osv-scanner-mcp 0.1.0

package/dist/test/osv/binaryDownloader.test.js

@@ -0,0 +1,117 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { ScanToolError } from "../../errors.js";
+import { assetNameForPlatform, ensureOsvScannerDownloaded, PINNED_OSV_SCANNER_VERSION, } from "../../osv/binaryDownloader.js";
+const FAKE_BINARY = Buffer.from("#!/bin/sh\necho fake-osv-scanner\n");
+const FAKE_SHA256 = createHash("sha256").update(FAKE_BINARY).digest("hex");
+let cacheDir;
+beforeAll(async () => {
+    cacheDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-dl-"));
+});
+afterAll(async () => {
+    await rm(cacheDir, { recursive: true, force: true });
+});
+/** darwin/arm64固定でテストする(実行環境に依存させない) */
+function options(overrides = {}) {
+    return {
+        cacheDir,
+        platform: "darwin",
+        arch: "arm64",
+        checksums: { "osv-scanner_darwin_arm64": FAKE_SHA256 },
+        fetchFn: async () => new Response(new Uint8Array(FAKE_BINARY), { status: 200 }),
+        ...overrides,
+    };
+}
+async function expectScanError(promise, kind) {
+    const error = await promise.then(() => null, (e) => e);
+    expect(error).toBeInstanceOf(ScanToolError);
+    expect(error.kind).toBe(kind);
+    return error;
+}
+describe("assetNameForPlatform", () => {
+    it("対応プラットフォームの公式資産名を組み立てる", () => {
+        expect(assetNameForPlatform("darwin", "arm64")).toBe("osv-scanner_darwin_arm64");
+        expect(assetNameForPlatform("linux", "x64")).toBe("osv-scanner_linux_amd64");
+        expect(assetNameForPlatform("win32", "x64")).toBe("osv-scanner_windows_amd64.exe");
+    });
+    it("未対応プラットフォームはnull", () => {
+        expect(assetNameForPlatform("sunos", "x64")).toBeNull();
+        expect(assetNameForPlatform("linux", "ia32")).toBeNull();
+    });
+});
+describe("ensureOsvScannerDownloaded", () => {
+    it("ダウンロード→検証→実行権限付きで配置し、正しいURLを参照する", async () => {
+        let requestedUrl = "";
+        const binPath = await ensureOsvScannerDownloaded(options({
+            fetchFn: async (url) => {
+                requestedUrl = String(url);
+                return new Response(new Uint8Array(FAKE_BINARY), { status: 200 });
+            },
+        }));
+        expect(requestedUrl).toBe(`https://github.com/google/osv-scanner/releases/download/v${PINNED_OSV_SCANNER_VERSION}/osv-scanner_darwin_arm64`);
+        expect(await readFile(binPath)).toEqual(FAKE_BINARY);
+        const mode = (await stat(binPath)).mode;
+        expect(mode & 0o111).not.toBe(0); // 実行権限あり
+    });
+    it("2回目以降はキャッシュを使いダウンロードしない", async () => {
+        let fetchCount = 0;
+        const opts = options({
+            fetchFn: async () => {
+                fetchCount++;
+                return new Response(new Uint8Array(FAKE_BINARY), { status: 200 });
+            },
+        });
+        await ensureOsvScannerDownloaded(opts); // キャッシュ済み(前テストで配置)
+        expect(fetchCount).toBe(0);
+    });
+    it("キャッシュが改ざんされていたら再ダウンロードして修復する", async () => {
+        const binPath = path.join(cacheDir, `v${PINNED_OSV_SCANNER_VERSION}`, "osv-scanner_darwin_arm64");
+        await writeFile(binPath, "tampered!");
+        let fetchCount = 0;
+        const restored = await ensureOsvScannerDownloaded(options({
+            fetchFn: async () => {
+                fetchCount++;
+                return new Response(new Uint8Array(FAKE_BINARY), { status: 200 });
+            },
+        }));
+        expect(fetchCount).toBe(1);
+        expect(await readFile(restored)).toEqual(FAKE_BINARY);
+    });
+    it("チェックサム不一致はbinary_checksum_mismatchでバイナリを配置しない", async () => {
