selfguard 0.0.1 → 0.2.0

package/dist/lockfile/npm.js

@@ -0,0 +1,77 @@
+/**
+ * Static parser for package-lock.json / npm-shrinkwrap.json (lockfileVersion 1, 2 and 3).
+ * Pure data: never executes anything from the project.
+ */
+import { isObject } from "../fsutil.js";
+import { Collector, depNames, parseAlias } from "./common.js";
+function isNonRegistry(resolved) {
+    if (typeof resolved !== "string")
+        return false;
+    return /^(git\+|git:|github:|file:|link:)/.test(resolved) || resolved.endsWith(".git");
+}
+const NM = "node_modules/";
+function parseV2(packages, out) {
+    // Direct deps = deps declared by the root package or any workspace package.
+    const direct = new Set();
+    for (const [key, entry] of Object.entries(packages)) {
+        if (key === "" || !key.includes(NM))
+            for (const n of depNames(entry))
+                direct.add(n);
+    }
+    for (const [key, entry] of Object.entries(packages)) {
+        if (key === "" || !isObject(entry))
+            continue;
+        const idx = key.lastIndexOf(NM);
+        if (idx === -1)
+            continue; // workspace source folder, not an installed package
+        if (entry.link === true)
+            continue; // symlink to a workspace
+        if (isNonRegistry(entry.resolved)) {
+            out.skipped++;
+            continue;
+        }
+        const installedAs = key.slice(idx + NM.length);
+        const name = typeof entry.name === "string" ? entry.name : installedAs; // aliases carry the real name
+        const version = typeof entry.version === "string" ? entry.version : "";
+        const isTopLevel = key.indexOf(NM) === idx; // only one node_modules segment in the path
+        out.add(name, version, isTopLevel && direct.has(installedAs), entry.dev === true);
+    }
+}
+function parseV1(deps, out, direct, depth) {
+    if (depth > 200)
+        return; // defensive: malformed/cyclic input
+    for (const [installedAs, entry] of Object.entries(deps)) {
+        if (!isObject(entry))
+            continue;
+        const spec = typeof entry.version === "string" ? entry.version : "";
+        if (isNonRegistry(entry.resolved) || isNonRegistry(spec)) {
+            out.skipped++;
+        }
+        else {
+            const alias = parseAlias(spec);
+            out.add(alias?.name ?? installedAs, alias?.version ?? spec, depth === 0 && direct.has(installedAs), entry.dev === true);
+        }
+        if (isObject(entry.dependencies))
+            parseV1(entry.dependencies, out, direct, depth + 1);
+    }
+}
+/**
+ * @param lockText raw contents of package-lock.json
+ * @param manifest parsed package.json (only needed for lockfileVersion 1 to know direct deps)
+ */
+export function parseNpmLockfile(lockText, manifest) {
+    const lock = JSON.parse(lockText);
+    if (!isObject(lock))
+        throw new Error("package-lock.json is not a JSON object");
+    const out = new Collector();
+    if (isObject(lock.packages)) {
+        parseV2(lock.packages, out);
+    }
+    else if (isObject(lock.dependencies)) {
+        parseV1(lock.dependencies, out, depNames(manifest), 0);
+    }
+    else {
+        throw new Error("unrecognized package-lock.json format");
+    }
+    return out.result();
+}

