secure-scan 1.2.2

package/src/dependencies/installed/types.ts

@@ -0,0 +1,287 @@
+/**
+ * Types for Installed Dependencies Analysis
+ * Scans actual installed packages (node_modules, vendor, venv, etc.)
+ */
+
+import { PackageEcosystem, MalwareIndicator, Dependency } from '../types';
+import { Severity } from '../../types';
+
+/**
+ * Simplified security standard reference for malware patterns
+ */
+export interface MalwareSecurityStandard {
+  /** Standard name */
+  standard: 'CWE' | 'MITRE' | 'OWASP' | 'SANS';
+  /** Standard ID */
+  id: string;
+  /** Standard description */
+  description: string;
+}
+
+/**
+ * Installed package information
+ */
+export interface InstalledPackage {
+  /** Package name */
+  name: string;
+  /** Installed version */
+  version: string;
+  /** Package ecosystem */
+  ecosystem: PackageEcosystem;
+  /** Installation path */
+  installPath: string;
+  /** Total size in bytes */
+  sizeBytes: number;
+  /** Number of files */
+  fileCount: number;
+  /** Has post-install scripts */
+  hasPostInstallScripts: boolean;
+  /** Post-install script content (if any) */
+  postInstallScripts?: PostInstallScript[];
+  /** Package metadata */
+  metadata?: InstalledPackageMetadata;
+  /** Integrity check result */
+  integrityStatus?: IntegrityStatus;
+}
+
+/**
+ * Package metadata from installed package
+ */
+export interface InstalledPackageMetadata {
+  /** Author */
+  author?: string;
+  /** License */
+  license?: string;
+  /** Homepage */
+  homepage?: string;
+  /** Repository URL */
+  repository?: string;
+  /** Description */
+  description?: string;
+  /** Install date (if available) */
+  installDate?: Date;
+  /** Main entry point */
+  main?: string;
+  /** Binary commands */
+  binaries?: string[];
+}
+
+/**
+ * Post-install script information
+ */
+export interface PostInstallScript {
+  /** Script type */
+  type: 'preinstall' | 'install' | 'postinstall' | 'preuninstall' | 'postuninstall';
+  /** Script command */
+  command: string;
+  /** Script file path (if file) */
+  scriptPath?: string;
+  /** Script content (if readable) */
+  content?: string;
+  /** Risk level */
+  riskLevel: Severity;
+  /** Risk indicators found */
+  riskIndicators: string[];
+}
+
+/**
+ * Integrity verification status
+ */
+export interface IntegrityStatus {
+  /** Overall status */
+  status: 'verified' | 'mismatch' | 'unknown' | 'missing_lockfile';
+  /** Expected version from lock file */
+  expectedVersion?: string;
+  /** Installed version */
+  installedVersion: string;
+  /** Expected integrity hash */
+  expectedHash?: string;
+  /** Actual integrity hash */
+  actualHash?: string;
+  /** Mismatch details */
+  mismatchDetails?: string;
+}
+
+/**
+ * Malware scan result for installed package
+ */
+export interface InstalledMalwareFinding {
+  /** Unique finding ID */
+  id: string;
+  /** Affected package */
+  package: InstalledPackage;
+  /** File where malware was detected */
+  filePath: string;
+  /** Line number (if applicable) */
+  lineNumber?: number;
+  /** Column number (if applicable) */
+  columnNumber?: number;
+  /** Malware indicators detected */
+  indicators: MalwareIndicator[];
+  /** Severity level */
+  severity: Severity;
+  /** Finding title */
+  title: string;
+  /** Detailed description */
+  description: string;
+  /** Matched pattern/signature */
+  matchedPattern: string;
+  /** Code snippet with malware */
+  codeSnippet?: string;
+  /** Security standards */
+  standards: MalwareSecurityStandard[];
+  /** Recommendation */
+  recommendation: string;
+  /** Confidence level (0-100) */
+  confidence: number;
+  /** Detection timestamp */
+  timestamp: Date;
+}
+
+/**
+ * Malware detection pattern
+ */
+export interface MalwarePattern {