+        const isolated = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-dl-bad-"));
+        try {
+            const error = await expectScanError(ensureOsvScannerDownloaded(options({
+                cacheDir: isolated,
+                checksums: { "osv-scanner_darwin_arm64": "0".repeat(64) },
+            })), "binary_checksum_mismatch");
+            expect(error.message).toContain("改ざんまたは破損");
+            // 検証に失敗したバイナリはキャッシュに残らない
+            const target = path.join(isolated, `v${PINNED_OSV_SCANNER_VERSION}`, "osv-scanner_darwin_arm64");
+            await expect(stat(target)).rejects.toThrow();
+        }
+        finally {
+            await rm(isolated, { recursive: true, force: true });
+        }
+    });
+    it("HTTPエラーはbinary_download_failed", async () => {
+        await expectScanError(ensureOsvScannerDownloaded(options({
+            cacheDir: await mkdtemp(path.join(os.tmpdir(), "osv-mcp-dl-404-")),
+            fetchFn: async () => new Response("not found", { status: 404 }),
+        })), "binary_download_failed");
+    });
+    it("ネットワークエラー・タイムアウトはbinary_download_failed", async () => {
+        await expectScanError(ensureOsvScannerDownloaded(options({
+            cacheDir: await mkdtemp(path.join(os.tmpdir(), "osv-mcp-dl-net-")),
+            fetchFn: async () => {
+                throw new TypeError("fetch failed");
+            },
+        })), "binary_download_failed");
+    });
+    it("未対応プラットフォームはbinary_download_failed(手動導入を案内)", async () => {
+        const error = await expectScanError(ensureOsvScannerDownloaded(options({ platform: "sunos" })), "binary_download_failed");
+        expect(error.message).toContain("OSV_SCANNER_PATH");
+    });
+});

package/dist/test/osv/explainVulnerability.test.js

@@ -0,0 +1,173 @@
+import { describe, expect, it } from "vitest";
+import { ScanToolError } from "../../errors.js";
+import { fetchOsvRecord, validateVulnerabilityId } from "../../osv/osvApi.js";
+import { buildVulnerabilityExplanation } from "../../osv/vulnerabilityExplanation.js";
+async function expectScanError(promise, kind) {
+    const error = await promise.then(() => null, (e) => e);
+    expect(error).toBeInstanceOf(ScanToolError);
+    expect(error.kind).toBe(kind);
+    return error;
+}
+function jsonResponse(payload, status = 200) {
+    return new Response(JSON.stringify(payload), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+describe("validateVulnerabilityId", () => {
+    it("GHSA/CVE形式のIDを受け付ける(前後の空白は除去)", () => {
+        expect(validateVulnerabilityId("GHSA-jfh8-c2jp-5v3q")).toBe("GHSA-jfh8-c2jp-5v3q");
+        expect(validateVulnerabilityId("CVE-2021-44228")).toBe("CVE-2021-44228");
+        expect(validateVulnerabilityId("  CVE-2021-44228  ")).toBe("CVE-2021-44228");
+    });
+    it("URLインジェクションにつながる文字を含むIDを拒否する", () => {
+        for (const bad of [
+            "../../../v1/query",
+            "CVE-2021-44228/../secret",
+            "id with space",
+            "id?query=1",
+            "id#frag",
+            "",
+            "ab",
+            "x".repeat(65),
+        ]) {
+            expect(() => validateVulnerabilityId(bad), bad).toThrowError(expect.objectContaining({ kind: "invalid_vulnerability_id" }));
+        }
+    });
+});
+describe("fetchOsvRecord", () => {
+    it("200レスポンスのJSONを返す", async () => {
+        const record = await fetchOsvRecord("GHSA-test-test-test", {
+            fetchFn: async (url) => {
+                expect(String(url)).toBe("https://api.osv.dev/v1/vulns/GHSA-test-test-test");
