postquant 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +57 -14
- package/dist/commands/analyze.d.ts.map +1 -1
- package/dist/commands/analyze.js +15 -5
- package/dist/commands/analyze.js.map +1 -1
- package/dist/index.js +4 -0
- package/dist/index.js.map +1 -1
- package/dist/output/json-code.d.ts.map +1 -1
- package/dist/output/json-code.js +12 -0
- package/dist/output/json-code.js.map +1 -1
- package/dist/output/sarif.d.ts.map +1 -1
- package/dist/output/sarif.js +27 -2
- package/dist/output/sarif.js.map +1 -1
- package/dist/output/terminal-code.d.ts +1 -0
- package/dist/output/terminal-code.d.ts.map +1 -1
- package/dist/output/terminal-code.js +66 -6
- package/dist/output/terminal-code.js.map +1 -1
- package/dist/scanner/code/grader.d.ts.map +1 -1
- package/dist/scanner/code/grader.js +75 -21
- package/dist/scanner/code/grader.js.map +1 -1
- package/dist/scanner/code/matcher.d.ts +11 -2
- package/dist/scanner/code/matcher.d.ts.map +1 -1
- package/dist/scanner/code/matcher.js +3 -2
- package/dist/scanner/code/matcher.js.map +1 -1
- package/dist/scanner/code/risk-assessor.d.ts +25 -0
- package/dist/scanner/code/risk-assessor.d.ts.map +1 -0
- package/dist/scanner/code/risk-assessor.js +412 -0
- package/dist/scanner/code/risk-assessor.js.map +1 -0
- package/dist/types/index.d.ts +21 -0
- package/dist/types/index.d.ts.map +1 -1
- package/dist/types/index.js +4 -1
- package/dist/types/index.js.map +1 -1
- package/package.json +4 -1
|
@@ -1,6 +1,27 @@
|
|
|
1
|
+
import { isAssessedFinding } from '../../types/index.js';
|
|
1
2
|
const BASE_GRADE_ORDER = ['A+', 'A', 'B', 'C', 'D', 'F'];
|
|
2
3
|
/** Algorithms that are already broken classically — cap grade at D. */
|
|
3
4
|
const BROKEN_ALGORITHMS = ['MD5', 'SHA-1', 'SHA1', 'DES', '3DES', 'TRIPLE-DES'];
|
|
5
|
+
/**
|
|
6
|
+
* Map a finding to a grade bucket using adjusted risk when available,
|
|
7
|
+
* falling back to the raw `risk` field for unassessed findings.
|
|
8
|
+
*/
|
|
9
|
+
function getEffectiveGradeBucket(f) {
|
|
10
|
+
if (isAssessedFinding(f)) {
|
|
11
|
+
switch (f.riskContext.adjustedRisk) {
|
|
12
|
+
case 'critical':
|
|
13
|
+
case 'high':
|
|
14
|
+
return 'critical';
|
|
15
|
+
case 'medium':
|
|
16
|
+
return 'moderate';
|
|
17
|
+
case 'low':
|
|
18
|
+
case 'informational':
|
|
19
|
+
return 'excluded';
|
|
20
|
+
}
|
|
21
|
+
}
|
|
22
|
+
// Raw finding — use original risk
|
|
23
|
+
return f.risk === 'critical' ? 'critical' : f.risk === 'moderate' ? 'moderate' : 'safe';
|
|
24
|
+
}
|
|
4
25
|
/**
|
|
5
26
|
* Grade a code scan result.