package/dist/lockfile/pnpm.js

@@ -0,0 +1,121 @@
+/**
+ * Static parser for pnpm-lock.yaml (lockfileVersion 5.x, 6.x and 9.x).
+ * Pure data: never executes anything from the project.
+ */
+import { Collector, devOnlyNames, reachable, splitNameAt } from "./common.js";
+import { isMap, parseYamlDocuments } from "./yaml.js";
+const IMPORTER_PROD = ["dependencies", "optionalDependencies"];
+const IMPORTER_DEV = ["devDependencies"];
+/** Drop peer-dependency suffixes: "18.2.0(react@18.2.0)" (v6+) or "18.2.0_react@18.2.0" (v5). */
+function stripPeers(v) {
+    const paren = v.indexOf("(");
+    const base = paren >= 0 ? v.slice(0, paren) : v;
+    const underscore = base.indexOf("_");
+    return underscore >= 0 ? base.slice(0, underscore) : base;
+}
+/** Package key -> name/version. v9 "name@1.0.0(peers)", v6 "/name@1.0.0(peers)", v5 "/name/1.0.0_peers". */
+function parseKey(key, major) {
+    const k = key.startsWith("/") ? key.slice(1) : key;
+    if (major < 6) {
+        const slash = k.lastIndexOf("/");
+        if (slash <= 0)
+            return null;
+        return { name: k.slice(0, slash), version: stripPeers(k.slice(slash + 1)) };
+    }
+    const parsed = splitNameAt(k.split("(")[0]);
+    return parsed ? { name: parsed.name, version: stripPeers(parsed.version) } : null;
+}
+/** Importer entry "version" -> snapshot key, handling aliases ("left-pad@1.3.0", "/left-pad@1.3.0"). */
+function importerTarget(name, ref, major) {
+    if (/^(link|file|workspace):/.test(ref))
+        return null;
+    if (ref.startsWith("/"))
+        return major < 6 ? ref : ref.slice(1);
+    // "1.2.3(...)" is a plain version; "real@1.2.3(...)" is an alias target.
+    const head = ref.split("(")[0];
+    if (/^\d/.test(head))
+        return major < 6 ? `/${name}/${ref}` : `${name}@${ref}`;
+    return major < 6 ? `/${ref}` : ref;
+}
+function refOf(entry) {
+    if (typeof entry === "string")
+        return entry; // v5: name: version
+    if (isMap(entry) && typeof entry.version === "string")
+        return entry.version; // v6/v9: {specifier, version}
+    return null;
+}
+export function parsePnpmLockfile(text, manifest) {
+    const docs = parseYamlDocuments(text);
+    // pnpm 10 can prepend a document for config dependencies; the main one has importers/packages.
+    const doc = docs.find((d) => isMap(d.importers) || isMap(d.packages)) ?? docs.find((d) => d.lockfileVersion !== undefined);
+    if (!doc || doc.lockfileVersion === undefined)
+        throw new Error("not a pnpm lockfile");
+    const major = Math.trunc(Number.parseFloat(String(doc.lockfileVersion)));
+    if (!Number.isFinite(major) || major < 5)
+        throw new Error(`unsupported pnpm lockfileVersion ${String(doc.lockfileVersion)}`);
+    const importers = isMap(doc.importers) ? doc.importers : { ".": doc };
+    const packages = isMap(doc.packages) ? doc.packages : Object.create(null);
+    // v9 keeps the graph in "snapshots"; older versions keep it in "packages".
+    const graph = isMap(doc.snapshots) ? doc.snapshots : packages;
+    const directPkgs = new Set(); // "name@version" depended on by some importer
+    const prodRoots = [];
+    const devOnly = devOnlyNames(manifest);
+    for (const importer of Object.values(importers)) {
+        if (!isMap(importer))
+            continue;
+        for (const field of [...IMPORTER_PROD, ...IMPORTER_DEV]) {
+            const deps = importer[field];
+            if (!isMap(deps))
+                continue;
+            for (const [name, entry] of Object.entries(deps)) {
+                const ref = refOf(entry);
+                const target = ref ? importerTarget(name, ref, major) : null;
+                if (!target)
+                    continue;
+                const pkg = parseKey(target, major);
+                if (pkg)
+                    directPkgs.add(`${pkg.name}@${pkg.version}`);
+                if (IMPORTER_PROD.includes(field) && !devOnly.has(name))
+                    prodRoots.push(target);
+            }
+        }
+    }
+    const edges = (key) => {
+        const node = graph[key];
+        if (!isMap(node))
+            return [];
+        const out = [];
+        for (const field of ["dependencies", "optionalDependencies"]) {
+            const deps = node[field];
+            if (!isMap(deps))
+                continue;
+            for (const [name, ref] of Object.entries(deps)) {
+                const target = typeof ref === "string" ? importerTarget(name, ref, major) : null;
+                if (target)
+                    out.push(target);
+            }
+        }
+        return out;
+    };
+    const prodKeys = reachable(prodRoots, edges);
+    const prodPkgs = new Set([...prodKeys].map((k) => parseKey(k, major)).filter(Boolean).map((p) => `${p.name}@${p.version}`));
+    const out = new Collector();
+    // Every installed package appears in the graph (snapshots in v9, packages before).
+    for (const [key, entry] of Object.entries(graph)) {
+        const pkg = parseKey(key, major);
+        if (!pkg) {
+            out.skipped++;
+            continue;
+        }
+        const meta = isMap(packages[key]) ? packages[key] : isMap(entry) ? entry : undefined;
+        const resolution = meta && isMap(meta.resolution) ? meta.resolution : meta?.resolution;
+        if (typeof resolution === "string" && /(tarball|repo|directory|commit):/.test(resolution) && !/integrity:/.test(resolution)) {
+            out.skipped++; // git / tarball / local directory deps
+            continue;
+        }
+        const legacyDev = isMap(entry) ? entry.dev : undefined; // v5/v6 mark dev explicitly
+        const dev = major < 9 && legacyDev !== undefined ? legacyDev === "true" : !prodPkgs.has(`${pkg.name}@${pkg.version}`);
+        out.add(pkg.name, pkg.version, directPkgs.has(`${pkg.name}@${pkg.version}`), dev);
+    }
+    return out.result();
+}

