qa360 2.1.7 → 2.2.0

package/dist/core/adapters/zap-dast.js

@@ -1,424 +0,0 @@
-/**
- * QA360 ZAP DAST Adapter (Sécurité Réelle)
- * OWASP ZAP baseline scan for dynamic application security testing
- */
-import { spawn } from 'child_process';
-import { existsSync, unlinkSync, readFileSync } from 'fs';
-import { join } from 'path';
-import { SecurityRedactor } from '../security/redactor.js';
-export class ZapDastAdapter {
-    redactor;
-    workingDir;
-    constructor(workingDir = process.cwd()) {
-        this.redactor = SecurityRedactor.forLogs();
-        this.workingDir = workingDir;
-    }
-    /**
-     * Execute ZAP DAST scan
-     */
-    async runDastScan(config) {
-        const startTime = Date.now();
-        try {
-            console.log(`🔍 Running ZAP ${config.scanType || 'baseline'} scan on ${config.targetUrl}`);
-            // Validate target URL
-            if (!this.isValidUrl(config.targetUrl)) {
-                return {
-                    success: false,
-                    alerts: [],
-                    summary: this.getEmptySummary(),
-                    budgetCheck: this.getDefaultBudgetCheck(),
-                    targetUrl: config.targetUrl,
-                    scanDuration: 0,
-                    error: 'Invalid target URL provided',
-                    errorCode: 'ZAP001'
-                };
-            }
-            // Execute ZAP scan
-            const result = await this.executeZapScan(config);
-            result.scanDuration = Date.now() - startTime;
-            return result;
-        }
-        catch (error) {
-            return {
-                success: false,
-                alerts: [],
-                summary: this.getEmptySummary(),
-                budgetCheck: this.getDefaultBudgetCheck(),
-                targetUrl: config.targetUrl,
-                scanDuration: Date.now() - startTime,
-                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error'),
-                errorCode: 'ZAP099'
-            };
-        }
-    }
-    /**
-     * Validate URL format
-     */
-    isValidUrl(url) {
-        try {
-            new URL(url);
-            return url.startsWith('http://') || url.startsWith('https://');
-        }
-        catch {
-            return false;
-        }
-    }
-    /**
-     * Execute ZAP scanner
-     */
-    async executeZapScan(config) {
-        return new Promise((resolve) => {
-            let output = '';
-            let error = '';
-            const reportPath = join(this.workingDir, `zap-report-${Date.now()}.json`);
-            const htmlReportPath = join(this.workingDir, `zap-report-${Date.now()}.html`);
-            // Try Docker first, then local installation
-            const useDocker = this.shouldUseDocker();
-            const args = this.buildZapArgs(config, reportPath, htmlReportPath, useDocker);
-            const command = useDocker ? 'docker' : 'zap-baseline.py';
-            console.log(`🐳 Using ${useDocker ? 'Docker' : 'local'} ZAP installation`);
-            const child = spawn(command, args, {
-                cwd: this.workingDir,
-                stdio: ['ignore', 'pipe', 'pipe']
-            });
-            const timeout = setTimeout(() => {
-                child.kill('SIGKILL');
-                resolve({
-                    success: false,
-                    alerts: [],
-                    summary: this.getEmptySummary(),
-                    budgetCheck: this.getDefaultBudgetCheck(),
-                    targetUrl: config.targetUrl,
-                    scanDuration: 0,
-                    error: `ZAP scan timed out after ${config.security?.dast?.timeout_ms || 300000}ms`,
-                    errorCode: 'ZAP002'
-                });
-            }, config.security?.dast?.timeout_ms || 300000); // 5 minutes default
-            if (child.stdout) {
-                child.stdout.on('data', (data) => {
-                    output += data.toString();
-                });
-            }
-            if (child.stderr) {
-                child.stderr.on('data', (data) => {
-                    error += data.toString();
-                });
-            }
-            child.on('close', (code) => {
-                clearTimeout(timeout);
-                // ZAP returns different codes: 0=no alerts, 1=low, 2=medium, 3=high
-                if (code !== null && code <= 3) {
-                    const result = this.parseZapResults(reportPath, config, output);
-                    resolve(result);
-                }
-                else {
-                    resolve({
-                        success: false,
-                        alerts: [],
-                        summary: this.getEmptySummary(),
-                        budgetCheck: this.getDefaultBudgetCheck(),
-                        targetUrl: config.targetUrl,
-                        scanDuration: 0,
-                        error: this.redactor.redact(error || `ZAP exited with code ${code}`),
-                        rawOutput: this.redactor.redact(output),
-                        errorCode: 'ZAP003'
-                    });
-                }
-            });
-            child.on('error', (err) => {
-                clearTimeout(timeout);