|
|
6
27
|
*
|
|
@@ -22,39 +43,58 @@ const BROKEN_ALGORITHMS = ['MD5', 'SHA-1', 'SHA1', 'DES', '3DES', 'TRIPLE-DES'];
|
|
|
22
43
|
*/
|
|
23
44
|
export function gradeCodeScan(scan) {
|
|
24
45
|
const { findings } = scan;
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
46
|
+
// Count findings by effective grade bucket (uses adjustedRisk when available)
|
|
47
|
+
let critical = 0;
|
|
48
|
+
let moderate = 0;
|
|
49
|
+
let safe = 0;
|
|
50
|
+
for (const f of findings) {
|
|
51
|
+
const bucket = getEffectiveGradeBucket(f);
|
|
52
|
+
if (bucket === 'critical')
|
|
53
|
+
critical++;
|
|
54
|
+
else if (bucket === 'moderate')
|
|
55
|
+
moderate++;
|
|
56
|
+
else if (bucket === 'safe' || bucket === 'excluded')
|
|
57
|
+
safe++;
|
|
58
|
+
}
|
|
28
59
|
// Determine base grade from critical/moderate counts
|
|
29
60
|
let baseGrade;
|
|
30
|
-
if (critical
|
|
61
|
+
if (critical === 0 && moderate === 0) {
|
|
31
62
|
const hasPqc = findings.some((f) => f.category === 'pqc-algorithm');
|
|
32
63
|
baseGrade = hasPqc ? 'A+' : 'A';
|
|
33
64
|
}
|
|
34
|
-
else if (critical
|
|
65
|
+
else if (critical === 0) {
|
|
35
66
|
baseGrade = 'B';
|
|
36
67
|
}
|
|
37
|
-
else if (critical
|
|
68
|
+
else if (critical <= 5) {
|
|
38
69
|
baseGrade = 'C';
|
|
39
70
|
}
|
|
40
|
-
else if (critical
|
|
71
|
+
else if (critical <= 20) {
|
|
41
72
|
baseGrade = 'D';
|
|
42
73
|
}
|
|
43
74
|
else {
|
|
44
75
|
baseGrade = 'F';
|
|
45
76
|
}
|
|
46
77
|
// Special case: broken algorithms cap at D
|
|
47
|
-
|
|
78
|
+
// Only applies when the finding's adjusted risk is critical or high
|
|
79
|
+
const hasBrokenAlgo = findings.some((f) => {
|
|
80
|
+
const isBroken = BROKEN_ALGORITHMS.some((broken) => f.algorithm.toUpperCase() === broken.toUpperCase());
|
|
81
|
+
if (!isBroken)
|
|
82
|
+
return false;
|
|
83
|
+
if (isAssessedFinding(f)) {
|
|
84
|
+
return f.riskContext.adjustedRisk === 'critical' || f.riskContext.adjustedRisk === 'high';
|
|
85
|
+
}
|
|
86
|
+
return true; // Raw finding — cap as before
|
|
87
|
+
});
|
|
48
88
|
if (hasBrokenAlgo && gradeRank(baseGrade) < gradeRank('D')) {
|
|
49
89
|
baseGrade = 'D';
|
|
50
90
|
}
|
|
51
91
|
// Compute modifier (same logic as TLS grader)
|
|
52
92
|
let modifier = '';
|
|
53
93
|
if (baseGrade !== 'A+' && baseGrade !== 'A' && baseGrade !== 'F') {
|
|
54
|
-
if (moderate
|
|
94
|
+
if (moderate === 0) {
|
|
55
95
|
modifier = '+';
|
|
56
96
|
}
|
|
57
|
-
else if (moderate
|
|
97
|
+
else if (moderate >= 2) {
|
|
58
98
|
modifier = '-';
|
|
59
99
|
}
|
|
60
100
|
}
|
|
@@ -75,9 +115,9 @@ export function gradeCodeScan(scan) {
|
|
|
75
115
|
findings,
|
|
76
116
|
migrationNotes: [...migrationSet],
|
|
77
117
|
summary: {
|
|
78
|
-
critical
|
|
79
|
-
moderate
|
|
80
|
-
safe
|
|
118
|
+
critical,
|
|
119
|
+
moderate,
|
|
120
|
+
safe,
|
|
81
121
|
total: findings.length,
|
|
82
122
|
filesScanned: scan.filesScanned,
|
|
83
123
|
filesWithFindings: scan.filesWithFindings,
|
|
@@ -92,14 +132,28 @@ function buildFileBreakdown(findings) {
|
|
|
92
132
|
list.push(f);
|
|
93
133
|
byFile.set(f.file, list);
|
|
94
134
|
}
|
|
95
|
-
return [...byFile.entries()].map(([file, fileFindgs]) =>
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
135
|
+
return [...byFile.entries()].map(([file, fileFindgs]) => {
|
|
136
|
+
let criticalCount = 0;
|
|
137
|
+
let moderateCount = 0;
|
|
138
|
+
let safeCount = 0;
|
|
139
|
+
for (const f of fileFindgs) {
|
|
140
|
+
const bucket = getEffectiveGradeBucket(f);
|
|
141
|
+
if (bucket === 'critical')
|
|
142
|
+
criticalCount++;
|
|
143
|
+
else if (bucket === 'moderate')
|
|
144
|
+
moderateCount++;
|
|
145
|
+
else
|
|
146
|
+
safeCount++;
|
|
147
|
+
}
|
|
148
|
+
return {
|
|
149
|
+
file,
|
|
150
|
+
language: fileFindgs[0].language,
|
|
151
|
+
