pumuki 6.3.7

package/core/facts/detectors/text/utils.test.ts

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasIdentifierAt,
+  isIdentifierCharacter,
+  nextNonWhitespaceIndex,
+  prevNonWhitespaceIndex,
+  readIdentifierBackward,
+  scanCodeLikeSource,
+} from './utils';
+
+test('isIdentifierCharacter valida letras, numeros y underscore', () => {
+  assert.equal(isIdentifierCharacter('A'), true);
+  assert.equal(isIdentifierCharacter('7'), true);
+  assert.equal(isIdentifierCharacter('_'), true);
+  assert.equal(isIdentifierCharacter('-'), false);
+  assert.equal(isIdentifierCharacter(' '), false);
+});
+
+test('prevNonWhitespaceIndex y nextNonWhitespaceIndex ubican indices no vacios', () => {
+  const source = ' \n\tabc  ';
+  assert.equal(prevNonWhitespaceIndex(source, source.length - 1), 4);
+  assert.equal(prevNonWhitespaceIndex('   ', 2), -1);
+  assert.equal(nextNonWhitespaceIndex(source, 0), 3);
+  assert.equal(nextNonWhitespaceIndex('   ', 0), -1);
+});
+
+test('readIdentifierBackward extrae identificador completo cuando aplica', () => {
+  const source = 'const token_value = 1;';
+  const endIndex = source.indexOf('token_value') + 'token_value'.length - 1;
+  assert.deepEqual(readIdentifierBackward(source, endIndex), {
+    value: 'token_value',
+    start: source.indexOf('token_value'),
+  });
+  assert.deepEqual(readIdentifierBackward(source, source.indexOf(' ')), {
+    value: '',
+    start: -1,
+  });
+});
+
+test('hasIdentifierAt respeta limites para evitar coincidencias parciales', () => {
+  const source = 'jwt decode jwtDecode jwt.decode';
+  assert.equal(hasIdentifierAt(source, source.indexOf('jwt'), 'jwt'), true);
+  assert.equal(hasIdentifierAt(source, source.indexOf('jwtDecode'), 'jwt'), false);
+  assert.equal(hasIdentifierAt(source, source.lastIndexOf('jwt'), 'jwt'), true);
+});
+
+test('scanCodeLikeSource ignora comentarios y strings', () => {
+  const source = `
+// jwt.decode in comment
+const a = "jwt.decode in string";
+/* jwt.decode in block comment */
+const token = jwt.decode(payload);
+`;
+  const matched = scanCodeLikeSource(source, ({ source: candidate, index }) => {
+    return hasIdentifierAt(candidate, index, 'jwt');
+  });
+  assert.equal(matched, true);
+});
+
+test('scanCodeLikeSource retorna false cuando solo hay coincidencias en comentarios o strings', () => {
+  const source = `
+// jwt.verify
+const a = "jwt.verify";
+/* jwt.verify */
+`;
+  const matched = scanCodeLikeSource(source, ({ source: candidate, index }) => {
+    return hasIdentifierAt(candidate, index, 'jwt');
+  });
+  assert.equal(matched, false);
+});

