pr-checkmate 1.22.7 → 1.23.0

package/dist/core/checks/diff-security.js

@@ -1,145 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.diffSecurityCheck = void 0;
-const utils_1 = require("../../utils");
-const types_1 = require("../types");
-const findings_1 = require("./findings");
-const SECURITY_PATTERNS = [
-    {
-        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
-        label: 'dangerouslySetInnerHTML (XSS risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
-        label: 'innerHTML assignment (XSS risk)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*document\.write\s*\(/,
-        label: 'document.write() (XSS risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+)(?![^'"`]*['"`]).*\beval\s*\(/,
-        label: 'eval() (code injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
-        label: 'new Function() (code injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*__proto__\s*[=:[]/,
-        label: '__proto__ mutation (prototype pollution)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\.constructor\.prototype\b/,
-        label: 'constructor.prototype access (prototype pollution)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
-        label: 'MD5 (weak hash — use sha256 or stronger)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
-        label: 'SHA-1 (weak hash — use sha256 or stronger)',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
-        label: 'deprecated createDecipher() — use createDecipheriv()',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
-        label: 'deprecated createCipher() — use createCipheriv()',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
-        label: "CORS wildcard origin: '*' (allows any domain)",
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
-        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
-        label: 'Insecure HTTP (non-HTTPS) in external call',
-        severity: 'warn',
-    },
-    {
-        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
-        label: 'exec/spawn with template literal (command injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
-        label: 'exec/spawn with string concatenation (command injection risk)',
-        severity: 'error',
-    },
-    {
-        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
-        label: 'SQL query with template literal interpolation (SQL injection risk)',
-        severity: 'error',
-    },
-    {
-        // A quoted string that contains a whole SQL keyword, concatenated with a
-        // variable — the real injection shape. Word boundaries + the quote context
-        // stop identifiers like `insertions + deletions` from false-positiving.
-        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
-        label: 'SQL string concatenation (SQL injection risk)',
-        severity: 'error',
-    },
-];
-/** Bucket added-line matches by severity, keyed by pattern label. */
-function scanDiff(stdout) {
-    const errors = {};
-    const warnings = {};
-    for (const line of stdout.split('\n')) {
-        for (const { pattern, label, severity } of SECURITY_PATTERNS) {
-            if (pattern.test(line)) {
-                const bucket = severity === 'error' ? errors : warnings;
-                (bucket[label] ?? (bucket[label] = [])).push(line.slice(1).trim().substring(0, 120));
-            }
-        }
-    }
-    return { errors, warnings };
-}
-exports.diffSecurityCheck = {
-    name: 'Diff Security',
-    phase: 'informational',
-    applies(ctx) {
-        return ctx.config.diffSecurity?.enabled !== false && Boolean(ctx.baseSha);
-    },
-    async run(ctx) {
-        try {
-            const stdout = await (0, findings_1.diffAddedLines)(ctx, [
-                '*.ts',
-                '*.tsx',
-                '*.js',
-                '*.jsx',
-                '*.mjs',
-                '*.cjs',
-            ]);
-            const { errors, warnings } = scanDiff(stdout);
-            return (0, findings_1.reportSeverityBuckets)(errors, warnings, {
-                prefix: 'Diff Security',
-                errorSummary: n => `${n} issue(s)`,
-                warningSummary: n => `${n} warning(s)`,
-                sampleLimit: 3,
-            });
-        }
-        catch (err) {
-            utils_1.logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
-            return (0, types_1.skip)('diff unavailable');
-        }
-    },
-};

package/dist/utils/delta.d.ts

@@ -1,5 +0,0 @@
-/**
- * Returns list of changed files in the current PR filtered by extension.
- * Returns null when not in a GitHub PR context (falls back to full-project scan).
- */
-export declare function getChangedFiles(extensions: string[]): Promise<string[] | null>;