findings: fileFindgs,
|
|
152
|
+
criticalCount,
|
|
153
|
+
moderateCount,
|
|
154
|
+
safeCount,
|
|
155
|
+
};
|
|
156
|
+
});
|
|
103
157
|
}
|
|
104
158
|
/** Return numeric rank for a base grade (higher = worse). */
|
|
105
159
|
function gradeRank(g) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"grader.js","sourceRoot":"","sources":["../../../src/scanner/code/grader.ts"],"names":[],"mappings":"AAUA,MAAM,gBAAgB,GAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEtE,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAEhF
|
|
1
|
+
{"version":3,"file":"grader.js","sourceRoot":"","sources":["../../../src/scanner/code/grader.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,gBAAgB,GAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEtE,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;AAEhF;;;GAGG;AACH,SAAS,uBAAuB,CAAC,CAAc;IAC7C,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;YACnC,KAAK,UAAU,CAAC;YAChB,KAAK,MAAM;gBACT,OAAO,UAAU,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,UAAU,CAAC;YACpB,KAAK,KAAK,CAAC;YACX,KAAK,eAAe;gBAClB,OAAO,UAAU,CAAC;QACtB,CAAC;IACH,CAAC;IACD,kCAAkC;IAClC,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE1B,8EAA8E;IAC9E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,UAAU;YAAE,QAAQ,EAAE,CAAC;aACjC,IAAI,MAAM,KAAK,UAAU;YAAE,QAAQ,EAAE,CAAC;aACtC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,UAAU;YAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,qDAAqD;IACrD,IAAI,SAAoB,CAAC;IAEzB,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC;QACpE,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAClC,CAAC;SAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;SAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACzB,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,2CAA2C;IAC3C,oEAAoE;IACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CACnD,CAAC;QACF,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,WAAW,CAAC,YAAY,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,KAAK,MAAM,CAAC;QAC5F,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,8BAA8B;IAC7C,CAAC,CAAC,CAAC;IACH,IAAI,aAAa,IAAI,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ,GAAkB,EAAE,CAAC;IACjC,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;QACjE,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,QAAQ,GAAG,GAAG,CAAC;QACjB,CAAC;aAAM,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,GAAG,GAAG,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAU,CAAC;IAErD,iCAAiC;IACjC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,2BAA2B;IAC3B,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEnD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,YAAY;QACnB,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,cAAc,EAAE,CAAC,GAAG,YAAY,CAAC;QACjC,OAAO,EAAE;YACP,QAAQ;YACR,QAAQ;YACR,IAAI;YACJ,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C;QACD,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAuB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE;QACtD,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,UAAU;gBAAE,aAAa,EAAE,CAAC;iBACtC,IAAI,MAAM,KAAK,UAAU;gBAAE,aAAa,EAAE,CAAC;;gBAC3C,SAAS,EAAE,CAAC;QACnB,CAAC;QACD,OAAO;YACL,IAAI;YACJ,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ;YAChC,QAAQ,EAAE,UAAU;YACpB,aAAa;YACb,aAAa;YACb,SAAS;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,SAAS,SAAS,CAAC,CAAY;IAC7B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAiB,EACjB,SAAoB;IAEpB,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC"}
|
|
@@ -1,8 +1,17 @@
|
|
|
1
1
|
import type { CodeFinding, Language } from '../../types/index.js';
|
|
2
2
|
/**
|
|
3
|
-
*
|
|
3
|
+
* Result of matching a file on disk — includes both findings and raw content
|
|
4
|
+
* so downstream stages (e.g. risk assessor) can inspect surrounding code
|
|
5
|
+
* without re-reading the file.
