safeey-cli 0.2.0 → 0.6.0

package/src/scan.js

@@ -5,20 +5,73 @@ const { analyzeJs } = require("./engine/js");
 const { analyzeSecrets } = require("./engine/secrets");
 const { analyzeDeps } = require("./engine/deps");
 const { analyzePatterns } = require("./engine/patterns");
+const { analyzeTaint } = require("./engine/taint");
+const { analyzeInfra } = require("./engine/infra");
+const { makeIgnoreChecker } = require("./engine/gitignore");
+const { fileSuppressions, isSuppressed, loadPathIgnores } = require("./engine/suppress");
+const { analyzeDependenciesOSV } = require("./engine/osv");
+const { analyzeGitHistory } = require("./engine/githistory");
+
+// Any .env-style file. `.env.example` / `.env.sample` / `.env.template` / .dist
+// are meant to be committed and hold placeholders, so they're scanned normally
+// (a *real* secret in one of those IS a finding). The bare/real env files are
+// the ones whose secrets we suppress-if-ignored, flag-if-not.
+const ENV_RE = /^\.env(\.|$)/;
+const ENV_EXAMPLE_RE = /(example|sample|template|dist|defaults)/i;
+
+function classifyEnvFile(base) {
+  if (!ENV_RE.test(base)) return null;
+  return ENV_EXAMPLE_RE.test(base) ? "example" : "real";
+}
+
+// Does the file actually contain KEY=value assignments with a value? Keeps us
+// from flagging an empty/placeholder .env.
+function hasEnvAssignment(code) {
+  return /^\s*[A-Za-z_][A-Za-z0-9_]*\s*=\s*\S/m.test(code);
+}
+
+function envNotIgnoredFinding(rel, hasSecret, unknown) {
+  return {
+    ruleId: "config/env-not-ignored",
+    title: "Environment file not covered by .gitignore",
+    severity: hasSecret ? "high" : "medium",
+    confidence: "medium",
+    category: "secrets",
+    cwe: "CWE-538",
+    owasp: "A05:2021 Security Misconfiguration",
+    file: rel,
+    line: 0,
+    column: 0,
+    message: unknown
+      ? `${rel} holds environment values and no .gitignore was found to protect it. If this directory is (or becomes) a git repo, the file will be committed and any credentials in it leaked.`
+      : `${rel} holds environment values but isn't matched by any .gitignore rule, so it can be committed to version control and its credentials leaked.`,
+    fix: "Add a matching rule to .gitignore (e.g. `.env` or `.env*`, keeping an explicit `!.env.example`). If the file was already committed, rotate the credentials and purge it from git history (e.g. git filter-repo).",
+  };
+}
 
 const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage", ".turbo", ".cache"]);
 const JS_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
-const TEXT_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".env", ".yml", ".yaml", ".py", ".rb", ".go", ".php", ".java", ".txt", ".sh", ".config"]);
+const TEXT_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".env", ".yml", ".yaml", ".py", ".rb", ".go", ".php", ".java", ".txt", ".sh", ".config", ".tf"]);
 const MAX_FILE_BYTES = 1_500_000;
+const CONF_RANK = { low: 1, medium: 2, high: 3 };
 
 const SEV_WEIGHT = { critical: 25, high: 12, medium: 5, low: 1, info: 0 };
 const SEV_ORDER = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 
+// Files that should be scanned even without a known text extension.
+function isScannable(base, ext, envClass) {
+  if (TEXT_EXT.has(ext)) return true;
+  if (base === "package.json") return true;
+  if (envClass) return true;
+  if (/^Dockerfile($|\.)/i.test(base)) return true; // Dockerfile, Dockerfile.prod
+  return false;
+}
+
 function walk(dir, files = []) {
   let entries = [];
   try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return files; }
   for (const e of entries) {
-    if (e.name.startsWith(".") && e.name !== ".env") { if (e.isDirectory()) continue; }
+    if (e.name.startsWith(".") && e.name !== ".env" && !e.name.startsWith(".env")) { if (e.isDirectory() && e.name !== ".github") continue; }
     const full = path.join(dir, e.name);
     if (e.isDirectory()) { if (!IGNORE_DIRS.has(e.name)) walk(full, files); }
     else files.push(full);
@@ -35,14 +88,40 @@ function grade(findings) {
   return { score, letter, counts };
 }
 
-function scan(target, opts = {}) {
+function dedupeSort(findings) {
+  const seen = new Set();
+  const unique = findings.filter((f) => {
+    const k = `${f.ruleId}|${f.file}|${f.line}|${f.column}`;
+    if (seen.has(k)) return false; seen.add(k); return true;
+  });
+  unique.sort((a, b) =>
+    (SEV_ORDER[b.severity] - SEV_ORDER[a.severity]) ||
+    a.file.localeCompare(b.file) || (a.line - b.line));
+  return unique;
+}
+
+async function scan(target, opts = {}) {
   const root = path.resolve(target);
   const stat = fs.existsSync(root) && fs.statSync(root);
   if (!stat) throw new Error(`Path not found: ${root}`);
 
   const files = stat.isDirectory() ? walk(root) : [root];
-  const findings = [];
+  let findings = [];
   let scanned = 0;
+  const meta = {};
+  const report = typeof opts.onProgress === "function" ? opts.onProgress : () => {};
+  report({ phase: "discover", total: files.length });
+
+  // Decide whether a .env's secrets are safely ignored or exposed.
+  const ignore = makeIgnoreChecker(root);
+  // .safeeyignore: skip whole paths the user has opted out of.
+  const pathIgnored = loadPathIgnores(
+    (p) => { try { return fs.readFileSync(p, "utf8"); } catch { return null; } },
+    (name) => path.join(root, name)
+  );
+
+  const minConf = CONF_RANK[opts.confidence] || 0;
+  const keepConf = (f) => !minConf || (CONF_RANK[f.confidence || "medium"] >= minConf);
 
   for (const file of files) {
     const ext = path.extname(file).toLowerCase();
@@ -50,29 +129,66 @@ function scan(target, opts = {}) {
     let size = 0;
     try { size = fs.statSync(file).size; } catch { continue; }
     if (size > MAX_FILE_BYTES) continue;
-    if (!TEXT_EXT.has(ext) && base !== "package.json" && base !== ".env") continue;
+    const envClass = classifyEnvFile(base);
+    if (!isScannable(base, ext, envClass)) continue;
+
+    const rel = path.relative(root, file) || base;
+    if (pathIgnored(rel)) continue;
 
     let code = "";
     try { code = fs.readFileSync(file, "utf8"); } catch { continue; }
     scanned++;
-    const rel = path.relative(root, file) || base;
+    report({ phase: "scan", current: scanned, total: files.length, file: rel });
 
-    if (JS_EXT.has(ext)) for (const f of analyzeJs(code, rel)) findings.push(f);
-    if (base === "package.json") for (const f of analyzeDeps(code, rel)) findings.push(f);
-    if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) findings.push(f);
-    // Regex/source-pattern rules run on every text file, gated by language tag.
-    for (const f of analyzePatterns(code, rel, ext)) findings.push(f);
-  }
+    // Collect this file's findings, then apply inline suppressions once.
+    const fileFindings = [];
 
-  // De-duplicate identical findings (same rule at the same spot).
-  const seen = new Set();
-  const unique = findings.filter((f) => { const k = `${f.ruleId}|${f.file}|${f.line}|${f.column}`; if (seen.has(k)) return false; seen.add(k); return true; });
-  findings.length = 0; findings.push(...unique);
+    if (envClass === "real") {
+      // A real .env is *meant* to hold secrets — the question is whether it's
+      // protected from being committed. Suppress when ignored; flag when not.
+      const secretFindings = opts.secrets !== false ? analyzeSecrets(code, rel) : [];
+      const ignored = ignore.isIgnored(file); // true | false | null(unknown)
+      if (ignored !== true && hasEnvAssignment(code)) {
+        fileFindings.push(envNotIgnoredFinding(rel, secretFindings.length > 0, ignored === null));
+        for (const f of secretFindings) fileFindings.push(f);
+      }
+    } else {
+      if (JS_EXT.has(ext)) {
+        for (const f of analyzeJs(code, rel)) fileFindings.push(f);
+        for (const f of analyzeTaint(code, rel)) fileFindings.push(f); // dataflow-backed
+      }
+      if (base === "package.json") for (const f of analyzeDeps(code, rel)) fileFindings.push(f);
+      if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) fileFindings.push(f);
+      for (const f of analyzePatterns(code, rel, ext)) fileFindings.push(f);   // + framework rules
+      for (const f of analyzeInfra(code, rel, base)) fileFindings.push(f);      // docker/k8s/tf/gha
+    }
+
+    // Inline suppressions (// safeey-ignore ...) for this file.
+    const sup = fileSuppressions(code);
+    for (const f of fileFindings) {
+      if (f.line && isSuppressed(sup, f.line, f.ruleId)) continue;
+      if (!keepConf(f)) continue;
+      findings.push(f);
+    }
+  }
 
-  // Sort worst-first, then by file/line.
-  findings.sort((a, b) => (SEV_ORDER[b.severity] - SEV_ORDER[a.severity]) || a.file.localeCompare(b.file) || a.line - b.line);
+  // ---- opt-in engines that aren't per-file --------------------------------
+  if (opts.osv) {
+    report({ phase: "osv" });
+    const r = await analyzeDependenciesOSV(root);
+    meta.osv = { checked: r.checked, error: r.error };
+    for (const f of r.findings) if (keepConf(f)) findings.push(f);
+  }
+  if (opts.history) {
+    report({ phase: "history" });
+    const r = analyzeGitHistory(root);
+    meta.history = { scannedBlobs: r.scannedBlobs, error: r.error };
+    for (const f of r.findings) if (keepConf(f)) findings.push(f);
+  }
 