package/dist/utils/delta.js

@@ -1,53 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getChangedFiles = getChangedFiles;
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const execa_1 = require("./execa");
-const logger_1 = require("./logger");
-/**
- * Returns list of changed files in the current PR filtered by extension.
- * Returns null when not in a GitHub PR context (falls back to full-project scan).
- */
-async function getChangedFiles(extensions) {
-    const eventName = process.env.GITHUB_EVENT_NAME;
-    const eventPath = process.env.GITHUB_EVENT_PATH;
-    if (eventName !== 'pull_request' || !eventPath || !node_fs_1.default.existsSync(eventPath)) {
-        return null;
-    }
-    let baseSha = null;
-    try {
-        const event = JSON.parse(node_fs_1.default.readFileSync(eventPath, 'utf-8'));
-        baseSha = event?.pull_request?.base?.sha ?? null;
-    }
-    catch {
-        return null;
-    }
-    if (!baseSha)
-        return null;
-    try {
-        const { stdout } = await (0, execa_1.execa)('git', [
-            'diff',
-            '--name-only',
-            '--diff-filter=ACMR',
-            baseSha,
-            'HEAD',
-        ]);
-        const files = stdout
-            .split('\n')
-            .map(f => f.trim())
-            .filter(f => f && extensions.some(ext => f.endsWith(ext)))
-            .map(f => node_path_1.default.join(process.cwd(), f));
-        if (files.length === 0)
-            return null;
-        logger_1.logger.info(`[delta]: 📂 Delta mode: checking ${files.length} changed file(s)`);
-        return files;
-    }
-    catch (err) {
-        logger_1.logger.warn(`[delta]: ⚠️ Could not get changed files, falling back to full scan\n${err}`);
-        return null;
-    }
-}