|
|
4
6
|
*/
|
|
5
|
-
export
|
|
7
|
+
export interface MatchFileResult {
|
|
8
|
+
findings: CodeFinding[];
|
|
9
|
+
content: string;
|
|
10
|
+
}
|
|
11
|
+
/**
|
|
12
|
+
* Scan a file on disk and return code findings alongside the file content.
|
|
13
|
+
*/
|
|
14
|
+
export declare function matchFile(filePath: string, language: Language): Promise<MatchFileResult>;
|
|
6
15
|
/**
|
|
7
16
|
* Scan file content (string) against patterns for a given language.
|
|
8
17
|
* Returns CodeFinding[] with line numbers, confidence, etc.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../../src/scanner/code/matcher.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAiB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEjF;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,
|
|
1
|
+
{"version":3,"file":"matcher.d.ts","sourceRoot":"","sources":["../../../src/scanner/code/matcher.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAiB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEjF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CA8If"}
|
|
@@ -2,12 +2,13 @@ import * as fs from 'node:fs';
|
|
|
2
2
|
import * as path from 'node:path';
|
|
3
3
|
import { getPatterns } from './patterns/index.js';
|
|
4
4
|
/**
|
|
5
|
-
* Scan a file on disk and return code findings.
|
|
5
|
+
* Scan a file on disk and return code findings alongside the file content.
|
|
6
6
|
*/
|
|
7
7
|
export async function matchFile(filePath, language) {
|
|
8
8
|
const content = await fs.promises.readFile(filePath, 'utf-8');
|
|
9
9
|
const relativeName = path.basename(filePath);
|
|
10
|
-
|
|
10
|
+
const findings = matchFileContent(content, language, relativeName);
|
|
11
|
+
return { findings, content };
|
|
11
12
|
}
|
|
12
13
|
/**
|
|
13
14
|
* Scan file content (string) against patterns for a given language.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../../src/scanner/code/matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"matcher.js","sourceRoot":"","sources":["../../../src/scanner/code/matcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAalD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,QAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,QAAkB,EAClB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,wDAAwD;IACxD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,cAAc;gBAAE,SAAS;YACtC,IAAI,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,iBAAiB,GAA0B,IAAI,CAAC;IAEpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAE/B,iCAAiC;QACjC,IAAI,cAAc,EAAE,CAAC;YACnB,IACE,iBAAiB,KAAK,GAAG;gBACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EACtB,CAAC;gBACD,cAAc,GAAG,KAAK,CAAC;gBACvB,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;iBAAM,IACL,iBAAiB,KAAK,QAAQ;gBAC9B,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EACpD,CAAC;gBACD,cAAc,GAAG,KAAK,CAAC;gBACvB,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,SAAS;QACX,CAAC;QAED,iCAAiC;QACjC,IACE,CAAC,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;YACvE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACxB,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,cAAc,GAAG,IAAI,CAAC;gBACtB,iBAAiB,GAAG,GAAG,CAAC;YAC1B,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,2EAA2E;oBAC3E,SAAS;gBACX,CAAC;qBAAM,CAAC;oBACN,6BAA6B;oBAC7B,cAAc,GAAG,IAAI,CAAC;oBACtB,iBAAiB,GAAG,QAAQ,CAAC;oBAC7B,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/D,IACE,CAAC,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;YACvE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,SAAS;QAEX,kDAAkD;QAClD,IACE,CAAC,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,CAAC;YACvE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtB,SAAS;QAEX,qCAAqC;QACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEvD,uDAAuD;QACvD,IAAI,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,SAAS;QAEtD,+BAA+B;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY;gBAEtC,uBAAuB;gBACvB,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;gBACpC,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChE,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAC9D,CAAC;gBAED,wCAAwC;gBACxC,IAAI,OAA2B,CAAC;gBAChC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBACxB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACtD,IAAI,KAAK,EAAE,CAAC;wBACV,yCAAyC;wBACzC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;wBAC5D,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;4BAChC,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gCAC3C,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,WAAW,EAAE,OAAO;oBACpB,QAAQ;oBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO;oBACP,IAAI;oBACJ,MAAM,EAAE,OAAO,CAAC,WAAW;oBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU;iBACX,CAAC,CAAC;gBAEH,iEAAiE;gBACjE,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAkB;IAC1D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,6CAA6C;QAC7C,OAAO,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1E,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aACjD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW;IAC9C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,CAAC,QAAQ,CAAC;aACjD,IACH,CAAC,QAAQ;YACT,CAAC,QAAQ;YACT,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,EACrC,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,QAAkB;IAC3D,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,6DAA6D;QAC7D,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACrD,yCAAyC;QACzC,IAAI,6DAA6D,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5F,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,qDAAqD;QACrD,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Risk Assessment Layer for PostQuant v0.3.0
|
|
3
|
+
*
|
|
4
|
+
* Analyzes the CONTEXT of each cryptographic finding to determine
|
|
5
|
+
* whether the algorithm usage is security-critical or benign.
|
|
6
|
+
* MD5 in password hashing is critical; MD5 in UUID v3 is informational.
|
|
7
|
+
*/
|
|
8
|
+
import type { CodeFinding, Language, RiskLevel, UsageContext, AdjustedRisk, ContextSignal, AssessedFinding } from '../../types/index.js';
|
|
9
|
+
export interface ResolvedContext {
|
|
10
|
+
context: UsageContext;
|
|
11
|
+
influence: 'increases-risk' | 'decreases-risk' | 'neutral';
|
|
12
|
+
}
|
|
13
|
+
export declare function detectFilePathSignals(filePath: string): ContextSignal[];
|
|
14
|
+
export declare function detectNearbyCodeSignals(lines: string[], lineNumber: number, windowSize?: number): ContextSignal[];
|
|
15
|
+
export declare function detectImportSignals(content: string, language: Language): ContextSignal[];
|
|
16
|
+
export declare function detectFunctionNameSignals(matchedLine: string): ContextSignal[];
|
|
17
|
+
export interface ProtocolPatternResult {
|
|
18
|
+
signal: ContextSignal;
|
|
19
|
+
contextOverride: UsageContext;
|
|
20
|
+
}
|
|
21
|
+
export declare function detectProtocolPattern(finding: CodeFinding, lines: string[], lineNumber: number, imports: string): ProtocolPatternResult | null;
|
|
22
|
+
export declare function resolveContext(signals: ContextSignal[]): ResolvedContext;
|
|
23
|
+
export declare function computeAdjustedRisk(originalRisk: RiskLevel, context: UsageContext): AdjustedRisk;
|
|
24
|
+
export declare function assessFindings(findings: CodeFinding[], fileContents: Map<string, string>): AssessedFinding[];
|
|
25
|
+
//# sourceMappingURL=risk-assessor.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"risk-assessor.d.ts","sourceRoot":"","sources":["../../../src/scanner/code/risk-assessor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,EAEb,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAI9B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,SAAS,CAAC;CAC5D;AAkFD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,CAcvE;AA4BD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,UAAU,GAAE,MAAU,GACrB,aAAa,EAAE,CAsBjB;AA6CD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,aAAa,EAAE,CA4BxF;AAuBD,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,EAAE,CAgB9E;AAkDD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,aAAa,CAAC;IACtB,eAAe,EAAE,YAAY,CAAC;CAC/B;AAUD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,qBAAqB,GAAG,IAAI,CAuB9B;AAID,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,eAAe,CAqBxE;AA2DD,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,SAAS,EACvB,OAAO,EAAE,YAAY,GACpB,YAAY,CAEd;AAID,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,WAAW,EAAE,EACvB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,eAAe,EAAE,CAEnB"}
|