qa360 2.1.7 → 2.2.0

package/dist/core/adapters/semgrep-sast.d.ts

@@ -1,99 +0,0 @@
-/**
- * QA360 Semgrep SAST Adapter (Socle OOTB)
- * Static Application Security Testing with configurable severity thresholds
- */
-import { PackSecurity } from '../types/pack-v1.js';
-export interface SemgrepTestConfig {
-    workingDir: string;
-    security?: PackSecurity;
-    rules?: string[];
-    paths?: string[];
-    timeout?: number;
-    configFile?: string;
-}
-export interface SemgrepFinding {
-    ruleId: string;
-    severity: 'INFO' | 'WARNING' | 'ERROR';
-    message: string;
-    file: string;
-    line: number;
-    column: number;
-    code?: string;
-    fix?: string;
-}
-export interface SemgrepTestResult {
-    success: boolean;
-    findings: SemgrepFinding[];
-    summary: {
-        total: number;
-        critical: number;
-        high: number;
-        medium: number;
-        low: number;
-        info: number;
-    };
-    thresholds: {
-        sast_max_high: {
-            passed: boolean;
-            actual: number;
-            budget: number;
-        };
-    };
-    error?: string;
-    rawOutput?: string;
-    junit?: string;
-}
-export declare class SemgrepSastAdapter {
-    private redactor;
-    constructor();
-    /**
-     * Execute Semgrep SAST scan
-     */
-    runSastScan(config: SemgrepTestConfig): Promise<SemgrepTestResult>;
-    /**
-     * Execute Semgrep command
-     */
-    private executeSemgrep;
-    /**
-     * Parse Semgrep JSON results
-     */
-    private parseSemgrepResults;
-    /**
-     * Map Semgrep severity to standard levels
-     */
-    private mapSeverity;
-    /**
-     * Calculate findings summary
-     */
-    private calculateSummary;
-    /**
-     * Check security thresholds
-     */
-    private checkThresholds;
-    /**
-     * Generate JUnit XML
-     */
-    private generateJUnit;
-    /**
-     * Get default summary structure
-     */
-    private getDefaultSummary;
-    /**
-     * Get default thresholds
-     */
-    private getDefaultThresholds;
-    /**
-     * Check if Semgrep is available
-     */
-    static isAvailable(): Promise<{
-        available: boolean;
-        error?: string;
-    }>;
-    /**
-     * Validate SAST configuration
-     */
-    static validateConfig(config: SemgrepTestConfig): {
-        valid: boolean;
-        errors: string[];
-    };
-}

package/dist/core/adapters/semgrep-sast.js

@@ -1,322 +0,0 @@
-/**
- * QA360 Semgrep SAST Adapter (Socle OOTB)
- * Static Application Security Testing with configurable severity thresholds
- */
-import { spawn } from 'child_process';
-import { existsSync } from 'fs';
-import { join } from 'path';
-import { SecurityRedactor } from '../security/redactor.js';
-export class SemgrepSastAdapter {
-    redactor;
-    constructor() {
-        this.redactor = SecurityRedactor.forLogs();
-    }
-    /**
-     * Execute Semgrep SAST scan
-     */
-    async runSastScan(config) {
-        try {
-            console.log(`🔍 Running Semgrep SAST scan (${config.paths?.join(', ') || 'default paths'})`);
-            // Check if Semgrep is available
-            const availability = await SemgrepSastAdapter.isAvailable();
-            if (!availability.available) {
-                return {
-                    success: false,
-                    findings: [],
-                    summary: this.getDefaultSummary(),
-                    thresholds: this.getDefaultThresholds(config.security),
-                    error: availability.error
-                };
-            }
-            // Execute Semgrep
-            const result = await this.executeSemgrep(config);
-            return result;
-        }
-        catch (error) {
-            return {
-                success: false,
-                findings: [],
-                summary: this.getDefaultSummary(),
-                thresholds: this.getDefaultThresholds(config.security),
-                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error')
-            };
-        }
-    }
-    /**
-     * Execute Semgrep command
-     */
-    async executeSemgrep(config) {
-        return new Promise((resolve) => {
-            let output = '';
-            let error = '';
-            const rules = config.rules || ['auto'];
-            const paths = config.paths || ['.'];