-                // Fallback to mock scan
-                resolve(this.fallbackMockScan(config));
-            });
-        });
-    }
-    /**
-     * Check if Docker should be used for ZAP
-     */
-    shouldUseDocker() {
-        // Check if Docker is available and ZAP image exists
-        try {
-            const { execSync } = require('child_process');
-            execSync('docker --version', { stdio: 'ignore' });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    }
-    /**
-     * Build ZAP command arguments
-     */
-    buildZapArgs(config, reportPath, htmlReportPath, useDocker) {
-        const args = [];
-        if (useDocker) {
-            args.push('run', '--rm', '-v', `${this.workingDir}:/zap/wrk/:rw`, 'owasp/zap2docker-stable', 'zap-baseline.py');
-        }
-        // Target URL
-        args.push('-t', config.targetUrl);
-        // Report formats
-        args.push('-J', reportPath.split('/').pop()); // JSON report
-        args.push('-r', htmlReportPath.split('/').pop()); // HTML report
-        // Scan configuration
-        if (config.scanType === 'full') {
-            args.push('-a'); // Full scan
-        }
-        // Exclude URLs
-        if (config.excludeUrls && config.excludeUrls.length > 0) {
-            for (const url of config.excludeUrls) {
-                args.push('-x', url);
-            }
-        }
-        // Include URLs
-        if (config.includeUrls && config.includeUrls.length > 0) {
-            for (const url of config.includeUrls) {
-                args.push('-i', url);
-            }
-        }
-        // Context file
-        if (config.contextFile && existsSync(config.contextFile)) {
-            args.push('-n', config.contextFile);
-        }
-        // Config file
-        if (config.configFile && existsSync(config.configFile)) {
-            args.push('-c', config.configFile);
-        }
-        // Additional options
-        args.push('-I'); // Ignore warnings
-        args.push('-d'); // Show debug messages
-        return args;
-    }
-    /**
-     * Parse ZAP scan results
-     */
-    parseZapResults(reportPath, config, output) {
-        try {
-            let alerts = [];
-            if (existsSync(reportPath)) {
-                const reportContent = readFileSync(reportPath, 'utf8');
-                const data = JSON.parse(reportContent);
-                if (data.site && data.site[0] && data.site[0].alerts) {
-                    alerts = data.site[0].alerts;
-                }
-                // Cleanup report file
-                try {
-                    unlinkSync(reportPath);
-                }
-                catch {
-                    // Ignore cleanup errors
-                }
-            }
-            // Redact sensitive information from alerts
-            const redactedAlerts = alerts.map(alert => ({
-                ...alert,
-                instances: alert.instances?.map(instance => ({
-                    ...instance,
-                    uri: this.redactor.redact(instance.uri || ''),
-                    attack: this.redactor.redact(instance.attack || ''),
-                    evidence: this.redactor.redact(instance.evidence || ''),
-                    otherinfo: this.redactor.redact(instance.otherinfo || '')
-                })) || []
-            }));
-            const summary = this.calculateSummary(redactedAlerts);
-            const budgetCheck = this.generateBudgetCheck(summary, config);
-            const success = budgetCheck.high_passed && budgetCheck.critical_passed;
-            const junit = this.generateJUnit(summary, success, config);
-            return {
-                success,
-                alerts: redactedAlerts,
-                summary,
-                budgetCheck,
-                targetUrl: config.targetUrl,
-                scanDuration: 0, // Will be set by caller
-                rawOutput: this.redactor.redact(output),
-                reportPath,
-                junit
-            };
-        }
-        catch (error) {
-            return {
-                success: false,
-                alerts: [],
-                summary: this.getEmptySummary(),
-                budgetCheck: this.getDefaultBudgetCheck(),
-                targetUrl: config.targetUrl,
-                scanDuration: 0,
-                error: `Failed to parse ZAP results: ${error}`,
-                rawOutput: this.redactor.redact(output),
-                errorCode: 'ZAP004'
-            };
-        }
-    }
-    /**
-     * Fallback mock scan when ZAP not available
-     */
-    fallbackMockScan(config) {
-        console.log('⚠️  ZAP not found, using mock scan (install OWASP ZAP for real scanning)');
-        return {
-            success: true,
-            alerts: [],
-            summary: this.getEmptySummary(),
-            budgetCheck: this.getDefaultBudgetCheck(),
-            targetUrl: config.targetUrl,
-            scanDuration: 1000,
-            error: 'ZAP not available - install from https://www.zaproxy.org/ or use Docker',
-            junit: this.generateJUnit(this.getEmptySummary(), true, config),
-            errorCode: 'ZAP005'
-        };
-    }
-    /**
-     * Calculate alerts summary
-     */