+                return jsonResponse({ id: "GHSA-test-test-test" });
+            },
+        });
+        expect(record).toEqual({ id: "GHSA-test-test-test" });
+    });
+    it("404はvulnerability_not_found", async () => {
+        await expectScanError(fetchOsvRecord("GHSA-none-none-none", {
+            fetchFn: async () => jsonResponse({ error: "not found" }, 404),
+        }), "vulnerability_not_found");
+    });
+    it("5xxはapi_request_failed", async () => {
+        await expectScanError(fetchOsvRecord("CVE-2021-44228", { fetchFn: async () => jsonResponse({}, 500) }), "api_request_failed");
+    });
+    it("ネットワークエラーはapi_request_failed", async () => {
+        await expectScanError(fetchOsvRecord("CVE-2021-44228", {
+            fetchFn: async () => {
+                throw new TypeError("fetch failed");
+            },
+        }), "api_request_failed");
+    });
+    it("タイムアウトはapi_request_failedとして報告される", async () => {
+        const error = await expectScanError(fetchOsvRecord("CVE-2021-44228", {
+            timeoutMs: 50,
+            // signalを尊重するfetch実装を模倣(abortされるまで解決しない)
+            fetchFn: (_url, init) => new Promise((_resolve, reject) => {
+                init?.signal?.addEventListener("abort", () => reject(init.signal.reason));
+            }),
+        }), "api_request_failed");
+        expect(error.message).toContain("秒以内に完了しませんでした");
+    });
+    it("サイズ上限を超えるレスポンスはoutput_too_large", async () => {
+        await expectScanError(fetchOsvRecord("CVE-2021-44228", {
+            maxResponseBytes: 100,
+            fetchFn: async () => new Response("x".repeat(200), { status: 200 }),
+        }), "output_too_large");
+    });
+    it("サイズ上限はバイト数で判定する(マルチバイト文字で文字数と乖離するケース)", async () => {
+        // 「脆」= UTF-8で3バイト。40文字(120バイト)は文字数では上限100未満だがバイト数では超過
+        await expectScanError(fetchOsvRecord("CVE-2021-44228", {
+            maxResponseBytes: 100,
+            fetchFn: async () => new Response("脆".repeat(40), { status: 200 }),
+        }), "output_too_large");
+    });
+    it("Content-Lengthヘッダが上限超過を示す場合は本文を読まずにoutput_too_large", async () => {
+        await expectScanError(fetchOsvRecord("CVE-2021-44228", {
+            maxResponseBytes: 100,
+            fetchFn: async () => new Response("{}", { status: 200, headers: { "content-length": "9999999" } }),
+        }), "output_too_large");
+    });
+    it("JSONでないレスポンスはapi_request_failed", async () => {
+        await expectScanError(fetchOsvRecord("CVE-2021-44228", {
+            fetchFn: async () => new Response("<html>oops</html>", { status: 200 }),
+        }), "api_request_failed");
+    });
+});
+describe("buildVulnerabilityExplanation", () => {
+    it("OSVレコードの主要フィールドを構造化する", () => {
+        const explanation = buildVulnerabilityExplanation({
+            id: "GHSA-jfh8-c2jp-5v3q",
+            aliases: ["CVE-2021-44228"],
+            summary: "Remote code injection in Log4j",
+            details: "Log4j versions prior to 2.15.0 are subject to RCE...",
+            severity: [{ type: "CVSS_V3", score: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" }],
+            published: "2021-12-10T00:00:00Z",
+            modified: "2025-01-01T00:00:00Z",
+            affected: [
+                {
+                    package: { name: "org.apache.logging.log4j:log4j-core", ecosystem: "Maven" },
+                    ranges: [
+                        {
+                            type: "ECOSYSTEM",
+                            events: [{ introduced: "2.13.0" }, { fixed: "2.15.0" }],
+                        },
+                        {