+  /** Pattern ID */
+  id: string;
+  /** Pattern name */
+  name: string;
+  /** Pattern description */
+  description: string;
+  /** Malware indicator type */
+  indicator: MalwareIndicator;
+  /** Severity */
+  severity: Severity;
+  /** Regex patterns */
+  patterns: RegExp[];
+  /** File extensions to scan */
+  fileExtensions: string[];
+  /** Keywords that trigger deeper analysis */
+  keywords?: string[];
+  /** Confidence level (0-100) */
+  confidence: number;
+  /** Related security standards */
+  standards: MalwareSecurityStandard[];
+}
+
+/**
+ * Installed dependencies scan result
+ */
+export interface InstalledDependenciesScanResult {
+  /** Scanned package folders */
+  scannedFolders: ScannedFolder[];
+  /** All installed packages found */
+  installedPackages: InstalledPackage[];
+  /** Malware findings */
+  malwareFindings: InstalledMalwareFinding[];
+  /** Integrity issues */
+  integrityIssues: IntegrityIssue[];
+  /** Suspicious post-install scripts */
+  suspiciousScripts: SuspiciousScriptFinding[];
+  /** Statistics */
+  stats: InstalledScanStats;
+  /** Timestamp */
+  timestamp: Date;
+}
+
+/**
+ * Scanned folder information
+ */
+export interface ScannedFolder {
+  /** Folder path */
+  path: string;
+  /** Folder type */
+  type: 'node_modules' | 'vendor' | 'venv' | 'site-packages' | 'packages' | 'other';
+  /** Ecosystem */
+  ecosystem: PackageEcosystem;
+  /** Number of packages */
+  packageCount: number;
+  /** Total size */
+  totalSizeBytes: number;
+  /** Files scanned */
+  filesScanned: number;
+}
+
+/**
+ * Integrity issue
+ */
+export interface IntegrityIssue {
+  /** Package name */
+  packageName: string;
+  /** Issue type */
+  issueType: 'version_mismatch' | 'hash_mismatch' | 'unexpected_package' | 'missing_package' | 'tampered';
+  /** Severity */
+  severity: Severity;
+  /** Description */
+  description: string;
+  /** Expected value */
+  expected?: string;
+  /** Actual value */
+  actual?: string;
+}
+
+/**
+ * Suspicious script finding
+ */
+export interface SuspiciousScriptFinding {
+  /** Package name */
+  packageName: string;
+  /** Script info */
+  script: PostInstallScript;
+  /** Severity */
+  severity: Severity;
+  /** Description */
+  description: string;
+  /** Risk indicators */
+  riskIndicators: string[];
+}
+
+/**
+ * Statistics for installed dependencies scan
+ */
+export interface InstalledScanStats {
+  /** Total folders scanned */
+  totalFoldersScanned: number;
+  /** Total packages found */
+  totalPackagesFound: number;
+  /** Total files scanned */
+  totalFilesScanned: number;
+  /** Total bytes scanned */
+  totalBytesScanned: number;
+  /** Malware findings count */
+  malwareFindingsCount: number;
+  /** Integrity issues count */
+  integrityIssuesCount: number;
+  /** Suspicious scripts count */
+  suspiciousScriptsCount: number;
+  /** Packages by ecosystem */
+  packagesByEcosystem: Record<PackageEcosystem, number>;
+  /** Findings by severity */
+  findingsBySeverity: Record<Severity, number>;
+  /** Scan duration in ms */
+  duration: number;
+}
+
+/**
+ * Installed dependencies scanner configuration
+ */
+export interface InstalledScanConfig {
+  /** Project root path */
+  projectPath: string;
+  /** Folders to scan */
+  foldersToScan?: string[];
+  /** Maximum file size to scan (bytes) */
+  maxFileSizeBytes?: number;
+  /** File extensions to scan */
+  fileExtensions?: string[];
+  /** Enable integrity verification */
+  verifyIntegrity?: boolean;
+  /** Scan post-install scripts */
+  scanPostInstallScripts?: boolean;
+  /** Maximum depth in node_modules */
+  maxDepth?: number;
+  /** Verbose logging */
+  verbose?: boolean;
+  /** Parallel scan threads */
+  parallelScans?: number;
+}