package/core/facts/detectors/text/utils.ts

@@ -0,0 +1,146 @@
+export const isIdentifierCharacter = (value: string): boolean => {
+  return /^[A-Za-z0-9_]$/.test(value);
+};
+
+export const prevNonWhitespaceIndex = (source: string, start: number): number => {
+  for (let index = start; index >= 0; index -= 1) {
+    if (!/\s/.test(source[index])) {
+      return index;
+    }
+  }
+  return -1;
+};
+
+export const nextNonWhitespaceIndex = (source: string, start: number): number => {
+  for (let index = start; index < source.length; index += 1) {
+    if (!/\s/.test(source[index])) {
+      return index;
+    }
+  }
+  return -1;
+};
+
+export const readIdentifierBackward = (
+  source: string,
+  endIndex: number
+): { value: string; start: number } => {
+  if (!isIdentifierCharacter(source[endIndex])) {
+    return { value: '', start: -1 };
+  }
+
+  let start = endIndex;
+  while (start > 0 && isIdentifierCharacter(source[start - 1])) {
+    start -= 1;
+  }
+
+  return {
+    value: source.slice(start, endIndex + 1),
+    start,
+  };
+};
+
+export const hasIdentifierAt = (source: string, index: number, identifier: string): boolean => {
+  if (!source.startsWith(identifier, index)) {
+    return false;
+  }
+
+  const before = source[index - 1];
+  const after = source[index + identifier.length];
+  const validBefore = typeof before === 'undefined' || !isIdentifierCharacter(before);
+  const validAfter = typeof after === 'undefined' || !isIdentifierCharacter(after);
+  return validBefore && validAfter;
+};
+
+export const scanCodeLikeSource = (
+  source: string,
+  matcher: (params: { source: string; index: number; current: string }) => boolean
+): boolean => {
+  let index = 0;
+  let inLineComment = false;
+  let blockCommentDepth = 0;
+  let inString = false;
+  let inMultilineString = false;
+
+  while (index < source.length) {
+    const current = source[index];
+    const next = source[index + 1];
+    const nextTwo = source[index + 2];
+
+    if (inLineComment) {
+      if (current === '\n') {
+        inLineComment = false;
+      }
+      index += 1;
+      continue;
+    }
+
+    if (blockCommentDepth > 0) {
+      if (current === '/' && next === '*') {
+        blockCommentDepth += 1;
+        index += 2;
+        continue;
+      }
+      if (current === '*' && next === '/') {
+        blockCommentDepth -= 1;
+        index += 2;
+        continue;
+      }
+      index += 1;
+      continue;
+    }
+
+    if (inMultilineString) {
+      if (current === '"' && next === '"' && nextTwo === '"') {
+        inMultilineString = false;
+        index += 3;
+        continue;
+      }
+      index += 1;
+      continue;
+    }
+
+    if (inString) {
+      if (current === '\\') {
+        index += 2;
+        continue;
+      }
+      if (current === '"') {
+        inString = false;
+      }
+      index += 1;
+      continue;
+    }
+
+    if (current === '/' && next === '/') {
+      inLineComment = true;
+      index += 2;
+      continue;
+    }
+
+    if (current === '/' && next === '*') {
+      blockCommentDepth = 1;
+      index += 2;
+      continue;
+    }
+
+    if (current === '"' && next === '"' && nextTwo === '"') {
+      inMultilineString = true;
+      index += 3;
+      continue;
+    }
+
+    if (current === '"') {
+      inString = true;
+      index += 1;
+      continue;
+    }
+
+    if (matcher({ source, index, current })) {
+      return true;
+    }
+
+    index += 1;
+  }
+
+  return false;
+};