package/dist/lockfile/types.js

@@ -0,0 +1 @@
+export {};

package/dist/lockfile/yaml.js

@@ -0,0 +1,140 @@
+/**
+ * Minimal YAML reader for the subset used by pnpm-lock.yaml and yarn (berry) yarn.lock:
+ * block mappings by indentation, plain/single/double-quoted scalars, `---` documents.
+ * Flow collections ({...} / [...]) are kept as raw strings and sequence items are
+ * ignored: lockfile parsers never need them.
+ *
+ * Hardened for untrusted input: objects have no prototype (so keys like "__proto__"
+ * are plain data), nesting depth is bounded, and there is no tag/anchor/alias support
+ * (no "billion laughs").
+ */
+const MAX_DEPTH = 64;
+const newMap = () => Object.create(null);
+export function isMap(v) {
+    return typeof v === "object" && v !== null;
+}
+/** Parse a key and return [key, restAfterColon], or null if the line has no mapping key. */
+function splitKey(line) {
+    let key;
+    let i;
+    if (line[0] === "'" || line[0] === '"') {
+        const q = line[0];
+        i = 1;
+        let out = "";
+        for (;;) {
+            if (i >= line.length)
+                return null;
+            const ch = line[i];
+            if (q === "'" && ch === "'" && line[i + 1] === "'") {
+                out += "'";
+                i += 2;
+                continue;
+            }
+            if (q === '"' && ch === "\\" && i + 1 < line.length) {
+                out += unescapeDouble(line.slice(i, i + 2));
+                i += 2;
+                continue;
+            }
+            if (ch === q)
+                break;
+            out += ch;
+            i++;
+        }
+        key = out;
+        i++; // closing quote
+        while (line[i] === " ")
+            i++;
+        if (line[i] !== ":")
+            return null;
+    }
+    else {
+        const m = /:(?:\s|$)/.exec(line);
+        if (!m)
+            return null;
+        i = m.index;
+        key = line.slice(0, i).trimEnd();
+    }
+    return [key, line.slice(i + 1).trim()];
+}
+function unescapeDouble(seq) {
+    switch (seq[1]) {
+        case "n":
+            return "\n";
+        case "t":
+            return "\t";
+        case '"':
+            return '"';
+        case "\\":
+            return "\\";
+        case "/":
+            return "/";
+        default:
+            return seq;
+    }
+}
+function scalar(raw) {
+    if (raw.startsWith("'")) {
+        const end = raw.lastIndexOf("'");
+        return end > 0 ? raw.slice(1, end).replace(/''/g, "'") : raw;
+    }
+    if (raw.startsWith('"')) {
+        const end = raw.lastIndexOf('"');
+        if (end <= 0)
+            return raw;
+        return raw.slice(1, end).replace(/\\./g, unescapeDouble);
+    }
+    if (raw.startsWith("{") || raw.startsWith("["))
+        return raw;
+    const comment = raw.search(/\s#/);
+    return (comment >= 0 ? raw.slice(0, comment) : raw).trim();
+}
+export function parseYamlDocuments(text) {
+    const docs = [];
+    let root = newMap();
+    docs.push(root);
+    let stack = [{ indent: -1, node: root }];
+    let skipAbove = -1; // skipping a block scalar's lines (indent > skipAbove)
+    for (const raw of text.split(/\r?\n/)) {
+        const body = raw.trimStart();
+        const indent = raw.length - body.length;
+        if (skipAbove >= 0) {
+            if (body === "" || indent > skipAbove)
+                continue;
+            skipAbove = -1;
+        }
+        if (body === "" || body.startsWith("#"))
+            continue;
+        if (indent === 0 && (body.startsWith("---") || body.startsWith("..."))) {
+            if (body.startsWith("---")) {
+                root = newMap();
+                docs.push(root);
+                stack = [{ indent: -1, node: root }];
+            }
+            continue;
+        }
+        while (stack.length > 1 && indent <= stack[stack.length - 1].indent)
+            stack.pop();
+        if (body === "-" || body.startsWith("- "))
+            continue; // sequence item: not needed
+        const kv = splitKey(body);
+        if (!kv)
+            continue;
+        const [key, rest] = kv;
+        const parent = stack[stack.length - 1].node;
+        if (rest === "") {
+            if (stack.length > MAX_DEPTH)
+                throw new Error("YAML nesting too deep");
+            const child = newMap();
+            parent[key] = child;
+            stack.push({ indent, node: child });
+        }
+        else if (/^[|>][-+0-9]*$/.test(rest)) {
+            parent[key] = ""; // block scalar: content not needed
+            skipAbove = indent;
+        }
+        else {
+            parent[key] = scalar(rest);
+        }
+    }
+    return docs.filter((d) => Object.keys(d).length > 0);
+}