-    calculateSummary(alerts) {
-        const summary = {
-            total: alerts.length,
-            high: 0,
-            medium: 0,
-            low: 0,
-            informational: 0,
-            by_category: {}
-        };
-        for (const alert of alerts) {
-            const risk = alert.riskdesc?.toLowerCase() || '';
-            if (risk.includes('high')) {
-                summary.high++;
-            }
-            else if (risk.includes('medium')) {
-                summary.medium++;
-            }
-            else if (risk.includes('low')) {
-                summary.low++;
-            }
-            else {
-                summary.informational++;
-            }
-            // Count by category/plugin
-            const category = alert.alert || 'Unknown';
-            summary.by_category[category] = (summary.by_category[category] || 0) + 1;
-        }
-        return summary;
-    }
-    /**
-     * Generate budget check based on security config
-     */
-    generateBudgetCheck(summary, config) {
-        const dast = config.security?.dast;
-        return {
-            critical_passed: !dast?.max_critical || 0 <= (dast.max_critical || 0), // No critical in ZAP baseline
-            high_passed: !dast?.max_high || summary.high <= dast.max_high,
-            medium_passed: !dast?.max_medium || summary.medium <= dast.max_medium
-        };
-    }
-    /**
-     * Get empty summary structure
-     */
-    getEmptySummary() {
-        return {
-            total: 0,
-            high: 0,
-            medium: 0,
-            low: 0,
-            informational: 0,
-            by_category: {}
-        };
-    }
-    /**
-     * Get default budget check structure
-     */
-    getDefaultBudgetCheck() {
-        return {
-            critical_passed: true,
-            high_passed: true,
-            medium_passed: true
-        };
-    }
-    /**
-     * Generate JUnit XML report
-     */
-    generateJUnit(summary, success, config) {
-        const timestamp = new Date().toISOString();
-        const duration = '30.0'; // Typical ZAP scan duration
-        let junit = `<?xml version="1.0" encoding="UTF-8"?>
-<testsuite name="ZAP DAST Scan" tests="1" failures="${success ? 0 : 1}" time="${duration}" timestamp="${timestamp}">
-  <testcase name="DAST Security Scan: ${config.targetUrl}" time="${duration}">
-`;
-        if (!success) {
-            junit += `    <failure message="Security vulnerabilities found">
-High: ${summary.high}
-Medium: ${summary.medium}
-Low: ${summary.low}
-Informational: ${summary.informational}
-Total: ${summary.total}
-    </failure>
-`;
-        }
-        junit += `  </testcase>
-</testsuite>`;
-        return junit;
-    }
-    /**
-     * Validate ZAP scan configuration
-     */
-    static validateConfig(config) {
-        const errors = [];
-        if (!config.targetUrl) {
-            errors.push('Target URL is required');
-        }
-        try {
-            new URL(config.targetUrl);
-        }
-        catch {
-            errors.push('Invalid target URL format');
-        }
-        if (config.contextFile && !existsSync(config.contextFile)) {
-            errors.push(`Context file does not exist: ${config.contextFile}`);
-        }
-        if (config.configFile && !existsSync(config.configFile)) {
-            errors.push(`Config file does not exist: ${config.configFile}`);
-        }
-        return {
-            valid: errors.length === 0,
-            errors
-        };
-    }
-    /**
-     * Check if ZAP is available (Docker or local)
-     */
-    static async isAvailable() {
-        // Check Docker first
-        try {
-            const { execSync } = require('child_process');
-            execSync('docker run --rm owasp/zap2docker-stable zap-baseline.py --version', {
-                stdio: 'ignore',
-                timeout: 10000
-            });
-            return { available: true, method: 'docker' };
-        }
-        catch {
-            // Check local installation
-            return new Promise((resolve) => {
-                const child = spawn('zap-baseline.py', ['--version'], { stdio: 'pipe' });
-                child.on('close', (code) => {
-                    resolve({
-                        available: code === 0,
-                        method: 'local',
-                        error: code !== 0 ? 'ZAP not found. Install from https://www.zaproxy.org/ or use Docker' : undefined
-                    });
-                });
-                child.on('error', () => {
-                    resolve({
-                        available: false,
-                        error: 'ZAP not found. Install from https://www.zaproxy.org/ or use Docker'
-                    });
-                });
-                setTimeout(() => {
-                    child.kill();
-                    resolve({
-                        available: false,
-                        error: 'ZAP availability check timed out'
-                    });
-                }, 5000);
-            });
-        }
-    }
-}

package/dist/core/ai/anthropic-provider.d.ts

@@ -1,50 +0,0 @@
-/**
- * Anthropic LLM Provider
- *
- * Provider for Anthropic API (https://api.anthropic.com).