package/core/facts/detectors/typescript/index.test.ts

@@ -0,0 +1,231 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  hasAsyncPromiseExecutor,
+  hasConsoleErrorCall,
+  hasConsoleLogCall,
+  hasDebuggerStatement,
+  hasDeleteOperator,
+  hasEmptyCatchClause,
+  hasEvalCall,
+  hasExplicitAnyType,
+  hasFunctionConstructorUsage,
+  hasSetIntervalStringCallback,
+  hasSetTimeoutStringCallback,
+  hasWithStatement,
+} from './index';
+
+test('hasEmptyCatchClause detecta catch vacio y descarta catch con cuerpo', () => {
+  const emptyCatchAst = {
+    type: 'CatchClause',
+    body: { type: 'BlockStatement', body: [] },
+  };
+  const nonEmptyCatchAst = {
+    type: 'CatchClause',
+    body: {
+      type: 'BlockStatement',
+      body: [{ type: 'ExpressionStatement' }],
+    },
+  };
+
+  assert.equal(hasEmptyCatchClause(emptyCatchAst), true);
+  assert.equal(hasEmptyCatchClause(nonEmptyCatchAst), false);
+});
+
+test('hasExplicitAnyType detecta TSAnyKeyword', () => {
+  const anyAst = {
+    type: 'TSTypeAnnotation',
+    typeAnnotation: { type: 'TSAnyKeyword' },
+  };
+  const unknownAst = {
+    type: 'TSTypeAnnotation',
+    typeAnnotation: { type: 'TSUnknownKeyword' },
+  };
+
+  assert.equal(hasExplicitAnyType(anyAst), true);
+  assert.equal(hasExplicitAnyType(unknownAst), false);
+});
+
+test('hasConsoleLogCall detecta console.log y descarta variantes no soportadas', () => {
+  const logAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'console' },
+      property: { type: 'Identifier', name: 'log' },
+    },
+    arguments: [{ type: 'StringLiteral', value: 'x' }],
+  };
+  const computedAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: true,
+      object: { type: 'Identifier', name: 'console' },
+      property: { type: 'StringLiteral', value: 'log' },
+    },
+    arguments: [],
+  };
+
+  assert.equal(hasConsoleLogCall(logAst), true);
+  assert.equal(hasConsoleLogCall(computedAst), false);
+});
+
+test('hasConsoleErrorCall detecta console.error y descarta metodos distintos', () => {
+  const errorAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'console' },
+      property: { type: 'Identifier', name: 'error' },
+    },
+    arguments: [{ type: 'Identifier', name: 'err' }],
+  };
+  const warnAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'console' },
+      property: { type: 'Identifier', name: 'warn' },
+    },
+    arguments: [{ type: 'Identifier', name: 'err' }],
+  };
+
+  assert.equal(hasConsoleErrorCall(errorAst), true);
+  assert.equal(hasConsoleErrorCall(warnAst), false);
+});
+
+test('hasEvalCall detecta eval directo y descarta member eval', () => {
+  const directEvalAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'eval' },
+    arguments: [{ type: 'StringLiteral', value: 'alert(1)' }],
+  };
+  const memberEvalAst = {
+    type: 'CallExpression',
+    callee: {
+      type: 'MemberExpression',
+      computed: false,
+      object: { type: 'Identifier', name: 'window' },
+      property: { type: 'Identifier', name: 'eval' },
+    },
+    arguments: [{ type: 'StringLiteral', value: 'alert(1)' }],
+  };
+
+  assert.equal(hasEvalCall(directEvalAst), true);
+  assert.equal(hasEvalCall(memberEvalAst), false);
+});
+
+test('hasFunctionConstructorUsage detecta new Function y descarta otros constructores', () => {
+  const functionCtorAst = {
+    type: 'NewExpression',
+    callee: { type: 'Identifier', name: 'Function' },