-  return { findings, filesScanned: scanned, filesTotal: files.length, grade: grade(findings), SEV_ORDER };
+  report({ phase: "grade" });
+  findings = dedupeSort(findings);
+  return { findings, filesScanned: scanned, filesTotal: files.length, grade: grade(findings), meta, SEV_ORDER };
 }
 
-module.exports = { scan, grade, SEV_ORDER };
+module.exports = { scan, grade, dedupeSort, SEV_ORDER };

package/src/spinner.js

@@ -0,0 +1,97 @@
+// src/spinner.js — lightweight progress UX for the scan.
+//
+// Writes to stderr (so --json/--sarif on stdout stays clean), animates in place
+// on a TTY, and degrades to plain one-line-per-phase output when not a TTY
+// (e.g. CI logs). The goal is simply to carry the user along: show that files
+// are being scanned, then dependencies, then history, then grading.
+
+const FRAMES = ["\u280b", "\u2819", "\u2839", "\u2838", "\u283c", "\u2834", "\u2826", "\u2827", "\u2807", "\u280f"];
+const GREEN = "\x1b[32m", DIM = "\x1b[2m", RESET = "\x1b[0m";
+
+class Spinner {
+  constructor(stream = process.stderr) {
+    this.stream = stream;
+    this.tty = !!stream.isTTY;
+    this.text = "";
+    this.frame = 0;
+    this.timer = null;
+    this.start = Date.now();
+    this.lastPlain = "";
+  }
+
+  _render() {
+    if (!this.tty) return;
+    const f = FRAMES[(this.frame = (this.frame + 1) % FRAMES.length)];
+    this.stream.write(`\r\x1b[2K  ${GREEN}${f}${RESET} ${this.text}`);
+  }
+
+  begin(text) {
+    this.text = text;
+    if (this.tty) {
+      if (!this.timer) this.timer = setInterval(() => this._render(), 80);
+      this._render();
+    } else {
+      this.stream.write(`  ${text}\n`);
+      this.lastPlain = text;
+    }
+    return this;
+  }
+
+  // Update the current line's text (in place on a TTY; new line otherwise,
+  // but only when the headline phase changes, to avoid log spam).
+  update(text, { phaseChanged = false } = {}) {
+    this.text = text;
+    if (this.tty) this._render();
+    else if (phaseChanged && text !== this.lastPlain) { this.stream.write(`  ${text}\n`); this.lastPlain = text; }
+  }
+
+  // Stop and erase the line (TTY), so the report/output prints cleanly after.
+  stop() {
+    if (this.timer) { clearInterval(this.timer); this.timer = null; }
+    if (this.tty) this.stream.write("\r\x1b[2K");
+  }
+
+  // Stop and leave a final check-marked line in place.
+  done(text) {
+    if (this.timer) { clearInterval(this.timer); this.timer = null; }
+    const secs = ((Date.now() - this.start) / 1000).toFixed(1);
+    if (this.tty) {
+      this.stream.write(`\r\x1b[2K  ${GREEN}\u2714${RESET} ${text} ${DIM}(${secs}s)${RESET}\n`);
+    } else {
+      this.stream.write(`  \u2714 ${text} (${secs}s)\n`);
+    }
+  }
+}
+
+// Build an onProgress handler for scan() that drives a spinner. Throttled so we
+// don't repaint on every single file.
+function attachProgress(spinner) {
+  let lastPaint = 0;
+  let curPhase = null;
+  return (ev) => {
+    const now = Date.now();
+    if (ev.phase !== curPhase) {
+      curPhase = ev.phase;
+      const headline = {
+        discover: "Discovering files\u2026",
+        scan: "Scanning source\u2026",
+        osv: "Checking dependencies against OSV.dev\u2026",
+        history: "Scanning git history for secrets\u2026",
+        grade: "Grading results\u2026",
+      }[ev.phase] || ev.phase;
+      spinner.update(headline, { phaseChanged: true });
+      lastPaint = now;
+      return;
+    }
+    if (ev.phase === "scan" && ev.total) {
+      if (now - lastPaint < 60) return; // throttle
+      lastPaint = now;
+      const name = ev.file ? ` ${DIM}${truncate(ev.file, 40)}${RESET}` : "";
+      spinner.update(`Scanning source ${ev.current}/${ev.total}\u2026${name}`);
+    }
+  };
+}
+
+function truncate(s, n) { return s.length <= n ? s : "\u2026" + s.slice(-(n - 1)); }
+
+module.exports = { Spinner, attachProgress };