privalint 0.3.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (64) hide show
  1. package/README.de.md +38 -0
  2. package/README.md +49 -11
  3. package/dist/assessment.d.ts +1 -1
  4. package/dist/assessment.js +45 -9
  5. package/dist/assessment.js.map +1 -1
  6. package/dist/capture.js +10 -3
  7. package/dist/capture.js.map +1 -1
  8. package/dist/cli.js +44 -11
  9. package/dist/cli.js.map +1 -1
  10. package/dist/config.d.ts +21 -0
  11. package/dist/config.js +113 -0
  12. package/dist/config.js.map +1 -0
  13. package/dist/consent.js +70 -8
  14. package/dist/consent.js.map +1 -1
  15. package/dist/coverage.d.ts +13 -0
  16. package/dist/coverage.js +86 -0
  17. package/dist/coverage.js.map +1 -0
  18. package/dist/data/third-parties.js +9 -0
  19. package/dist/data/third-parties.js.map +1 -1
  20. package/dist/diagnostics.d.ts +7 -3
  21. package/dist/diagnostics.js +36 -8
  22. package/dist/diagnostics.js.map +1 -1
  23. package/dist/index.d.ts +3 -0
  24. package/dist/index.js +3 -0
  25. package/dist/index.js.map +1 -1
  26. package/dist/network.d.ts +3 -2
  27. package/dist/network.js +6 -4
  28. package/dist/network.js.map +1 -1
  29. package/dist/observations.d.ts +5 -1
  30. package/dist/observations.js +6 -1
  31. package/dist/observations.js.map +1 -1
  32. package/dist/policy.d.ts +6 -0
  33. package/dist/policy.js +37 -0
  34. package/dist/policy.js.map +1 -0
  35. package/dist/report-contract.d.ts +13 -0
  36. package/dist/report-contract.js +16 -0
  37. package/dist/report-contract.js.map +1 -0
  38. package/dist/reporters/capture.js +56 -4
  39. package/dist/reporters/capture.js.map +1 -1
  40. package/dist/reporters/markdown.js +6 -1
  41. package/dist/reporters/markdown.js.map +1 -1
  42. package/dist/reporters/messages.d.ts +1 -0
  43. package/dist/reporters/messages.js +6 -0
  44. package/dist/reporters/messages.js.map +1 -1
  45. package/dist/reporters/sarif.js +25 -11
  46. package/dist/reporters/sarif.js.map +1 -1
  47. package/dist/reporters/shared.js +3 -2
  48. package/dist/reporters/shared.js.map +1 -1
  49. package/dist/reporters/text.js +4 -0
  50. package/dist/reporters/text.js.map +1 -1
  51. package/dist/rules/reject-option.js +3 -1
  52. package/dist/rules/reject-option.js.map +1 -1
  53. package/dist/rules/third-party-embeds.js +2 -2
  54. package/dist/rules/third-party-embeds.js.map +1 -1
  55. package/dist/scan-options.d.ts +7 -1
  56. package/dist/scan-options.js.map +1 -1
  57. package/dist/scanner.js +95 -7
  58. package/dist/scanner.js.map +1 -1
  59. package/dist/types.d.ts +61 -2
  60. package/package.json +7 -1
  61. package/schemas/report-1.0.0.schema.json +813 -0
  62. package/schemas/report-1.1.0.schema.json +833 -0
  63. package/schemas/sarif-properties-1.0.0.schema.json +785 -0
  64. package/schemas/sarif-properties-1.1.0.schema.json +810 -0
@@ -0,0 +1,833 @@
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$id": "https://github.com/JExcellence/privalint/raw/refs/heads/main/schemas/report-1.1.0.schema.json",