+    arguments: [{ type: 'StringLiteral', value: 'return 1;' }],
+  };
+  const otherCtorAst = {
+    type: 'NewExpression',
+    callee: { type: 'Identifier', name: 'Fn' },
+    arguments: [],
+  };
+
+  assert.equal(hasFunctionConstructorUsage(functionCtorAst), true);
+  assert.equal(hasFunctionConstructorUsage(otherCtorAst), false);
+});
+
+test('hasSetTimeoutStringCallback detecta callback string y template literal plano', () => {
+  const stringAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'setTimeout' },
+    arguments: [{ type: 'StringLiteral', value: 'work()' }, { type: 'NumericLiteral', value: 10 }],
+  };
+  const plainTemplateAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'setTimeout' },
+    arguments: [
+      {
+        type: 'TemplateLiteral',
+        expressions: [],
+        quasis: [{ type: 'TemplateElement', value: { cooked: 'work()' } }],
+      },
+    ],
+  };
+  const fnAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'setTimeout' },
+    arguments: [{ type: 'ArrowFunctionExpression', async: false }],
+  };
+
+  assert.equal(hasSetTimeoutStringCallback(stringAst), true);
+  assert.equal(hasSetTimeoutStringCallback(plainTemplateAst), true);
+  assert.equal(hasSetTimeoutStringCallback(fnAst), false);
+});
+
+test('hasSetIntervalStringCallback detecta callback string y descarta callback funcion', () => {
+  const stringAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'setInterval' },
+    arguments: [{ type: 'StringLiteral', value: 'tick()' }, { type: 'NumericLiteral', value: 100 }],
+  };
+  const fnAst = {
+    type: 'CallExpression',
+    callee: { type: 'Identifier', name: 'setInterval' },
+    arguments: [{ type: 'FunctionExpression', async: false }],
+  };
+
+  assert.equal(hasSetIntervalStringCallback(stringAst), true);
+  assert.equal(hasSetIntervalStringCallback(fnAst), false);
+});
+
+test('hasAsyncPromiseExecutor detecta ejecutor async en new Promise', () => {
+  const asyncExecutorAst = {
+    type: 'NewExpression',
+    callee: { type: 'Identifier', name: 'Promise' },
+    arguments: [{ type: 'ArrowFunctionExpression', async: true }],
+  };
+  const syncExecutorAst = {
+    type: 'NewExpression',
+    callee: { type: 'Identifier', name: 'Promise' },
+    arguments: [{ type: 'ArrowFunctionExpression', async: false }],
+  };
+
+  assert.equal(hasAsyncPromiseExecutor(asyncExecutorAst), true);
+  assert.equal(hasAsyncPromiseExecutor(syncExecutorAst), false);
+});
+
+test('hasWithStatement detecta with y hasDeleteOperator detecta operador delete', () => {
+  const withAst = {
+    type: 'Program',
+    body: [{ type: 'WithStatement' }],
+  };
+  const deleteAst = {
+    type: 'UnaryExpression',
+    operator: 'delete',
+    argument: { type: 'Identifier', name: 'obj' },
+  };
+  const typeofAst = {
+    type: 'UnaryExpression',
+    operator: 'typeof',
+    argument: { type: 'Identifier', name: 'obj' },
+  };
+
+  assert.equal(hasWithStatement(withAst), true);
+  assert.equal(hasDeleteOperator(deleteAst), true);
+  assert.equal(hasDeleteOperator(typeofAst), false);
+});
+
+test('hasDebuggerStatement detecta nodos debugger', () => {
+  const debuggerAst = {
+    type: 'Program',
+    body: [{ type: 'DebuggerStatement' }],
+  };
+  const noDebuggerAst = {
+    type: 'Program',
+    body: [{ type: 'ExpressionStatement' }],
+  };
+
+  assert.equal(hasDebuggerStatement(debuggerAst), true);
+  assert.equal(hasDebuggerStatement(noDebuggerAst), false);
+});