package/src/dependencies/parsers/base/baseParser.ts

@@ -0,0 +1,108 @@
+/**
+ * Base Dependency Parser
+ * Abstract base class for ecosystem-specific parsers
+ */
+
+import { 
+  DependencyParser, 
+  DependencyManifest, 
+  ManifestFileType, 
+  PackageEcosystem,
+  Dependency 
+} from '../../types';
+import { logger } from '../../../utils/logger';
+
+/**
+ * Base Parser Class
+ * Provides common functionality for all dependency parsers
+ */
+export abstract class BaseDependencyParser implements DependencyParser {
+  abstract name: string;
+  abstract supportedFiles: ManifestFileType[];
+  abstract ecosystem: PackageEcosystem;
+
+  /**
+   * Check if parser supports a file
+   */
+  supports(fileName: string): boolean {
+    const baseName = fileName.split(/[/\\]/).pop() || '';
+    
+    // Special handling for .csproj files
+    if (baseName.endsWith('.csproj')) {
+      return this.supportedFiles.includes('csproj');
+    }
+    
+    return this.supportedFiles.some(ft => baseName === ft || baseName.endsWith(ft));
+  }
+
+  /**
+   * Parse manifest file - must be implemented by subclasses
+   */
+  abstract parse(filePath: string, content: string): Promise<DependencyManifest>;
+
+  /**
+   * Helper to create a dependency object
+   */
+  protected createDependency(
+    name: string,
+    version: string,
+    sourceFile: string,
+    options: Partial<Dependency> = {}
+  ): Dependency {
+    return {
+      name,
+      version,
+      ecosystem: this.ecosystem,
+      dependencyType: 'direct',
+      depth: 0,
+      sourceFile,
+      ...options
+    };
+  }
+
+  /**
+   * Helper to normalize version string
+   */
+  protected normalizeVersion(version: string): string {
+    if (!version) return '*';
+    
+    // Remove common prefixes
+    version = version.replace(/^[v=~^]/, '');
+    
+    // Handle special cases
+    if (version === 'latest' || version === '*') {
+      return '*';
+    }
+    
+    return version.trim();
+  }
+
+  /**
+   * Helper to determine if file is a lock file
+   */
+  protected isLockFile(fileName: string): boolean {
+    const lockPatterns = [
+      'package-lock.json',
+      'yarn.lock',
+      'Pipfile.lock',
+      'composer.lock'
+    ];
+    return lockPatterns.some(p => fileName.endsWith(p));
+  }
+
+  /**
+   * Log parsing info
+   */
+  protected logParsing(filePath: string): void {
+    logger.debug(`[${this.name}] Parsing: ${filePath}`);
+  }
+
+  /**
+   * Log parsing error
+   */
+  protected logError(filePath: string, error: string): void {
+    logger.debug(`[${this.name}] Error parsing ${filePath}: ${error}`);
+  }
+}
+
+export default BaseDependencyParser;

package/src/dependencies/parsers/base/index.ts

@@ -0,0 +1,6 @@
+/**
+ * Base Parser Module Exports
+ */
+
+export * from './baseParser';
+export { default as BaseDependencyParser } from './baseParser';