4
+ "title": "PrivaLint scan report 1.1.0",
5
+ "description": "Structural contract; not a guarantee of complete observation, URL safety or legal compliance. Counter equations and page-ID references require semantic checks.",
6
+ "type": "object",
7
+ "properties": {
8
+ "scanId": {
9
+ "type": "string",
10
+ "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
11
+ },
12
+ "schemaVersion": {
13
+ "const": "1.1.0"
14
+ },
15
+ "scannerVersion": {
16
+ "type": "string",
17
+ "minLength": 1
18
+ },
19
+ "options": {
20
+ "$ref": "#/$defs/options"
21
+ },
22
+ "siteUrl": {
23
+ "type": "string"
24
+ },
25
+ "lang": {
26
+ "type": "string",
27
+ "enum": [
28
+ "en",
29
+ "de"
30
+ ]
31
+ },
32
+ "region": {
33
+ "type": "string",
34
+ "enum": [
35
+ "de",
36
+ "at",
37
+ "ch",
38
+ "eu"
39
+ ]
40
+ },
41
+ "scannedAt": {
42
+ "type": "string",
43
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"
44
+ },
45
+ "durationMs": {
46
+ "type": "number",
47
+ "minimum": 0
48
+ },
49
+ "pages": {
50
+ "type": "array",
51
+ "items": {
52
+ "$ref": "#/$defs/page"
53
+ }
54
+ },
55
+ "consent": {
56
+ "$ref": "#/$defs/consent"
57
+ },
58
+ "findings": {
59
+ "type": "array",
60
+ "items": {
61
+ "$ref": "#/$defs/finding"
62
+ }
63
+ },
64
+ "rules": {
65
+ "type": "array",
66
+ "items": {
67
+ "$ref": "#/$defs/rule"
68
+ }
69
+ },
70
+ "coverage": {
71
+ "type": "string",
72
+ "enum": [
73
+ "complete",
74
+ "partial"
75
+ ]
76
+ }
77
+ },
78
+ "required": [
79
+ "scanId",
80
+ "schemaVersion",
81
+ "scannerVersion",
82
+ "options",
83
+ "siteUrl",
84
+ "lang",
85
+ "region",
86
+ "scannedAt",
87
+ "durationMs",
88
+ "pages",
89
+ "findings",
90
+ "rules",
91
+ "coverage"
92
+ ],
93
+ "$defs": {
94
+ "diagnostic": {
95
+ "type": "object",
96
+ "properties": {
97
+ "kind": {
98
+ "type": "string",
99
+ "enum": [
100
+ "security-blocked",
101
+ "unsupported-method",
102
+ "unsupported-protocol",
103
+ "dns",
104
+ "tls",
105
+ "connection",
106
+ "timeout",
107
+ "resource-limit",
108
+ "http-error",
109
+ "browser-failure",
110
+ "skipped",
111
+ "aborted"
112
+ ]
113
+ },
114
+ "phase": {
115
+ "type": "string",
116
+ "enum": [
117
+ "before-consent",
118
+ "after-reject"
119
+ ]
120
+ },
121
+ "url": {
122
+ "type": "string",
123
+ "pattern": "^(https?://[^/?#@\\s]+/\\[redacted\\]|\\[redacted\\])$"
124
+ },
125
+ "status": {
126
+ "type": "integer",
127
+ "minimum": 100,
128
+ "maximum": 599
129
+ },
130
+ "limit": {
131
+ "type": "string",
132
+ "enum": [
133
+ "requests",
134
+ "response-bytes",
135
+ "total-bytes",
136
+ "redirects"
137
+ ]
138
+ },
139
+ "skippedReason": {
140
+ "type": "string",
141
+ "enum": [
142
+ "beacon",
143
+ "unsupported-method",
144
+ "unsupported-protocol",
145
+ "policy"
146
+ ]
147
+ }
148
+ },
149
+ "required": [
150
+ "kind",
151
+ "phase",
152
+ "url"
153
+ ]
154
+ },
155
+ "diagnostics": {
156
+ "type": "object",
157
+ "properties": {
158
+ "requests": {
159
+ "type": "integer",
160