-            const args = [
-                '--config', rules.join(','),
-                '--json',
-                '--no-git-ignore', // Include all files
-                '--timeout', '60',
-                ...paths
-            ];
-            // Add custom config if specified
-            if (config.configFile && existsSync(join(config.workingDir, config.configFile))) {
-                args.unshift('--config', config.configFile);
-            }
-            const child = spawn('semgrep', args, {
-                cwd: config.workingDir,
-                stdio: ['ignore', 'pipe', 'pipe']
-            });
-            const timeout = setTimeout(() => {
-                child.kill('SIGKILL');
-                resolve({
-                    success: false,
-                    findings: [],
-                    summary: this.getDefaultSummary(),
-                    thresholds: this.getDefaultThresholds(config.security),
-                    error: `Semgrep scan timed out after ${config.timeout || 120000}ms`
-                });
-            }, config.timeout || 120000);
-            if (child.stdout) {
-                child.stdout.on('data', (data) => {
-                    output += data.toString();
-                });
-            }
-            if (child.stderr) {
-                child.stderr.on('data', (data) => {
-                    error += data.toString();
-                });
-            }
-            child.on('close', (code) => {
-                clearTimeout(timeout);
-                // Semgrep returns 0 for no findings, 1 for findings, 2+ for errors
-                if (code === 0 || code === 1) {
-                    const result = this.parseSemgrepResults(output, config);
-                    resolve(result);
-                }
-                else {
-                    resolve({
-                        success: false,
-                        findings: [],
-                        summary: this.getDefaultSummary(),
-                        thresholds: this.getDefaultThresholds(config.security),
-                        error: this.redactor.redact(error || `Semgrep exited with code ${code}`),
-                        rawOutput: this.redactor.redact(output)
-                    });
-                }
-            });
-            child.on('error', (err) => {
-                clearTimeout(timeout);
-                resolve({
-                    success: false,
-                    findings: [],
-                    summary: this.getDefaultSummary(),
-                    thresholds: this.getDefaultThresholds(config.security),
-                    error: `Failed to start Semgrep: ${err.message}`
-                });
-            });
-        });
-    }
-    /**
-     * Parse Semgrep JSON results
-     */
-    parseSemgrepResults(output, config) {
-        try {
-            const jsonData = JSON.parse(output);
-            const findings = [];
-            // Parse findings from results
-            if (jsonData.results && Array.isArray(jsonData.results)) {
-                for (const result of jsonData.results) {
-                    const finding = {
-                        ruleId: result.check_id || 'unknown',
-                        severity: this.mapSeverity(result.extra?.severity || 'INFO'),
-                        message: result.extra?.message || result.message || 'Security issue detected',
-                        file: result.path || 'unknown',
-                        line: result.start?.line || 0,
-                        column: result.start?.col || 0,
-                        code: result.extra?.lines ? result.extra.lines.trim() : undefined,
-                        fix: result.extra?.fix ? result.extra.fix.trim() : undefined
-                    };
-                    findings.push(finding);
-                }
-            }
-            // Calculate summary
-            const summary = this.calculateSummary(findings);
-            // Check thresholds
-            const thresholds = this.checkThresholds(summary, config.security);
-            // Determine success based on thresholds
-            const success = thresholds.sast_max_high.passed;
-            const junit = this.generateJUnit(findings, success);
-            return {
-                success,