- * Supports Claude 3.5 Sonnet, Claude 3 Opus, and Claude 3 Haiku.
- *
- * Environment variables:
- * - ANTHROPIC_API_KEY: Required API key
- * - ANTHROPIC_BASE_URL: Optional base URL (default: https://api.anthropic.com)
- * - ANTHROPIC_MODEL: Model to use (default: claude-3-5-sonnet-20241022)
- */
-import type { LLMProvider, GenerationRequest, GenerationResponse } from './index.js';
-export interface AnthropicConfig {
-    apiKey?: string;
-    baseURL?: string;
-    model?: string;
-    timeout?: number;
-}
-export declare class AnthropicProvider implements LLMProvider {
-    name: string;
-    models: string[];
-    private readonly apiKey;
-    private readonly baseURL;
-    private readonly defaultModel;
-    private readonly timeout;
-    private readonly version;
-    constructor(config?: AnthropicConfig);
-    isAvailable(): Promise<boolean>;
-    generate(request: GenerationRequest): Promise<GenerationResponse>;
-    stream(request: GenerationRequest): AsyncIterable<string>;
-    countTokens(text: string): number;
-    private buildMessages;
-    private extractContent;
-}
-/**
- * Anthropic-specific error
- */
-export declare class AnthropicError extends Error {
-    code: string;
-    details?: Record<string, unknown>;
-    constructor(message: string, details?: Record<string, unknown>);
-}
-/**
- * Create Anthropic provider with default settings
- */
-export declare function createAnthropicProvider(config?: AnthropicConfig): AnthropicProvider;
-/**
- * Check if Anthropic is available and configured
- */
-export declare function checkAnthropicSetup(): Promise<boolean>;

package/dist/core/ai/anthropic-provider.js

@@ -1,223 +0,0 @@
-/**
- * Anthropic LLM Provider
- *
- * Provider for Anthropic API (https://api.anthropic.com).
- * Supports Claude 3.5 Sonnet, Claude 3 Opus, and Claude 3 Haiku.
- *
- * Environment variables:
- * - ANTHROPIC_API_KEY: Required API key
- * - ANTHROPIC_BASE_URL: Optional base URL (default: https://api.anthropic.com)
- * - ANTHROPIC_MODEL: Model to use (default: claude-3-5-sonnet-20241022)
- */
-export class AnthropicProvider {
-    name = 'anthropic';
-    // Recommended models for code generation
-    models = [
-        'claude-3-5-sonnet-20241022', // Most capable for code
-        'claude-3-5-sonnet-20240620', // Previous Sonnet version
-        'claude-3-opus-20240229', // Most capable overall
-        'claude-3-haiku-20240307', // Fastest, cheapest
-    ];
-    apiKey;
-    baseURL;
-    defaultModel;
-    timeout;
-    version = '2023-06-01'; // API version header
-    constructor(config = {}) {
-        this.apiKey = config.apiKey || process.env.ANTHROPIC_API_KEY || '';
-        this.baseURL = config.baseURL || process.env.ANTHROPIC_BASE_URL || 'https://api.anthropic.com';
-        this.defaultModel = config.model || process.env.ANTHROPIC_MODEL || 'claude-3-5-sonnet-20241022';
-        this.timeout = config.timeout || 60000; // 1 minute default
-    }
-    async isAvailable() {
-        // Check if API key is present
-        if (!this.apiKey) {
-            return false;
-        }
-        // Try a minimal API call
-        try {
-            // Use timeout with AbortController for compatibility
-            const controller = new AbortController();
-            const timeoutId = setTimeout(() => controller.abort(), 5000);
-            const response = await fetch(`${this.baseURL}/v1/messages`, {
-                method: 'POST',
-                headers: {
-                    'x-api-key': this.apiKey,
-                    'anthropic-version': this.version,
-                    'content-type': 'application/json',
-                },
-                signal: controller.signal,
-                body: JSON.stringify({
-                    model: this.defaultModel,
-                    max_tokens: 1,
-                    messages: [{ role: 'user', content: 'Hi' }]
-                })
-            });
-            clearTimeout(timeoutId);
-            // Anthropic may return 400 for malformed request but still be available
-            // We consider it available if we get any response (not a network error)
-            return response.status !== 401 && response.status !== 403;
-        }
-        catch {
-            return false;
-        }
-    }
-    async generate(request) {
-        if (!this.apiKey) {
-            throw new AnthropicError('ANTHROPIC_API_KEY is required', {
-                suggestion: 'Set ANTHROPIC_API_KEY environment variable or pass apiKey in config'
-            });
-        }
-        const messages = this.buildMessages(request);
-        // Use timeout with AbortController for compatibility
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), this.timeout);
-        try {
-            const response = await fetch(`${this.baseURL}/v1/messages`, {
-                method: 'POST',
-                headers: {
-                    'x-api-key': this.apiKey,
-                    'anthropic-version': this.version,