+ "minimum": 0
161
+ },
162
+ "omittedRequests": {
163
+ "type": "integer",
164
+ "minimum": 0
165
+ },
166
+ "responses": {
167
+ "type": "integer",
168
+ "minimum": 0
169
+ },
170
+ "finished": {
171
+ "type": "integer",
172
+ "minimum": 0
173
+ },
174
+ "failed": {
175
+ "type": "integer",
176
+ "minimum": 0
177
+ },
178
+ "blocked": {
179
+ "type": "integer",
180
+ "minimum": 0
181
+ },
182
+ "skippedRequests": {
183
+ "type": "integer",
184
+ "minimum": 0
185
+ },
186
+ "failedRequests": {
187
+ "type": "integer",
188
+ "minimum": 0
189
+ },
190
+ "securityBlockedRequests": {
191
+ "type": "integer",
192
+ "minimum": 0
193
+ },
194
+ "httpErrors": {
195
+ "type": "integer",
196
+ "minimum": 0
197
+ },
198
+ "bytes": {
199
+ "type": "integer",
200
+ "minimum": 0
201
+ },
202
+ "issueCount": {
203
+ "type": "integer",
204
+ "minimum": 0
205
+ },
206
+ "dropped": {
207
+ "type": "integer",
208
+ "minimum": 0
209
+ },
210
+ "issues": {
211
+ "type": "array",
212
+ "items": {
213
+ "$ref": "#/$defs/diagnostic"
214
+ }
215
+ }
216
+ },
217
+ "required": [
218
+ "requests",
219
+ "omittedRequests",
220
+ "responses",
221
+ "finished",
222
+ "failed",
223
+ "blocked",
224
+ "skippedRequests",
225
+ "failedRequests",
226
+ "securityBlockedRequests",
227
+ "httpErrors",
228
+ "bytes",
229
+ "issueCount",
230
+ "dropped",
231
+ "issues"
232
+ ]
233
+ },
234
+ "capture": {
235
+ "type": "object",
236
+ "properties": {
237
+ "complete": {
238
+ "type": "boolean"
239
+ },
240
+ "beforeConsentComplete": {
241
+ "type": "boolean"
242
+ },
243
+ "document": {
244
+ "type": "boolean"
245
+ },
246
+ "diagnostics": {
247
+ "$ref": "#/$defs/diagnostics"
248
+ }
249
+ },
250
+ "required": [
251
+ "complete",
252
+ "beforeConsentComplete",
253
+ "document",
254
+ "diagnostics"
255
+ ],
256
+ "allOf": [
257
+ {
258
+ "if": {
259
+ "properties": {
260
+ "complete": {
261
+ "const": true
262
+ }
263
+ },
264
+ "required": [
265
+ "complete"
266
+ ]
267
+ },
268
+ "then": {
269
+ "properties": {
270
+ "document": {
271
+ "const": true
272
+ },
273
+ "beforeConsentComplete": {
274
+ "const": true
275
+ },
276
+ "diagnostics": {
277
+ "type": "object",
278
+ "properties": {
279
+ "omittedRequests": {
280
+ "const": 0
281
+ },
282
+ "failed": {
283
+ "const": 0
284
+ },
285
+ "blocked": {
286
+ "const": 0
287
+ },
288
+ "skippedRequests": {
289
+ "const": 0
290
+ },
291
+ "failedRequests": {
292
+ "const": 0
293
+ },
294
+ "securityBlockedRequests": {
295
+ "const": 0
296
+ },
297
+ "httpErrors": {
298
+ "const": 0
299
+ },
300
+ "issueCount": {
301
+ "const": 0
302
+ },
303
+ "dropped": {
304
+ "const": 0
305
+ }
306
+ }
307
+ }
308
+ }
309
+ }
310
+ }
311
+ ]
312
+ },
313
+ "evaluation": {
314
+ "type": "object",
315
+ "properties": {
316
+ "pageId": {
317
+ "type": "string",
318
+ "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
319
+ },
320
+ "ruleId": {
321
+ "type": "string"
322
+ },
323
+ "status": {
324
+ "type": "string",
325
+ "enum": [
326
+ "executed",