package/dist/lockfile/yarn.js

@@ -0,0 +1,136 @@
+/**
+ * Static parsers for yarn.lock: classic (v1, custom format) and berry (v2+, YAML).
+ * Pure data: never executes anything from the project.
+ */
+import { Collector, depsOf, devOnlyNames, parseAlias, PROD_FIELDS, reachable, splitNameAt, ALL_FIELDS } from "./common.js";
+import { isMap, parseYamlDocuments } from "./yaml.js";
+function unquote(s) {
+    const t = s.trim();
+    return t.length >= 2 && t.startsWith('"') && t.endsWith('"') ? t.slice(1, -1) : t;
+}
+/** Shared tail: classify direct/dev by walking from the manifest's production deps. */
+function collect(entries, manifest, descriptor) {
+    const out = new Collector();
+    const devOnly = devOnlyNames(manifest);
+    const all = depsOf(manifest, ALL_FIELDS);
+    const prodRoots = [...depsOf(manifest, PROD_FIELDS)]
+        .filter(([name]) => !devOnly.has(name))
+        .map(([name, spec]) => descriptor(name, spec));
+    const haveManifest = all.size > 0;
+    const prod = reachable(prodRoots, (d) => (entries.get(d)?.deps ?? []).map(([n, s]) => descriptor(n, s)));
+    const prodPkgs = new Set([...prod].map((d) => entries.get(d)).filter(Boolean).map((e) => `${e.name}@${e.version}`));
+    const directPkgs = new Set([...all].map(([n, s]) => entries.get(descriptor(n, s))).filter(Boolean).map((e) => `${e.name}@${e.version}`));
+    const seen = new Set();
+    for (const e of entries.values()) {
+        if (seen.has(e))
+            continue; // one entry is shared by several descriptors
+        seen.add(e);
+        if (!e.registry) {
+            out.skipped++;
+            continue;
+        }
+        const key = `${e.name}@${e.version}`;
+        out.add(e.name, e.version, directPkgs.has(key), haveManifest ? !prodPkgs.has(key) : false);
+    }
+    return out.result();
+}
+// ---------- classic (v1) ----------
+function parseClassic(text, manifest) {
+    const entries = new Map();
+    let current = null;
+    let inDeps = false;
+    for (const line of text.split(/\r?\n/)) {
+        if (line === "" || line.startsWith("#"))
+            continue;
+        const indent = line.length - line.trimStart().length;
+        const body = line.trim();
+        if (indent === 0) {
+            inDeps = false;
+            if (!body.endsWith(":")) {
+                current = null;
+                continue;
+            }
+            const descriptors = body.slice(0, -1).split(/,\s*/).map(unquote);
+            const first = splitNameAt(descriptors[0] ?? "");
+            if (!first) {
+                current = null;
+                continue;
+            }
+            const alias = parseAlias(first.version);
+            const spec = alias ? alias.version : first.version;
+            // git/file/link/tarball specs, or GitHub "user/repo" shorthand, are not registry packages
+            const registry = !/^(file|link|git|github|https?|portal|exec):|^git\+|^[\w.-]+\/[\w.-]+(#.*)?$/.test(spec);
+            current = { name: alias?.name ?? first.name, version: "", registry, deps: [] };
+            for (const d of descriptors)
+                entries.set(d, current);