-                findings: findings.map(f => ({
-                    ...f,
-                    message: this.redactor.redact(f.message),
-                    code: f.code ? this.redactor.redact(f.code) : undefined,
-                    fix: f.fix ? this.redactor.redact(f.fix) : undefined
-                })),
-                summary,
-                thresholds,
-                rawOutput: this.redactor.redact(output),
-                junit
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                findings: [],
-                summary: this.getDefaultSummary(),
-                thresholds: this.getDefaultThresholds(config.security),
-                error: `Failed to parse Semgrep results: ${error}`,
-                rawOutput: this.redactor.redact(output)
-            };
-        }
-    }
-    /**
-     * Map Semgrep severity to standard levels
-     */
-    mapSeverity(severity) {
-        const sev = severity.toUpperCase();
-        if (sev === 'ERROR' || sev === 'HIGH')
-            return 'ERROR';
-        if (sev === 'WARNING' || sev === 'MEDIUM')
-            return 'WARNING';
-        return 'INFO';
-    }
-    /**
-     * Calculate findings summary
-     */
-    calculateSummary(findings) {
-        const summary = {
-            total: findings.length,
-            critical: 0,
-            high: 0,
-            medium: 0,
-            low: 0,
-            info: 0
-        };
-        for (const finding of findings) {
-            switch (finding.severity) {
-                case 'ERROR':
-                    summary.high++;
-                    break;
-                case 'WARNING':
-                    summary.medium++;
-                    break;
-                case 'INFO':
-                    summary.info++;
-                    break;
-            }
-        }
-        return summary;
-    }
-    /**
-     * Check security thresholds
-     */
-    checkThresholds(summary, security) {
-        const maxHigh = security?.sast?.max_high ?? 0; // Default: strict (0 high findings)
-        return {
-            sast_max_high: {
-                passed: summary.high <= maxHigh,
-                actual: summary.high,
-                budget: maxHigh
-            }
-        };
-    }
-    /**
-     * Generate JUnit XML
-     */
-    generateJUnit(findings, success) {
-        const timestamp = new Date().toISOString();
-        const failures = findings.filter(f => f.severity === 'ERROR').length;
-        let junit = `<?xml version="1.0" encoding="UTF-8"?>
-<testsuite name="Semgrep SAST Scan" tests="1" failures="${success ? 0 : 1}" time="0" timestamp="${timestamp}">
-  <testcase name="SAST Security Scan" time="0">
-`;
-        if (!success) {
-            junit += `    <failure message="Security issues found">
-High severity findings: ${findings.filter(f => f.severity === 'ERROR').length}
-Medium severity findings: ${findings.filter(f => f.severity === 'WARNING').length}
-Total findings: ${findings.length}
-
-Top findings:
-${findings.slice(0, 5).map(f => `- ${f.ruleId}: ${f.message} (${f.file}:${f.line})`).join('\n')}
-    </failure>
-`;
-        }
-        junit += `  </testcase>
-</testsuite>`;
-        return junit;
-    }
-    /**
-     * Get default summary structure
-     */
-    getDefaultSummary() {
-        return {
-            total: 0,
-            critical: 0,
-            high: 0,
-            medium: 0,
-            low: 0,
-            info: 0
-        };
-    }
-    /**
-     * Get default thresholds
-     */
-    getDefaultThresholds(security) {
-        return {
-            sast_max_high: {
-                passed: true,
-                actual: 0,
-                budget: security?.sast?.max_high ?? 0
-            }
-        };
-    }
-    /**
-     * Check if Semgrep is available
-     */
-    static async isAvailable() {
-        return new Promise((resolve) => {
-            const child = spawn('semgrep', ['--version'], { stdio: 'pipe' });
-            child.on('close', (code) => {
-                resolve({
-                    available: code === 0,
-                    error: code !== 0 ? 'Semgrep not found. Install with: pip install semgrep' : undefined
-                });
-            });
-            child.on('error', () => {
-                resolve({
-                    available: false,
