Enum2["MissingHstsHeader"] = "MISSING_HSTS_HEADER";
+  IssueType_Enum2["MissingSslMinversion"] = "MISSING_SSL_MINVERSION";
   IssueType_Enum2["NonFinalPublicStaticField"] = "NON_FINAL_PUBLIC_STATIC_FIELD";
   IssueType_Enum2["NonReadonlyField"] = "NON_READONLY_FIELD";
   IssueType_Enum2["NoEquivalenceMethod"] = "NO_EQUIVALENCE_METHOD";
@@ -190,6 +191,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["WcfMisconfigurationThrottlingNotEnabled"] = "WCF_MISCONFIGURATION_THROTTLING_NOT_ENABLED";
   IssueType_Enum2["WeakEncryption"] = "WEAK_ENCRYPTION";
   IssueType_Enum2["WeakXmlSchemaUnboundedOccurrences"] = "WEAK_XML_SCHEMA_UNBOUNDED_OCCURRENCES";
+  IssueType_Enum2["WebsocketMissingOriginCheck"] = "WEBSOCKET_MISSING_ORIGIN_CHECK";
   IssueType_Enum2["Xss"] = "XSS";
   IssueType_Enum2["Xxe"] = "XXE";
   IssueType_Enum2["ZipSlip"] = "ZIP_SLIP";
@@ -895,6 +897,7 @@ var FixPageFixReportZ = z3.object({
 });
 
 // src/features/analysis/scm/shared/src/types/issue.ts
+var MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES = 1e5;
 var category = {
   NoFix: "NoFix",
   Unsupported: "Unsupported",
@@ -928,7 +931,35 @@ var BaseIssuePartsZ = z4.object({
       index: z4.number()
     })
   ).transform((nodes) => nodes.sort((a, b) => b.index - a.index)),
-  fix: FixPartsForFixScreenZ.nullish()
+  sourceCodeNodes: z4.array(
+    z4.object({
+      sourceCodeFile: z4.object({
+        path: z4.string(),
+        signedFile: z4.object({
+          url: z4.string()
+        })
+      })
+    }).transform(async ({ sourceCodeFile }) => {
+      const { url } = sourceCodeFile.signedFile;
+      const sourceCodeRes = await fetch(url);
+      if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {
+        return null;
+      }
+      return {
+        path: sourceCodeFile.path,
+        fileContent: await sourceCodeRes.text()
+      };
+    })
+  ).transform((nodes) => nodes.filter((node) => node !== null)),
+  fix: FixPartsForFixScreenZ.nullish(),
+  vulnerabilityReportIssueNodeDiffFile: z4.object({
+    signedFile: z4.object({
+      url: z4.string()
+    }).transform(async ({ url }) => {
+      const codeDiff = await fetch(url).then((res) => res.text());
+      return { codeDiff };
+    })
+  }).nullish()
 });
 var FalsePositivePartsZ = z4.object({
   extraContext: z4.array(z4.object({ key: z4.string(), value: z4.string() })),
@@ -1069,7 +1100,9 @@ var issueTypeMap = {
   ["CODE_IN_COMMENT" /* CodeInComment */]: "Code in Comment",
   ["REGEX_MISSING_TIMEOUT" /* RegexMissingTimeout */]: "Regex Missing Timeout",
   ["FRAMEABLE_LOGIN_PAGE" /* FrameableLoginPage */]: "Frameable Login Page",
-  ["USE_OF_HARD_CODED_CRYPTOGRAPHIC_KEY" /* UseOfHardCodedCryptographicKey */]: "Use of Hardcoded Cryptographic Key"
+  ["USE_OF_HARD_CODED_CRYPTOGRAPHIC_KEY" /* UseOfHardCodedCryptographicKey */]: "Use of Hardcoded Cryptographic Key",
+  ["MISSING_SSL_MINVERSION" /* MissingSslMinversion */]: "Missing SSL MinVersion",
+  ["WEBSOCKET_MISSING_ORIGIN_CHECK" /* WebsocketMissingOriginCheck */]: "Missing Websocket Origin Check"
 };
 var issueTypeZ = z5.nativeEnum(IssueType_Enum);
 var getIssueTypeFriendlyString = (issueType) => {
@@ -1972,7 +2005,9 @@ var fixDetailsData = {
   ["CODE_IN_COMMENT" /* CodeInComment */]: void 0,
   ["REGEX_MISSING_TIMEOUT" /* RegexMissingTimeout */]: void 0,
   ["FRAMEABLE_LOGIN_PAGE" /* FrameableLoginPage */]: void 0,
-  ["USE_OF_HARD_CODED_CRYPTOGRAPHIC_KEY" /* UseOfHardCodedCryptographicKey */]: void 0
+  ["USE_OF_HARD_CODED_CRYPTOGRAPHIC_KEY" /* UseOfHardCodedCryptographicKey */]: void 0,
+  ["MISSING_SSL_MINVERSION" /* MissingSslMinversion */]: void 0,
+  ["WEBSOCKET_MISSING_ORIGIN_CHECK" /* WebsocketMissingOriginCheck */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/commitDescriptionMarkup.ts
@@ -2534,9 +2569,29 @@ var logForging2 = {
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/go/missingSslMinversion.ts
+var missingSslMinversion = {
+  minTlsVersion: {
+    content: () => "What is the minimum version of Transport Layer Security (TLS) you allow? Ensure compatibility between the server and clients.",
+    description: () => "",
+    guidance: () => ""
+  }
+};
+
+// src/features/analysis/scm/shared/src/storedQuestionData/go/websocketMissingOriginCheck.ts
+var websocketMissingOriginCheck = {
+  minTlsVersion: {
+    content: () => "Please provide a comma-separated list of valid hosts. This list will serve as an allow list to check the connection `Origin` header.",
+    description: () => "",
+    guidance: () => ""
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/go/index.ts
 var vulnerabilities10 = {
-  ["LOG_FORGING" /* LogForging */]: logForging2
+  ["LOG_FORGING" /* LogForging */]: logForging2,
+  ["MISSING_SSL_MINVERSION" /* MissingSslMinversion */]: missingSslMinversion,
+  ["WEBSOCKET_MISSING_ORIGIN_CHECK" /* WebsocketMissingOriginCheck */]: websocketMissingOriginCheck
 };
 var go_default2 = vulnerabilities10;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "1.0.50",
+  "version": "1.0.53",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.js",
@@ -100,6 +100,7 @@
     "eslint-plugin-import": "2.31.0",
     "eslint-plugin-prettier": "5.2.3",
     "eslint-plugin-simple-import-sort": "10.0.0",
+    "nock": "14.0.1",
     "prettier": "3.5.1",
     "tsup": "7.2.0",
     "typescript": "4.9.5",