+                            type: "ECOSYSTEM",
+                            events: [{ introduced: "2.4" }, { last_affected: "2.12.1" }],
+                        },
+                    ],
+                },
+            ],
+            references: [
+                { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" },
+                { type: "WEB", url: "ftp://evil.example/exploit" },
+                { url: "https://github.com/apache/logging-log4j2/pull/608" },
+            ],
+        }, "GHSA-jfh8-c2jp-5v3q");
+        expect(explanation.id).toBe("GHSA-jfh8-c2jp-5v3q");
+        expect(explanation.aliases).toEqual(["CVE-2021-44228"]);
+        expect(explanation.severity[0].score).toContain("CVSS:3.1");
+        expect(explanation.affected[0].ranges).toEqual([
+            { introduced: "2.13.0", fixed: "2.15.0", last_affected: null },
+            { introduced: "2.4", fixed: null, last_affected: "2.12.1" },
+        ]);
+        // http/https以外の参照URLは除外、typeが無ければWEB扱い
+        expect(explanation.references).toEqual([
+            { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" },
+            { type: "WEB", url: "https://github.com/apache/logging-log4j2/pull/608" },
+        ]);
+    });
+    it("巨大なdetailsは切り詰める", () => {
+        const explanation = buildVulnerabilityExplanation({ id: "X-1", details: "d".repeat(10_000) }, "X-1");
+        expect(explanation.details.length).toBeLessThanOrEqual(4001);
+        expect(explanation.details.endsWith("…")).toBe(true);
+    });
+    it("件数上限を超える配列は上限で打ち切る(DoS・プロンプト肥大対策)", () => {
+        const many = (n, make) => Array.from({ length: n }, (_, i) => make(i));
+        const explanation = buildVulnerabilityExplanation({
+            id: "X-1",
+            aliases: many(30, (i) => `ALIAS-${i}`),
+            severity: many(10, (i) => ({ type: `T${i}`, score: `S${i}` })),
+            affected: many(15, (i) => ({
+                package: { name: `pkg-${i}`, ecosystem: "Maven" },
+                ranges: [{ events: many(30, (j) => ({ introduced: `${j}.0` })) }],
+            })),
+            references: many(30, (i) => ({ type: "WEB", url: `https://example.com/${i}` })),
+        }, "X-1");
+        expect(explanation.aliases).toHaveLength(20);
+        expect(explanation.severity).toHaveLength(5);
+        expect(explanation.affected).toHaveLength(10);
+        expect(explanation.affected[0].ranges).toHaveLength(10);
+        expect(explanation.references).toHaveLength(20);
+    });
+    it("欠損・型不正のレコードでも例外を投げない(idはリクエスト値でフォールバック)", () => {
+        for (const raw of [null, {}, "junk", { affected: "oops", references: 42, severity: {} }]) {
+            const explanation = buildVulnerabilityExplanation(raw, "CVE-2024-1");
+            expect(explanation.id).toBe("CVE-2024-1");
+            expect(explanation.affected).toEqual([]);
+            expect(explanation.references).toEqual([]);
+        }
+    });
+});

package/dist/test/osv/runner.test.js

@@ -0,0 +1,170 @@
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { ScanToolError } from "../../errors.js";
+import { findOsvScannerBinary, installGuidance, OSV_SCANNER_PATH_ENV, resolveOsvScannerBinary, } from "../../osv/binaryManager.js";
+import { runOsvScan } from "../../osv/runner.js";
+let binDir;
+let projectDir;
+/** 偽のosv-scannerスクリプトを作る。テストでは実バイナリの終了コード仕様を模倣する。 */
+async function makeFakeBinary(name, script) {
+    const filePath = path.join(binDir, name);
+    await writeFile(filePath, `#!/bin/sh\n${script}\n`);
+    await chmod(filePath, 0o755);
+    return filePath;
+}