package/src/dependencies/parsers/cpp/cppParser.ts

@@ -0,0 +1,245 @@
+/**
+ * C/C++ Dependency Parser
+ * Parses vcpkg.json, conanfile.txt, and CMakeLists.txt
+ */
+
+import { BaseDependencyParser } from '../base';
+import { 
+  DependencyManifest, 
+  ManifestFileType, 
+  PackageEcosystem,
+  Dependency
+} from '../../types';
+
+/**
+ * vcpkg.json structure
+ */
+interface VcpkgJson {
+  name?: string;
+  version?: string;
+  dependencies?: (string | VcpkgDependency)[];
+  'default-features'?: boolean;
+  features?: Record<string, VcpkgFeature>;
+}
+
+interface VcpkgDependency {
+  name: string;
+  version?: string;
+  'version>='?: string;
+  features?: string[];
+  platform?: string;
+}
+
+interface VcpkgFeature {
+  description?: string;
+  dependencies?: (string | VcpkgDependency)[];
+}
+
+/**
+ * C/C++ Dependency Parser
+ */
+export class CppDependencyParser extends BaseDependencyParser {
+  name = 'C/C++ Dependency Parser';
+  supportedFiles: ManifestFileType[] = ['vcpkg.json', 'conanfile.txt', 'CMakeLists.txt'];
+  ecosystem: PackageEcosystem = 'vcpkg';
+
+  /**
+   * Parse manifest file
+   */
+  async parse(filePath: string, content: string): Promise<DependencyManifest> {
+    this.logParsing(filePath);
+
+    const fileName = filePath.split(/[/\\]/).pop() || '';
+    const dependencies: Dependency[] = [];
+    const parseErrors: string[] = [];
+    let ecosystem: PackageEcosystem = 'vcpkg';
+
+    try {
+      if (fileName === 'vcpkg.json') {
+        dependencies.push(...this.parseVcpkgJson(content, filePath, parseErrors));
+        ecosystem = 'vcpkg';
+      } else if (fileName === 'conanfile.txt') {
+        dependencies.push(...this.parseConanfile(content, filePath, parseErrors));
+        ecosystem = 'conan';
+      } else if (fileName === 'CMakeLists.txt') {
+        dependencies.push(...this.parseCMakeLists(content, filePath, parseErrors));
+        ecosystem = 'cmake';
+      }
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      parseErrors.push(`Failed to parse ${fileName}: ${errorMsg}`);
+      this.logError(filePath, errorMsg);
+    }
+
+    return {
+      filePath,
+      fileType: fileName as ManifestFileType,
+      ecosystem,
+      dependencies,
+      parseErrors: parseErrors.length > 0 ? parseErrors : undefined,
+      isLockFile: false
+    };
+  }
+
+  /**
+   * Check if parser supports file
+   */
+  supports(fileName: string): boolean {
+    const baseName = fileName.split(/[/\\]/).pop() || '';
+    return this.supportedFiles.some(ft => baseName === ft);
+  }
+
+  /**
+   * Parse vcpkg.json
+   */
+  private parseVcpkgJson(content: string, filePath: string, errors: string[]): Dependency[] {
+    const dependencies: Dependency[] = [];
+    
+    let vcpkg: VcpkgJson;
+    try {
+      vcpkg = JSON.parse(content);
+    } catch (e) {
+      errors.push('Invalid JSON in vcpkg.json');
+      return dependencies;
+    }
+
+    if (vcpkg.dependencies) {
+      for (const dep of vcpkg.dependencies) {
+        if (typeof dep === 'string') {
+          dependencies.push(this.createDependency(dep, '*', filePath, {
+            dependencyType: 'direct',
+            ecosystem: 'vcpkg'
+          }));
+        } else {
+          const version = dep.version || dep['version>='] || '*';
+          dependencies.push(this.createDependency(dep.name, version, filePath, {
+            dependencyType: 'direct',
+            ecosystem: 'vcpkg'
+          }));
+        }
+      }
+    }
+
+    // Parse feature dependencies
+    if (vcpkg.features) {
+      for (const [featureName, feature] of Object.entries(vcpkg.features)) {
+        if (feature.dependencies) {
+          for (const dep of feature.dependencies) {
+            const name = typeof dep === 'string' ? dep : dep.name;