package/core/facts/detectors/typescript/index.ts

@@ -0,0 +1,167 @@
+import { hasNode, isObject } from '../utils/astHelpers';
+
+export const hasEmptyCatchClause = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CatchClause') {
+      return false;
+    }
+    const body = value.body;
+    return isObject(body) && Array.isArray(body.body) && body.body.length === 0;
+  });
+};
+
+export const hasExplicitAnyType = (node: unknown): boolean => {
+  return hasNode(node, (value) => value.type === 'TSAnyKeyword');
+};
+
+export const hasConsoleLogCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'console' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'log'
+    );
+  });
+};
+
+export const hasConsoleErrorCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'MemberExpression' || callee.computed === true) {
+      return false;
+    }
+
+    const objectNode = callee.object;
+    const propertyNode = callee.property;
+    return (
+      isObject(objectNode) &&
+      objectNode.type === 'Identifier' &&
+      objectNode.name === 'console' &&
+      isObject(propertyNode) &&
+      propertyNode.type === 'Identifier' &&
+      propertyNode.name === 'error'
+    );
+  });
+};
+
+export const hasEvalCall = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    return isObject(callee) && callee.type === 'Identifier' && callee.name === 'eval';
+  });
+};
+
+export const hasFunctionConstructorUsage = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'NewExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    return isObject(callee) && callee.type === 'Identifier' && callee.name === 'Function';
+  });
+};
+
+export const hasSetTimeoutStringCallback = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'Identifier' || callee.name !== 'setTimeout') {
+      return false;
+    }
+    const args = value.arguments;
+    if (!Array.isArray(args) || args.length === 0) {
+      return false;
+    }
+    const firstArg = args[0];
+    return (
+      (isObject(firstArg) && firstArg.type === 'StringLiteral') ||
+      (isObject(firstArg) &&
+        firstArg.type === 'TemplateLiteral' &&
+        Array.isArray(firstArg.expressions) &&
+        firstArg.expressions.length === 0)
+    );
+  });
+};
+
+export const hasSetIntervalStringCallback = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'CallExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'Identifier' || callee.name !== 'setInterval') {
+      return false;
+    }
+    const args = value.arguments;
+    if (!Array.isArray(args) || args.length === 0) {
+      return false;
+    }
+    const firstArg = args[0];
+    return (
+      (isObject(firstArg) && firstArg.type === 'StringLiteral') ||
+      (isObject(firstArg) &&
+        firstArg.type === 'TemplateLiteral' &&
+        Array.isArray(firstArg.expressions) &&
+        firstArg.expressions.length === 0)
+    );
+  });
+};
+
+export const hasAsyncPromiseExecutor = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    if (value.type !== 'NewExpression') {
+      return false;
+    }
+    const callee = value.callee;
+    if (!isObject(callee) || callee.type !== 'Identifier' || callee.name !== 'Promise') {
+      return false;
+    }
+    const args = value.arguments;
+    if (!Array.isArray(args) || args.length === 0) {
+      return false;
+    }
+    const firstArg = args[0];
+    return (
+      isObject(firstArg) &&
+      (firstArg.type === 'ArrowFunctionExpression' || firstArg.type === 'FunctionExpression') &&
+      firstArg.async === true
+    );
+  });
+};
+
+export const hasWithStatement = (node: unknown): boolean => {
+  return hasNode(node, (value) => value.type === 'WithStatement');
+};
+
+export const hasDeleteOperator = (node: unknown): boolean => {
+  return hasNode(node, (value) => {
+    return value.type === 'UnaryExpression' && value.operator === 'delete';
+  });
+};
+
+export const hasDebuggerStatement = (node: unknown): boolean => {
+  return hasNode(node, (value) => value.type === 'DebuggerStatement');
+};

package/core/facts/detectors/utils/astHelpers.test.ts

@@ -0,0 +1,79 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { hasNode, isObject } from './astHelpers';
+
+test('isObject devuelve true para objetos y arrays, false para null y primitivos', () => {
+  assert.equal(isObject({ key: 'value' }), true);
+  assert.equal(isObject([]), true);
+  assert.equal(isObject(null), false);
+  assert.equal(isObject('value'), false);
+  assert.equal(isObject(10), false);
+});
+
+test('hasNode devuelve false cuando la raiz no es un objeto', () => {
+  assert.equal(hasNode(null, () => true), false);
+  assert.equal(hasNode('text', () => true), false);
+  assert.equal(hasNode(42, () => true), false);
+});
+
+test('hasNode encuentra coincidencias en la raiz y en nodos anidados', () => {
+  const ast = {
+    type: 'Program',
+    body: [
+      {
+        type: 'ExpressionStatement',
+        expression: {
+          type: 'CallExpression',
+          callee: {
+            type: 'Identifier',
+            name: 'targetCall',
+          },
+          arguments: [],
+        },
+      },
+    ],
+  };
+
+  assert.equal(hasNode(ast, (value) => value.type === 'Program'), true);
+  assert.equal(
+    hasNode(
+      ast,
+      (value) => value.type === 'Identifier' && value.name === 'targetCall'
+    ),
+    true
+  );
+});
+
+test('hasNode recorre arrays y objetos anidados y descarta cuando no hay match', () => {
+  const ast = {
+    type: 'Root',
+    sections: [
+      {
+        type: 'Section',
+        nodes: [
+          { type: 'Literal', value: 'a' },
+          { type: 'Literal', value: 'b' },
+        ],
+      },
+      {
+        type: 'Section',
+        payload: {
+          type: 'NestedPayload',
+          child: {
+            type: 'Identifier',
+            name: 'needle',
+          },
+        },
+      },
+    ],
+  };
+
+  assert.equal(
+    hasNode(ast, (value) => value.type === 'Identifier' && value.name === 'needle'),
+    true
+  );
+  assert.equal(
+    hasNode(ast, (value) => value.type === 'Identifier' && value.name === 'missing'),
+    false
+  );
+});