-                    error: 'Semgrep not found. Install with: pip install semgrep'
-                });
-            });
-        });
-    }
-    /**
-     * Validate SAST configuration
-     */
-    static validateConfig(config) {
-        const errors = [];
-        if (!config.workingDir || !existsSync(config.workingDir)) {
-            errors.push('SAST scan requires valid working directory');
-        }
-        if (config.paths) {
-            for (const path of config.paths) {
-                const fullPath = join(config.workingDir, path);
-                if (!existsSync(fullPath)) {
-                    errors.push(`SAST scan path not found: ${path}`);
-                }
-            }
-        }
-        if (config.configFile) {
-            const configPath = join(config.workingDir, config.configFile);
-            if (!existsSync(configPath)) {
-                errors.push(`Semgrep config file not found: ${config.configFile}`);
-            }
-        }
-        return {
-            valid: errors.length === 0,
-            errors
-        };
-    }
-}

package/dist/core/adapters/zap-dast.d.ts

@@ -1,133 +0,0 @@
-/**
- * QA360 ZAP DAST Adapter (Sécurité Réelle)
- * OWASP ZAP baseline scan for dynamic application security testing
- */
-import { PackSecurity } from '../types/pack-v1.js';
-export interface ZapDastConfig {
-    targetUrl: string;
-    security?: PackSecurity;
-    timeout?: number;
-    scanType?: 'baseline' | 'full' | 'api';
-    contextFile?: string;
-    excludeUrls?: string[];
-    includeUrls?: string[];
-    authScript?: string;
-    configFile?: string;
-}
-export interface ZapAlert {
-    pluginid: string;
-    alertRef: string;
-    alert: string;
-    name: string;
-    riskcode: string;
-    confidence: string;
-    riskdesc: string;
-    desc: string;
-    instances: Array<{
-        uri: string;
-        method: string;
-        param: string;
-        attack: string;
-        evidence: string;
-        otherinfo: string;
-    }>;
-    count: string;
-    solution: string;
-    otherinfo: string;
-    reference: string;
-    cweid: string;
-    wascid: string;
-    sourceid: string;
-}
-export interface ZapDastResult {
-    success: boolean;
-    alerts: ZapAlert[];
-    summary: {
-        total: number;
-        high: number;
-        medium: number;
-        low: number;
-        informational: number;
-        by_category: Record<string, number>;
-    };
-    budgetCheck: {
-        high_passed: boolean;
-        critical_passed: boolean;
-        medium_passed: boolean;
-    };
-    targetUrl: string;
-    scanDuration: number;
-    error?: string;
-    rawOutput?: string;
-    reportPath?: string;
-    junit?: string;
-    errorCode?: string;
-}
-export declare class ZapDastAdapter {
-    private redactor;
-    private workingDir;
-    constructor(workingDir?: string);
-    /**
-     * Execute ZAP DAST scan
-     */
-    runDastScan(config: ZapDastConfig): Promise<ZapDastResult>;
-    /**
-     * Validate URL format
-     */
-    private isValidUrl;
-    /**
-     * Execute ZAP scanner
-     */
-    private executeZapScan;
-    /**
-     * Check if Docker should be used for ZAP
-     */
-    private shouldUseDocker;
-    /**
-     * Build ZAP command arguments
-     */
-    private buildZapArgs;
-    /**
-     * Parse ZAP scan results
-     */
-    private parseZapResults;
-    /**
-     * Fallback mock scan when ZAP not available
-     */
-    private fallbackMockScan;
-    /**
-     * Calculate alerts summary
-     */
-    private calculateSummary;
-    /**
-     * Generate budget check based on security config
-     */
-    private generateBudgetCheck;
-    /**
-     * Get empty summary structure
-     */
-    private getEmptySummary;
-    /**
-     * Get default budget check structure
-     */
-    private getDefaultBudgetCheck;
-    /**
-     * Generate JUnit XML report
-     */
-    private generateJUnit;
-    /**
-     * Validate ZAP scan configuration
-     */
-    static validateConfig(config: ZapDastConfig): {
-        valid: boolean;
-        errors: string[];
-    };
-    /**
-     * Check if ZAP is available (Docker or local)
-     */
-    static isAvailable(): Promise<{
-        available: boolean;
-        method?: 'docker' | 'local';
-        error?: string;
-    }>;
-}