327
+ "skipped",
328
+ "not-evaluable"
329
+ ]
330
+ },
331
+ "reason": {
332
+ "type": "string",
333
+ "enum": [
334
+ "disabled",
335
+ "consent-disabled",
336
+ "not-start-page",
337
+ "missing-observation"
338
+ ]
339
+ },
340
+ "partial": {
341
+ "type": "boolean"
342
+ },
343
+ "outcome": {
344
+ "type": "string",
345
+ "enum": [
346
+ "checked-no-finding",
347
+ "finding-detected",
348
+ "not-evaluable"
349
+ ]
350
+ },
351
+ "explanation": {
352
+ "type": "string",
353
+ "enum": [
354
+ "disabled",
355
+ "not-start-page",
356
+ "consent-disabled",
357
+ "missing-reject-observation",
358
+ "missing-consent-observation",
359
+ "incomplete-document",
360
+ "positive-evidence",
361
+ "incomplete-observation",
362
+ "required-observations-available",
363
+ "no-supported-banner",
364
+ "no-supported-reject-control",
365
+ "unsupported-banner-markup",
366
+ "browser-interaction-failed",
367
+ "reject-clicked-and-reloaded"
368
+ ]
369
+ },
370
+ "findingCount": {
371
+ "type": "integer",
372
+ "minimum": 0
373
+ }
374
+ },
375
+ "required": [
376
+ "pageId",
377
+ "ruleId",
378
+ "status",
379
+ "partial",
380
+ "outcome",
381
+ "explanation",
382
+ "findingCount"
383
+ ],
384
+ "allOf": [
385
+ {
386
+ "if": {
387
+ "properties": {
388
+ "outcome": {
389
+ "const": "checked-no-finding"
390
+ }
391
+ },
392
+ "required": [
393
+ "outcome"
394
+ ]
395
+ },
396
+ "then": {
397
+ "properties": {
398
+ "findingCount": {
399
+ "const": 0
400
+ },
401
+ "partial": {
402
+ "const": false
403
+ },
404
+ "status": {
405
+ "const": "executed"
406
+ }
407
+ }
408
+ }
409
+ },
410
+ {
411
+ "if": {
412
+ "properties": {
413
+ "outcome": {
414
+ "const": "finding-detected"
415
+ }
416
+ },
417
+ "required": [
418
+ "outcome"
419
+ ]
420
+ },
421
+ "then": {
422
+ "properties": {
423
+ "findingCount": {
424
+ "type": "integer",
425
+ "minimum": 1
426
+ },
427
+ "status": {
428
+ "const": "executed"
429
+ }
430
+ }
431
+ }
432
+ }
433
+ ]
434
+ },
435
+ "page": {
436
+ "type": "object",
437
+ "properties": {
438
+ "pageId": {
439
+ "type": "string",
440
+ "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
441
+ },
442
+ "url": {
443
+ "type": "string"
444
+ },
445
+ "finalUrl": {
446
+ "type": "string"
447
+ },
448
+ "status": {
449
+ "anyOf": [
450
+ {
451
+ "type": "integer",
452
+ "minimum": 100,
453
+ "maximum": 599
454
+ },
455
+ {
456
+ "type": "null"
457
+ }
458
+ ]
459
+ },
460
+ "requestCount": {
461
+ "type": "integer",
462
+ "minimum": 0
463
+ },
464
+ "cookieCount": {
465
+ "type": "integer",
466
+ "minimum": 0
467
+ },
468
+ "error": {
469
+ "type": "string"
470
+ },
471
+ "capture": {
472
+ "$ref": "#/$defs/capture"
473
+ },
474
+ "ruleEvaluations": {
475
+ "type": "array",
476
+ "items": {
477
+ "$ref": "#/$defs/evaluation"
478
+ }
479
+ }
480
+ },
481
+ "required": [
482
+ "pageId",
483
+ "url",
484
+ "finalUrl",
485
+ "status",
486
+ "requestCount",
487
+ "cookieCount",
488
+ "capture",
489
+ "ruleEvaluations"
490
+ ]
491
+ },
492