package/src/config/eslint.config.mjs

@@ -1,180 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import tsPlugin from '@typescript-eslint/eslint-plugin';
-import tsParser from '@typescript-eslint/parser';
-import prettierPlugin from 'eslint-plugin-prettier';
-import sonarjsPlugin from 'eslint-plugin-sonarjs';
-import importPlugin from 'eslint-plugin-import-x';
-import jsdocPlugin from 'eslint-plugin-jsdoc';
-
-/**
- * Default ESLint rules - can be exported for use in init.ts
- */
-export const defaultRules = {
-  'no-console': 'warn',
-  'no-debugger': 'error',
-  'prefer-const': 'error',
-  'eqeqeq': ['error', 'always'],
-  '@typescript-eslint/no-unused-vars': [
-    'error',
-    { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
-  ],
-  '@typescript-eslint/explicit-function-return-type': ['warn'],
-  '@typescript-eslint/no-explicit-any': ['warn'],
-  '@typescript-eslint/no-floating-promises': ['error'],
-  'space-before-function-paren': 'off',
-  'operator-linebreak': 'off',
-  'max-len': ['warn', { code: 100 }],
-  'semi': ['error', 'always'],
-  'quotes': ['error', 'single', { avoidEscape: true }],
-  'object-curly-spacing': ['error', 'always'],
-  'space-infix-ops': 'error',
-  'keyword-spacing': ['error', { before: true, after: true }],
-  'padding-line-between-statements': [
-    'error',
-    { blankLine: 'always', prev: 'block', next: '*' },
-    { blankLine: 'always', prev: '*', next: 'return' },
-  ],
-  // Complexity analysis (#61)
-  'sonarjs/cognitive-complexity': ['warn', 30],
-  'sonarjs/no-duplicate-string': ['warn', { threshold: 3 }],
-  'sonarjs/no-identical-functions': 'warn',
-  // Import ordering (#65)
-  'import/order': [
-    'warn',
-    {
-      groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
-      alphabetize: { order: 'asc', caseInsensitive: true },
-    },
-  ],
-  'import/no-duplicates': 'error',
-  // Documentation (#62)
-  'jsdoc/require-jsdoc': [
-    'warn',
-    {
-      publicOnly: true,
-      require: {
-        FunctionDeclaration: true,
-        MethodDefinition: true,
-        ClassDeclaration: true,
-        ArrowFunctionExpression: false,
-      },
-    },
-  ],
-  'jsdoc/check-param-names': 'warn',
-  'jsdoc/check-tag-names': 'warn',
-  'jsdoc/check-types': 'warn',
-  'prettier/prettier': [
-    'error',
-    {
-      semi: true,
-      singleQuote: true,
-      bracketSpacing: true,
-      arrowParens: 'avoid',
-      printWidth: 100,
-    },
-  ],
-};
-
-/**
- * Default ignore patterns
- */
-const defaultIgnores = [
-  '**/node_modules/**',
-  '**/dist/**',
-  '**/.git/**',
-  '**/build/**',
-  '**/coverage/**',
-];
-
-/**
- * Load user's pr-checkmate.json from project root
- * Works both when developing the package and when installed in node_modules
- */
-function loadUserConfig() {
-  let currentDir = process.cwd();
-  let configPath = path.join(currentDir, 'pr-checkmate.json');
-  
-  // If running from node_modules, find project root
-  if (currentDir.includes('node_modules')) {
-    const parts = currentDir.split(path.sep);
-    const nodeModulesIndex = parts.lastIndexOf('node_modules');
-    if (nodeModulesIndex > 0) {
-      currentDir = parts.slice(0, nodeModulesIndex).join(path.sep);
-      configPath = path.join(currentDir, 'pr-checkmate.json');
-    }
-  }
-  
-  if (fs.existsSync(configPath)) {
-    try {
-      const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-      console.error(`[loadUserConfig]: ✅ Loaded user config from: ${configPath}`);
-      return config;
-    } catch (err) {
-      console.warn(`[loadUserConfig]: ⚠️ Failed to parse ${configPath}:`, err.message);
-    }
-  } else {
-    console.error(`[loadUserConfig]: No pr-checkmate.json found, using defaults`);
-  }
-  
-  return { sourcePath: 'src', eslint: {} };
-}
-
-const userConfig = loadUserConfig();
-const SRC = userConfig.sourcePath || 'src';
-
-// Merge default rules with user-defined rules
-const mergedRules = {
-  ...defaultRules,
-  ...(userConfig.eslint?.rules || {}),
-};
-
-// Merge default ignores with user-defined ignores
-const mergedIgnores = [
-  ...defaultIgnores,
-  '**/.eslintrc.js',
-  '**/eslint.config.mjs',
-  ...(userConfig.eslint?.ignorePatterns || []),
-];
-
-// Log customization info
-const customRulesCount = Object.keys(userConfig.eslint?.rules || {}).length;
-const customIgnoresCount = (userConfig.eslint?.ignorePatterns || []).length;
-
-if (customRulesCount > 0) {
-  console.error(`Applied ${customRulesCount} custom ESLint rules`);
-}
-if (customIgnoresCount > 0) {
-  console.error(`🚫 Applied ${customIgnoresCount} custom ignore patterns`);
-}
-
-console.error(`ESLint checking: ${SRC}/**/*.{ts,tsx,js,jsx}`);
-
-export default [
-  // Global ignores must be in a separate config object
-  {
-    ignores: mergedIgnores,
-  },
-  {
-    files: [`${SRC}/**/*.{ts,tsx,js,jsx}`],
-
-    languageOptions: {
-      parser: tsParser,
-      parserOptions: {
-        ecmaVersion: 2020,
-        sourceType: 'module',
-        project: './tsconfig.json',
-      },
-    },
-
-    plugins: {
-      '@typescript-eslint': tsPlugin,
-      prettier: prettierPlugin,
-      sonarjs: sonarjsPlugin,
-      import: importPlugin,
-      jsdoc: jsdocPlugin,
-    },
-
-    rules: mergedRules,
-  },
-];