safeey-cli 0.2.0 → 0.2.1

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "safeey-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Scan your source code for security vulnerabilities — a Safeey product by Noohra Innovate Ltd.",
   "bin": {
-    "safeey": "./bin/safeey.js"
+    "safeey": "bin/safeey.js"
   },
   "files": [
     "bin",
@@ -29,7 +29,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/davolu/safeey-cli.git"
+    "url": "git+https://github.com/davolu/safeey-cli.git"
   },
   "homepage": "https://safeey.io",
   "bugs": {

package/src/engine/gitignore.js

@@ -0,0 +1,128 @@
+// src/engine/gitignore.js
+// Answers one question: "would git ignore this path?" We use it to decide
+// whether secrets in a .env file matter. A secret in a *properly ignored* .env
+// is that file doing its job. A secret in a .env that ISN'T ignored is a leak
+// waiting to be committed — that's the finding worth raising.
+//
+// Primary strategy: shell out to `git check-ignore`, which implements the full
+// gitignore spec (nesting, negation, anchoring, core.excludesFile) correctly so
+// we don't have to. Fallback: a focused matcher for trees that aren't git repos
+// (where "no .gitignore at all" correctly resolves to "not ignored" -> flag it).
+
+const { execFileSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage"]);
+
+function isGitRepo(root) {
+  try {
+    const out = execFileSync("git", ["-C", root, "rev-parse", "--is-inside-work-tree"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return out.trim() === "true";
+  } catch {
+    return false;
+  }
+}
+
+// Returns true (ignored), false (not ignored), or null (couldn't determine).
+function gitCheckIgnore(root, relPath) {
+  try {
+    execFileSync("git", ["-C", root, "check-ignore", "-q", "--", relPath], { stdio: "ignore" });
+    return true; // exit 0 => path is ignored
+  } catch (e) {
+    if (e && e.status === 1) return false; // exit 1 => not ignored
+    return null; // 128 / git missing => unknown
+  }
+}
+
+// ---- Non-git fallback ------------------------------------------------------
+
+// Convert a single gitignore pattern to { re, negate, dirOnly } relative to the
+// directory the .gitignore lives in. Intentionally a pragmatic subset of the
+// spec — enough to resolve the env-file cases the tool cares about.
+function patternToMatcher(raw) {
+  let pat = raw.replace(/\r$/, "");
+  if (!pat || pat.startsWith("#")) return null;
+  // Trim unescaped trailing whitespace.
+  pat = pat.replace(/((?:[^\\ ]|\\ )*?)\s+$/, "$1");
+  if (!pat) return null;
+
+  let negate = false;
+  if (pat.startsWith("!")) { negate = true; pat = pat.slice(1); }
+
+  let dirOnly = false;
+  if (pat.endsWith("/")) { dirOnly = true; pat = pat.slice(0, -1); }
+
+  const anchored = pat.startsWith("/") || pat.includes("/");
+  if (pat.startsWith("/")) pat = pat.slice(1);
+
+  // Escape regex metachars, then re-enable glob semantics.
+  let re = pat.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  re = re.replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*").replace(/\?/g, "[^/]");
+
+  const body = anchored ? `^${re}(?:/.*)?$` : `(?:^|/)${re}(?:/.*)?$`;
+  return { re: new RegExp(body), negate, dirOnly };
+}
+
+function readGitignores(root) {
+  const found = []; // { dir, matchers: [...] }
+  (function walk(dir) {
+    let entries = [];
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    const gi = path.join(dir, ".gitignore");
+    if (fs.existsSync(gi)) {
+      try {
+        const matchers = fs.readFileSync(gi, "utf8").split(/\n/).map(patternToMatcher).filter(Boolean);
+        found.push({ dir, matchers });
+      } catch { /* unreadable — skip */ }
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && !IGNORE_DIRS.has(e.name)) walk(path.join(dir, e.name));
+    }
+  })(root);
+  return found;
+}
+
+function buildFallbackMatcher(root) {
+  const gitignores = readGitignores(root);
+  return function isIgnored(absPath) {
+    let decision = false;
+    for (const { dir, matchers } of gitignores) {
+      const rel = path.relative(dir, absPath);
+      if (!rel || rel.startsWith("..")) continue; // file not under this .gitignore
+      for (const m of matchers) {
+        if (m.re.test(rel)) decision = !m.negate;
+      }
+    }
+    return decision;
+  };
+}
+
+// ---- Public API ------------------------------------------------------------
+
+function makeIgnoreChecker(root) {
+  const git = isGitRepo(root);
+  const fallback = git ? null : buildFallbackMatcher(root);
+  const cache = new Map();
+  return {
+    mode: git ? "git" : "fallback",
+    // true | false | null(unknown, git-mode only)
+    isIgnored(absPath) {
+      if (cache.has(absPath)) return cache.get(absPath);
+      let res;
+      if (git) {
+        const rel = path.relative(root, absPath) || path.basename(absPath);
+        res = gitCheckIgnore(root, rel);
+      } else {
+        res = fallback(absPath);
+      }
+      cache.set(absPath, res);
+      return res;
+    },
+  };
+}
+
+module.exports = { makeIgnoreChecker };