-                    'content-type': 'application/json',
-                },
-                signal: controller.signal,
-                body: JSON.stringify({
-                    model: this.defaultModel,
-                    messages,
-                    system: request.systemPrompt,
-                    temperature: request.temperature ?? 0.7,
-                    max_tokens: request.maxTokens ?? 4096,
-                })
-            });
-            if (!response.ok) {
-                const error = await response.text().catch(() => 'Unknown error');
-                throw new AnthropicError(`Anthropic request failed: ${response.status} ${error}`, {
-                    status: response.status,
-                    response: error
-                });
-            }
-            const data = await response.json();
-            if (data.error) {
-                throw new AnthropicError(`Anthropic API error: ${data.error.message}`, {
-                    type: data.error.type
-                });
-            }
-            const content = this.extractContent(data.content);
-            return {
-                content,
-                usage: {
-                    promptTokens: data.usage?.input_tokens || 0,
-                    completionTokens: data.usage?.output_tokens || 0,
-                    totalTokens: (data.usage?.input_tokens || 0) + (data.usage?.output_tokens || 0),
-                },
-                model: data.model,
-                finishReason: data.stop_reason === 'end_turn' ? 'stop' : 'length'
-            };
-        }
-        finally {
-            clearTimeout(timeoutId);
-        }
-    }
-    async *stream(request) {
-        if (!this.apiKey) {
-            throw new AnthropicError('ANTHROPIC_API_KEY is required');
-        }
-        const messages = this.buildMessages(request);
-        const response = await fetch(`${this.baseURL}/v1/messages`, {
-            method: 'POST',
-            headers: {
-                'x-api-key': this.apiKey,
-                'anthropic-version': this.version,
-                'content-type': 'application/json',
-            },
-            body: JSON.stringify({
-                model: this.defaultModel,
-                messages,
-                system: request.systemPrompt,
-                temperature: request.temperature ?? 0.7,
-                max_tokens: request.maxTokens ?? 4096,
-                stream: true,
-            })
-        });
-        if (!response.ok) {
-            throw new AnthropicError(`Anthropic stream failed: ${response.status}`);
-        }
-        const reader = response.body?.getReader();
-        if (!reader) {
-            throw new AnthropicError('No response body');
-        }
-        const decoder = new TextDecoder();
-        let buffer = '';
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split('\n');
-            buffer = lines.pop() || '';
-            for (const line of lines) {
-                if (line.startsWith('data: ')) {
-                    const data = line.slice(6);
-                    if (data === '[DONE]') {
-                        return;
-                    }
-                    try {
-                        const parsed = JSON.parse(data);
-                        if (parsed.type === 'content_block_delta') {
-                            const content = parsed.delta?.text;
-                            if (content) {
-                                yield content;
-                            }
-                        }
-                    }
-                    catch {
-                        // Ignore invalid JSON
-                    }
-                }
-            }
-        }
-    }
-    countTokens(text) {
-        // Approximate token count (roughly 4 chars per token for English)
-        return Math.ceil(text.length / 4);
-    }
-    buildMessages(request) {
-        return [{ role: 'user', content: request.prompt }];
-    }
-    extractContent(content) {
-        // Anthropic returns content as an array of blocks
-        if (Array.isArray(content)) {
-            const textBlocks = content
-                .filter((block) => block?.type === 'text')
-                .map(block => block.text)
-                .join('');
-            return textBlocks;
-        }
-        return String(content ?? '');
-    }
-}
-/**
- * Anthropic-specific error
- */
-export class AnthropicError extends Error {
-    code = 'ANTHROPIC_ERROR';
-    details;
-    constructor(message, details) {
-        super(message);
-        this.name = 'AnthropicError';
-        this.details = details;
-    }
-}
-/**
- * Create Anthropic provider with default settings
- */
-export function createAnthropicProvider(config) {
-    return new AnthropicProvider(config);
-}
-/**
- * Check if Anthropic is available and configured
- */
-export async function checkAnthropicSetup() {
-    const provider = new AnthropicProvider();
-    return provider.isAvailable();
-}