+ "finding": {
493
+ "type": "object",
494
+ "properties": {
495
+ "pageId": {
496
+ "type": "string",
497
+ "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
498
+ },
499
+ "ruleId": {
500
+ "type": "string"
501
+ },
502
+ "severity": {
503
+ "type": "string",
504
+ "enum": [
505
+ "error",
506
+ "warning",
507
+ "info"
508
+ ]
509
+ },
510
+ "message": {
511
+ "type": "string"
512
+ },
513
+ "pageUrl": {
514
+ "type": "string"
515
+ },
516
+ "evidence": {
517
+ "type": "array",
518
+ "items": {
519
+ "type": "string"
520
+ }
521
+ },
522
+ "fix": {
523
+ "type": "string"
524
+ },
525
+ "subject": {
526
+ "type": "string"
527
+ },
528
+ "references": {
529
+ "type": "array",
530
+ "items": {
531
+ "type": "string"
532
+ }
533
+ },
534
+ "policy": {
535
+ "type": "object",
536
+ "properties": {
537
+ "allowed": {
538
+ "type": "boolean"
539
+ },
540
+ "originalSeverity": {
541
+ "type": "string",
542
+ "enum": [
543
+ "error",
544
+ "warning",
545
+ "info"
546
+ ]
547
+ }
548
+ },
549
+ "required": [
550
+ "allowed",
551
+ "originalSeverity"
552
+ ]
553
+ }
554
+ },
555
+ "required": [
556
+ "pageId",
557
+ "ruleId",
558
+ "severity",
559
+ "message",
560
+ "pageUrl",
561
+ "evidence"
562
+ ]
563
+ },
564
+ "consent": {
565
+ "type": "object",
566
+ "properties": {
567
+ "bannerFound": {
568
+ "type": "boolean"
569
+ },
570
+ "rejected": {
571
+ "type": "boolean"
572
+ },
573
+ "state": {
574
+ "type": "string",
575
+ "enum": [
576
+ "not-detected",
577
+ "reject-unavailable",
578
+ "interaction-failed",
579
+ "reject-tested"
580
+ ]
581
+ },
582
+ "outcome": {
583
+ "type": "string",
584
+ "enum": [
585
+ "no-banner-detected",
586
+ "unsupported-banner",
587
+ "interaction-failed",
588
+ "reject-succeeded"
589
+ ]
590
+ },
591
+ "reason": {
592
+ "type": "string",
593
+ "enum": [
594
+ "no-supported-banner",
595
+ "no-supported-reject-control",
596
+ "unsupported-banner-markup",
597
+ "browser-interaction-failed",
598
+ "reject-clicked-and-reloaded"
599
+ ]
600
+ },
601
+ "cmp": {
602
+ "type": "string"
603
+ },
604
+ "acceptLabel": {
605
+ "type": "string"
606
+ },
607
+ "rejectLabel": {
608
+ "type": "string"
609
+ },
610
+ "payOrOk": {
611
+ "type": "boolean"
612
+ },
613
+ "afterRejectComplete": {
614
+ "type": "boolean"
615
+ },
616
+ "error": {
617
+ "type": "string"
618
+ }
619
+ },
620
+ "required": [
621
+ "bannerFound",
622
+ "rejected",
623
+ "state",
624
+ "outcome",
625
+ "reason"
626
+ ]
627
+ },
628
+ "rule": {
629
+ "type": "object",
630
+ "properties": {
631
+ "id": {
632
+ "type": "string"
633
+ },
634
+ "title": {
635
+ "type": "string"
636
+ },
637
+ "description": {
638
+ "type": "string"
639
+ },
640
+ "references": {
641
+ "type": "array",
642
+ "items": {
643
+ "type": "string"
644
+ }
645
+ },
646
+ "requires": {
647
+ "type": "array",
648
+ "items": {
649
+ "type": "string",
650
+ "enum": [
651
+ "document",
652
+ "network",
653
+ "consent",
654
+ "after-reject"
655
+ ]
656
+ }
657
+ }
658
+ },
659
+ "required": [