package/src/scan.js

@@ -5,6 +5,44 @@ const { analyzeJs } = require("./engine/js");
 const { analyzeSecrets } = require("./engine/secrets");
 const { analyzeDeps } = require("./engine/deps");
 const { analyzePatterns } = require("./engine/patterns");
+const { makeIgnoreChecker } = require("./engine/gitignore");
+
+// Any .env-style file. `.env.example` / `.env.sample` / `.env.template` / .dist
+// are meant to be committed and hold placeholders, so they're scanned normally
+// (a *real* secret in one of those IS a finding). The bare/real env files are
+// the ones whose secrets we suppress-if-ignored, flag-if-not.
+const ENV_RE = /^\.env(\.|$)/;
+const ENV_EXAMPLE_RE = /(example|sample|template|dist|defaults)/i;
+
+function classifyEnvFile(base) {
+  if (!ENV_RE.test(base)) return null;
+  return ENV_EXAMPLE_RE.test(base) ? "example" : "real";
+}
+
+// Does the file actually contain KEY=value assignments with a value? Keeps us
+// from flagging an empty/placeholder .env.
+function hasEnvAssignment(code) {
+  return /^\s*[A-Za-z_][A-Za-z0-9_]*\s*=\s*\S/m.test(code);
+}
+
+function envNotIgnoredFinding(rel, hasSecret, unknown) {
+  return {
+    ruleId: "config/env-not-ignored",
+    title: "Environment file not covered by .gitignore",
+    severity: hasSecret ? "high" : "medium",
+    confidence: "medium",
+    category: "secrets",
+    cwe: "CWE-538",
+    owasp: "A05:2021 Security Misconfiguration",
+    file: rel,
+    line: 0,
+    column: 0,
+    message: unknown
+      ? `${rel} holds environment values and no .gitignore was found to protect it. If this directory is (or becomes) a git repo, the file will be committed and any credentials in it leaked.`
+      : `${rel} holds environment values but isn't matched by any .gitignore rule, so it can be committed to version control and its credentials leaked.`,
+    fix: "Add a matching rule to .gitignore (e.g. `.env` or `.env*`, keeping an explicit `!.env.example`). If the file was already committed, rotate the credentials and purge it from git history (e.g. git filter-repo).",
+  };
+}
 
 const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage", ".turbo", ".cache"]);
 const JS_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
@@ -44,19 +82,38 @@ function scan(target, opts = {}) {
   const findings = [];
   let scanned = 0;
 
+  // Used to decide whether a .env's secrets are safely ignored or exposed.
+  const ignore = makeIgnoreChecker(root);
+
   for (const file of files) {
     const ext = path.extname(file).toLowerCase();
     const base = path.basename(file);
     let size = 0;
     try { size = fs.statSync(file).size; } catch { continue; }
     if (size > MAX_FILE_BYTES) continue;
-    if (!TEXT_EXT.has(ext) && base !== "package.json" && base !== ".env") continue;
+    const envClass = classifyEnvFile(base);
+    if (!TEXT_EXT.has(ext) && base !== "package.json" && !envClass) continue;
 
     let code = "";
     try { code = fs.readFileSync(file, "utf8"); } catch { continue; }
     scanned++;
     const rel = path.relative(root, file) || base;
 
+    // A real .env file is *meant* to hold secrets. The question isn't "are
+    // there secrets in it" but "is it protected from being committed". So we
+    // suppress its secret findings when it's properly ignored, and raise a
+    // single clear finding when it isn't.
+    if (envClass === "real") {
+      const secretFindings = opts.secrets !== false ? analyzeSecrets(code, rel) : [];
+      const ignored = ignore.isIgnored(file); // true | false | null(unknown)
+      if (ignored !== true && hasEnvAssignment(code)) {
+        findings.push(envNotIgnoredFinding(rel, secretFindings.length > 0, ignored === null));
+        for (const f of secretFindings) findings.push(f); // exposure is real — show what's inside
+      }
+      // ignored === true -> secrets stay local and protected; report nothing.
+      continue;
+    }
+
     if (JS_EXT.has(ext)) for (const f of analyzeJs(code, rel)) findings.push(f);
     if (base === "package.json") for (const f of analyzeDeps(code, rel)) findings.push(f);
     if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) findings.push(f);