+const VULN_JSON = JSON.stringify({
+    results: [
+        {
+            source: { path: "/x/pom.xml" },
+            packages: [
+                {
+                    package: { name: "a:a", version: "1.0", ecosystem: "Maven" },
+                    groups: [{ ids: ["GHSA-test"], aliases: ["CVE-2020-1"], max_severity: "7.5" }],
+                },
+            ],
+        },
+    ],
+});
+beforeAll(async () => {
+    binDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-bin-"));
+    projectDir = await mkdtemp(path.join(os.tmpdir(), "osv-mcp-proj-"));
+});
+afterAll(async () => {
+    await rm(binDir, { recursive: true, force: true });
+    await rm(projectDir, { recursive: true, force: true });
+});
+async function expectScanError(promise, kind) {
+    const error = await promise.then(() => null, (e) => e);
+    expect(error).toBeInstanceOf(ScanToolError);
+    expect(error.kind).toBe(kind);
+    return error;
+}
+describe("runOsvScan", () => {
+    it("exit 1(脆弱性あり)のJSONをレポートに変換する", async () => {
+        const bin = await makeFakeBinary("fake-vulns", `echo '${VULN_JSON}'; exit 1`);
+        const report = await runOsvScan(projectDir, { binaryPath: bin });
+        expect(report.vulnerability_count).toBe(1);
+        expect(report.packages[0].vulnerabilities[0].cve).toBe("CVE-2020-1");
+    });
+    it("exit 0(脆弱性なし)は空レポートを返す", async () => {
+        const bin = await makeFakeBinary("fake-clean", `echo '{"results":[]}'; exit 0`);
+        const report = await runOsvScan(projectDir, { binaryPath: bin });
+        expect(report.vulnerability_count).toBe(0);
+        expect(report.packages).toEqual([]);
+    });
+    it("exit 128はno_packages_found", async () => {
+        const bin = await makeFakeBinary("fake-nopkg", `echo 'No package sources found' >&2; exit 128`);
+        await expectScanError(runOsvScan(projectDir, { binaryPath: bin }), "no_packages_found");
+    });
+    it("その他の終了コードはscan_failed(stderr抜粋をdetailに含む)", async () => {
+        const bin = await makeFakeBinary("fake-fail", `echo 'something broke' >&2; exit 127`);
+        const error = await expectScanError(runOsvScan(projectDir, { binaryPath: bin }), "scan_failed");
+        expect(error.detail).toContain("something broke");
+    });
+    it("JSONでない出力はinvalid_output", async () => {
+        const bin = await makeFakeBinary("fake-notjson", `echo 'oops not json'; exit 0`);
+        await expectScanError(runOsvScan(projectDir, { binaryPath: bin }), "invalid_output");
+    });
+    it("タイムアウトでプロセスを打ち切りscan_timeout", async () => {
+        const bin = await makeFakeBinary("fake-slow", `sleep 30; echo '{"results":[]}'`);
+        await expectScanError(runOsvScan(projectDir, { binaryPath: bin, timeoutMs: 300 }), "scan_timeout");
+    });
+    it("出力サイズ上限を超えたらoutput_too_large", async () => {
+        const bin = await makeFakeBinary("fake-huge", `head -c 100000 /dev/zero | tr '\\0' 'a'; exit 0`);
+        await expectScanError(runOsvScan(projectDir, { binaryPath: bin, maxOutputBytes: 10_000 }), "output_too_large");
+    });
+    it("バイナリが起動できなければscan_failed", async () => {
+        await expectScanError(runOsvScan(projectDir, { binaryPath: path.join(binDir, "does-not-exist") }), "scan_failed");
+    });
+    it("binaryPath省略時はOSV_SCANNER_PATH環境変数から解決する", async () => {
+        const bin = await makeFakeBinary("env-resolved", `echo '{"results":[]}'; exit 0`);
+        const previous = process.env[OSV_SCANNER_PATH_ENV];
+        process.env[OSV_SCANNER_PATH_ENV] = bin;
+        try {
+            const report = await runOsvScan(projectDir);
