opensecurity 0.1.0

package/dist/deps/scanners.js

@@ -0,0 +1,114 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+export async function scanDependencies(root) {
+    const deps = [];
+    const pkgJsonPath = path.join(root, "package.json");
+    const pkgLockPath = path.join(root, "package-lock.json");
+    const requirementsPath = path.join(root, "requirements.txt");
+    const [pkgJson, pkgLock, requirements] = await Promise.all([
+        readJsonFile(pkgJsonPath),
+        readJsonFile(pkgLockPath),
+        readTextFile(requirementsPath)
+    ]);
+    const resolvedVersions = pkgLock ? parsePackageLock(pkgLock) : new Map();
+    if (pkgJson) {
+        const depsFromPkg = parsePackageJson(pkgJson, pkgJsonPath);
+        for (const dep of depsFromPkg) {
+            const resolved = resolvedVersions.get(dep.name);
+            deps.push({ ...dep, version: dep.version ?? resolved });
+        }
+    }
+    if (requirements) {
+        deps.push(...parseRequirements(requirements, requirementsPath));
+    }
+    return deps;
+}
+function parsePackageJson(data, source) {
+    const deps = [];
+    const addDeps = (record, scope) => {
+        if (!record)
+            return;
+        for (const [name, spec] of Object.entries(record)) {
+            deps.push({
+                name,
+                spec,
+                version: undefined,
+                ecosystem: "npm",
+                scope,
+                source
+            });
+        }
+    };
+    addDeps(data.dependencies, "prod");
+    addDeps(data.devDependencies, "dev");
+    return deps;
+}
+function parsePackageLock(data) {
+    const versions = new Map();
+    if (data.packages && typeof data.packages === "object") {
+        for (const [pkgPath, info] of Object.entries(data.packages)) {
+            if (!info || typeof info !== "object")
+                continue;
+            if (!info.name || !info.version)
+                continue;
+            versions.set(info.name, info.version);
+            if (pkgPath === "" && info.dependencies) {
+                for (const [name, version] of Object.entries(info.dependencies)) {
+                    versions.set(name, version);
+                }
+            }
+        }
+    }
+    if (data.dependencies && typeof data.dependencies === "object") {
+        for (const [name, info] of Object.entries(data.dependencies)) {
+            if (info?.version) {
+                versions.set(name, info.version);
+            }
+        }
+    }
+    return versions;
+}
+function parseRequirements(text, source) {
+    const deps = [];
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const [namePart, versionPart] = trimmed.split(/==|>=|<=|~=|!=|>/).map((s) => s.trim());
+        if (!namePart)
+            continue;
+        const versionMatch = trimmed.match(/(==|>=|<=|~=|!=|>)(.+)$/);
+        const spec = versionMatch ? `${versionMatch[1]}${versionMatch[2].trim()}` : undefined;
+        deps.push({
+            name: namePart,
+            spec,
+            version: versionPart && versionMatch?.[1] === "==" ? versionPart : undefined,
+            ecosystem: "pypi",
+            scope: "prod",
+            source
+        });
+    }
+    return deps;
+}
+async function readJsonFile(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+async function readTextFile(filePath) {
+    try {
+        return await fs.readFile(filePath, "utf8");
+    }
+    catch (err) {
+        if (err?.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}

package/dist/deps/scoring.js

@@ -0,0 +1,46 @@
+export function scoreRisk(cve, options = {}) {
+    const base = baseScore(cve);
+    const exploitability = cve.exploitability === "high" ? 10 : cve.exploitability === "medium" ? 5 : 0;
+    const privilegeRequired = cve.privilegeRequired === "none" ? 10 : cve.privilegeRequired === "low" ? 5 : 0;
+    const dataSensitivity = options.dataSensitivity === "high" ? 10 : options.dataSensitivity === "medium" ? 5 : 0;
+    const score = clamp(base + exploitability + privilegeRequired + dataSensitivity, 0, 100);
+    return {
+        score,
+        severity: scoreToSeverity(score),
+        factors: {
+            base,
+            exploitability,
+            privilegeRequired,
+            dataSensitivity
+        }
+    };
+}
+function baseScore(cve) {
+    if (typeof cve.cvssScore === "number" && !Number.isNaN(cve.cvssScore)) {
+        return clamp(cve.cvssScore * 10, 0, 100);
+    }
+    switch (cve.severity) {
+        case "critical":
+            return 90;
+        case "high":
+            return 70;
+        case "medium":
+            return 40;
+        case "low":
+            return 20;
+        default:
+            return 30;
+    }
+}
+function scoreToSeverity(score) {
+    if (score >= 90)
+        return "critical";
+    if (score >= 70)
+        return "high";
+    if (score >= 40)
+        return "medium";
+    return "low";
+}
+function clamp(value, min, max) {
+    return Math.min(max, Math.max(min, value));
+}

package/dist/deps/simulate.js

@@ -0,0 +1,9 @@
+export function buildSimulation(finding) {
+    const dep = finding.dependency;
+    const cve = finding.cve;
+    const payload = `Trigger ${cve.id} via ${dep.name}@${dep.version ?? dep.spec ?? "unknown"}`;
+    const impact = cve.description
+        ? `Potential impact: ${cve.description}`
+        : `Potential impact: untrusted input could exploit ${dep.name}.`;
+    return { payload, impact };
+}

package/dist/deps/types.js

@@ -0,0 +1 @@
+export {};

package/dist/fileWalker.js

@@ -0,0 +1,27 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import picomatch from "picomatch";
+export async function walkFiles(rootDir, options) {
+    const includeMatchers = options.include.map((p) => picomatch(p, { dot: true }));
+    const excludeMatchers = options.exclude.map((p) => picomatch(p, { dot: true }));
+    const results = [];
+    async function visit(currentDir) {
+        const entries = await fs.readdir(currentDir, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = path.join(currentDir, entry.name);
+            const relPath = path.relative(rootDir, fullPath).split(path.sep).join("/");
+            if (excludeMatchers.some((m) => m(relPath))) {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                await visit(fullPath);
+                continue;
+            }
+            if (includeMatchers.length === 0 || includeMatchers.some((m) => m(relPath))) {
+                results.push(fullPath);
+            }
+        }
+    }
+    await visit(rootDir);
+    return results;
+}