+            const version = typeof dep === 'string' ? '*' : (dep.version || dep['version>='] || '*');
+            dependencies.push(this.createDependency(name, version, filePath, {
+              dependencyType: 'optional',
+              ecosystem: 'vcpkg'
+            }));
+          }
+        }
+      }
+    }
+
+    return dependencies;
+  }
+
+  /**
+   * Parse conanfile.txt
+   */
+  private parseConanfile(content: string, filePath: string, errors: string[]): Dependency[] {
+    const dependencies: Dependency[] = [];
+    const lines = content.split('\n');
+    let inRequires = false;
+    let inBuildRequires = false;
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+
+      // Track sections
+      if (trimmed === '[requires]') {
+        inRequires = true;
+        inBuildRequires = false;
+        continue;
+      }
+      if (trimmed === '[build_requires]' || trimmed === '[tool_requires]') {
+        inRequires = false;
+        inBuildRequires = true;
+        continue;
+      }
+      if (trimmed.startsWith('[')) {
+        inRequires = false;
+        inBuildRequires = false;
+        continue;
+      }
+
+      // Skip comments and empty lines
+      if (!trimmed || trimmed.startsWith('#')) continue;
+
+      // Parse requirement line (format: package/version)
+      if (inRequires || inBuildRequires) {
+        const match = trimmed.match(/^([^/\s@]+)(?:\/([^@\s]+))?/);
+        if (match) {
+          const name = match[1];
+          const version = match[2] || '*';
+          dependencies.push(this.createDependency(name, version, filePath, {
+            dependencyType: inBuildRequires ? 'dev' : 'direct',
+            ecosystem: 'conan'
+          }));
+        }
+      }
+    }
+
+    return dependencies;
+  }
+
+  /**
+   * Parse CMakeLists.txt
+   */
+  private parseCMakeLists(content: string, filePath: string, errors: string[]): Dependency[] {
+    const dependencies: Dependency[] = [];
+
+    // find_package(Package VERSION x.x REQUIRED)
+    const findPackageRegex = /find_package\s*\(\s*(\w+)(?:\s+(\d+(?:\.\d+)*))?[^)]*\)/gi;
+    
+    let match;
+    while ((match = findPackageRegex.exec(content)) !== null) {
+      const name = match[1];
+      const version = match[2] || '*';
+      
+      // Skip CMake built-in packages
+      const builtins = ['CMake', 'CTest', 'GTest'];
+      if (builtins.includes(name)) continue;
+      
+      dependencies.push(this.createDependency(name, version, filePath, {
+        dependencyType: 'direct',
+        ecosystem: 'cmake'
+      }));
+    }
+
+    // FetchContent_Declare(name GIT_REPOSITORY url GIT_TAG tag)
+    const fetchContentRegex = /FetchContent_Declare\s*\(\s*(\w+)[^)]*GIT_TAG\s+([^\s)]+)/gi;
+    
+    while ((match = fetchContentRegex.exec(content)) !== null) {
+      const name = match[1];
+      const version = match[2] || '*';
+      
+      dependencies.push(this.createDependency(name, version, filePath, {
+        dependencyType: 'direct',
+        ecosystem: 'cmake'
+      }));
+    }
+
+    // CPMAddPackage
+    const cpmRegex = /CPMAddPackage\s*\([^)]*NAME\s+(\w+)[^)]*VERSION\s+([^\s)]+)/gi;
+    
+    while ((match = cpmRegex.exec(content)) !== null) {
+      const name = match[1];
+      const version = match[2] || '*';
+      
+      dependencies.push(this.createDependency(name, version, filePath, {
+        dependencyType: 'direct',
+        ecosystem: 'cmake'
+      }));
+    }
+
+    return dependencies;
+  }
+}
+
+export default CppDependencyParser;

package/src/dependencies/parsers/cpp/index.ts

@@ -0,0 +1,6 @@
+/**
+ * C/C++ Parser Module Exports
+ */
+
+export * from './cppParser';
+export { default as CppDependencyParser } from './cppParser';