+            expect(report.vulnerability_count).toBe(0);
+        }
+        finally {
+            if (previous === undefined)
+                delete process.env[OSV_SCANNER_PATH_ENV];
+            else
+                process.env[OSV_SCANNER_PATH_ENV] = previous;
+        }
+    });
+    it("シグナルで強制終了された場合もscan_failed(signal情報付き)", async () => {
+        const bin = await makeFakeBinary("fake-killed", `kill -KILL $$`);
+        const error = await expectScanError(runOsvScan(projectDir, { binaryPath: bin }), "scan_failed");
+        expect(error.message).toContain("SIGKILL");
+    });
+});
+describe("binaryManager", () => {
+    it("PATHからosv-scannerを見つける", async () => {
+        await makeFakeBinary("osv-scanner", `exit 0`);
+        const env = { PATH: binDir };
+        expect(await findOsvScannerBinary(env)).toBe(path.join(binDir, "osv-scanner"));
+    });
+    it("OSV_SCANNER_PATHの明示指定を優先し、無効ならPATHにフォールバックしない", async () => {
+        const explicit = await makeFakeBinary("custom-scanner", `exit 0`);
+        const env = {
+            PATH: binDir,
+            [OSV_SCANNER_PATH_ENV]: explicit,
+        };
+        expect(await findOsvScannerBinary(env)).toBe(explicit);
+        const badEnv = {
+            PATH: binDir, // PATH上には有効なosv-scannerがあるが、明示指定が優先される
+            [OSV_SCANNER_PATH_ENV]: "/no/such/binary",
+        };
+        expect(await findOsvScannerBinary(badEnv)).toBeNull();
+    });
+    it("見つからず自動ダウンロードも無効なら案内メッセージ付きのbinary_not_found", async () => {
+        const env = {
+            PATH: "/nonexistent-dir-for-test",
+            OSV_MCP_AUTO_DOWNLOAD: "0",
+        };
+        const error = await resolveOsvScannerBinary(env).then(() => null, (e) => e);
+        expect(error).toBeInstanceOf(ScanToolError);
+        expect(error.kind).toBe("binary_not_found");
+        expect(error.message).toContain("brew install osv-scanner");
+        expect(installGuidance(env)).toContain(OSV_SCANNER_PATH_ENV);
+    });
+    it("見つからなければ自動ダウンロードにフォールバックする(デフォルト有効)", async () => {
+        const env = { PATH: "/nonexistent-dir-for-test" };
+        let downloadCalled = false;
+        const resolved = await resolveOsvScannerBinary(env, {
+            downloadFn: async () => {
+                downloadCalled = true;
+                return "/cache/osv-scanner";
+            },
+        });
+        expect(downloadCalled).toBe(true);
+        expect(resolved).toBe("/cache/osv-scanner");
+    });
+    it("OSV_SCANNER_PATHが無効な場合は自動ダウンロードせずbinary_not_found", async () => {
+        const env = {
+            PATH: "/nonexistent-dir-for-test",
+            [OSV_SCANNER_PATH_ENV]: "/no/such/binary",
+        };
+        let downloadCalled = false;
+        const error = await resolveOsvScannerBinary(env, {
+            downloadFn: async () => {
+                downloadCalled = true;
+                return "/cache/osv-scanner";
+            },
+        }).then(() => null, (e) => e);
+        expect(downloadCalled).toBe(false);
+        expect(error.kind).toBe("binary_not_found");
+    });
+    it("resolveOsvScannerBinaryは見つかったバイナリのパスを返す", async () => {
+        const bin = await makeFakeBinary("osv-scanner", `exit 0`);
+        const env = { PATH: binDir };
+        expect(await resolveOsvScannerBinary(env)).toBe(bin);
+    });
+    it("環境変数が無効なパスを指す場合は案内メッセージでその旨を伝える", () => {
+        const env = { [OSV_SCANNER_PATH_ENV]: "/no/such/binary" };
+        const guidance = installGuidance(env);
+        expect(guidance).toContain("/no/such/binary");
+        expect(guidance).toContain("実行可能ファイルを指していません");
+    });
+});