660
+ "id",
661
+ "title",
662
+ "description",
663
+ "references"
664
+ ]
665
+ },
666
+ "networkLimits": {
667
+ "type": "object",
668
+ "properties": {
669
+ "concurrency": {
670
+ "type": "integer",
671
+ "minimum": 1
672
+ },
673
+ "maxRequests": {
674
+ "type": "integer",
675
+ "minimum": 1
676
+ },
677
+ "maxResponseBytes": {
678
+ "type": "integer",
679
+ "minimum": 1
680
+ },
681
+ "maxTotalBytes": {
682
+ "type": "integer",
683
+ "minimum": 1
684
+ },
685
+ "maxRedirects": {
686
+ "type": "integer",
687
+ "minimum": 0
688
+ },
689
+ "requestTimeoutMs": {
690
+ "type": "integer",
691
+ "minimum": 1
692
+ }
693
+ },
694
+ "required": [
695
+ "concurrency",
696
+ "maxRequests",
697
+ "maxResponseBytes",
698
+ "maxTotalBytes",
699
+ "maxRedirects",
700
+ "requestTimeoutMs"
701
+ ]
702
+ },
703
+ "options": {
704
+ "type": "object",
705
+ "properties": {
706
+ "maxPages": {
707
+ "type": "integer",
708
+ "minimum": 1
709
+ },
710
+ "settleMs": {
711
+ "type": "integer",
712
+ "minimum": 0
713
+ },
714
+ "timeoutMs": {
715
+ "type": "integer",
716
+ "minimum": 1
717
+ },
718
+ "locale": {
719
+ "type": "string"
720
+ },
721
+ "lang": {
722
+ "type": "string",
723
+ "enum": [
724
+ "en",
725
+ "de"
726
+ ]
727
+ },
728
+ "region": {
729
+ "type": "string",
730
+ "enum": [
731
+ "de",
732
+ "at",
733
+ "ch",
734
+ "eu"
735
+ ]
736
+ },
737
+ "consentCheck": {
738
+ "type": "boolean"
739
+ },
740
+ "headed": {
741
+ "type": "boolean"
742
+ },
743
+ "channel": {
744
+ "type": "string"
745
+ },
746
+ "captureTimeoutMs": {
747
+ "anyOf": [
748
+ {
749
+ "type": "integer",
750
+ "minimum": 1
751
+ },
752
+ {
753
+ "type": "null"
754
+ }
755
+ ]
756
+ },
757
+ "maxDiagnostics": {
758
+ "type": "integer",
759
+ "minimum": 0
760
+ },
761
+ "failureMode": {
762
+ "type": "string",
763
+ "enum": [
764
+ "throw",
765
+ "report"
766
+ ]
767
+ },
768
+ "captureMode": {
769
+ "type": "string",
770
+ "enum": [
771
+ "native",
772
+ "adapter",
773
+ "offline-fixture"
774
+ ]
775
+ },
776
+ "networkLimits": {
777
+ "anyOf": [
778
+ {
779
+ "$ref": "#/$defs/networkLimits"
780
+ },
781
+ {
782
+ "type": "null"
783
+ }
784
+ ]
785
+ },
786
+ "selectedRules": {
787
+ "type": "array",
788
+ "items": {
789
+ "type": "string"
790
+ },
791
+ "uniqueItems": true
792
+ },
793
+ "ruleSettings": {
794
+ "type": "object",
795
+ "additionalProperties": {
796
+ "type": "string",
797
+ "enum": [
798
+ "error",
799
+ "warning",
800
+ "info",
801
+ "off"
802
+ ]
803
+ }
804
+ },
805
+ "allowedVendors": {
806
+ "type": "array",
807
+ "items": {
808
+ "type": "string"
809
+ }
810
+ }
811
+ },
812
+ "required": [
813
+ "maxPages",
814
+ "settleMs",
815
+ "timeoutMs",
816
+ "locale",
817
+ "lang",
818
+ "region",
819
+ "consentCheck",
820
+ "headed",
821
+ "channel",
822
+ "captureTimeoutMs",
823
+ "maxDiagnostics",
824
+ "failureMode",
825
+ "captureMode",
826
+ "networkLimits",
827
+ "selectedRules",
828
+ "ruleSettings",
829
+ "allowedVendors"
830
+ ]
831
+ }
832
+ }
833
+ }