+            continue;
+        }
+        if (!current)
+            continue;
+        if (indent === 2) {
+            inDeps = body === "dependencies:" || body === "optionalDependencies:";
+            const m = /^(\S+)\s+(.*)$/.exec(body);
+            if (m && m[1] === "version")
+                current.version = unquote(m[2]);
+            if (m && m[1] === "resolved" && /^"?(git|file:|link:)|codeload\.github\.com|\.git(#|"?$)/.test(m[2]))
+                current.registry = false;
+            continue;
+        }
+        if (indent >= 4 && inDeps) {
+            const m = /^("(?:[^"\\]|\\.)*"|\S+)\s+(.*)$/.exec(body);
+            if (m)
+                current.deps.push([unquote(m[1]), unquote(m[2])]);
+        }
+    }
+    return collect(entries, manifest, (name, spec) => `${name}@${spec}`);
+}
+// ---------- berry (v2+) ----------
+function parseBerry(text, manifest) {
+    const doc = parseYamlDocuments(text)[0];
+    if (!doc)
+        throw new Error("empty yarn.lock");
+    const entries = new Map();
+    for (const [key, value] of Object.entries(doc)) {
+        if (key === "__metadata" || !isMap(value))
+            continue;
+        const resolution = typeof value.resolution === "string" ? value.resolution : "";
+        let resolved = splitNameAt(resolution);
+        let registry = false;
+        if (resolved?.version.startsWith("npm:")) {
+            registry = true;
+            resolved = { name: resolved.name, version: resolved.version.slice(4) };
+        }
+        else if (resolved?.version.startsWith("patch:")) {
+            // "name@patch:name@npm%3A1.2.3#..." -> the patched npm package
+            const inner = splitNameAt(decodeURIComponent(resolved.version.slice(6).split("#")[0]));
+            if (inner?.version.startsWith("npm:")) {
+                registry = true;
+                resolved = { name: inner.name, version: inner.version.slice(4) };
+            }
+        }
+        const deps = [];
+        for (const field of ["dependencies", "optionalDependencies"]) {
+            const d = value[field];
+            if (isMap(d))
+                for (const [n, s] of Object.entries(d))
+                    if (typeof s === "string")
+                        deps.push([n, s]);
+        }
+        const entry = { name: resolved?.name ?? key, version: resolved?.version ?? "", registry, deps };
+        const isWorkspace = /@workspace:/.test(resolution);
+        for (const d of key.split(/,\s*/))
+            entries.set(d.trim(), entry);
+        if (isWorkspace)
+            entries.set(`__workspace__:${key}`, { ...entry, registry: false });
+    }
+    // Berry descriptors always carry a protocol; manifest ranges without one mean npm:.
+    const descriptor = (name, spec) => `${name}@${/^[a-z]+:/.test(spec) ? spec : `npm:${spec}`}`;
+    return collect(new Map([...entries].filter(([k, e]) => !k.startsWith("__workspace__:") && !(e.version === "0.0.0-use.local"))), manifest, descriptor);
+}
+export function parseYarnLockfile(text, manifest) {
+    if (/^__metadata:/m.test(text))
+        return parseBerry(text, manifest);
+    if (/^# yarn lockfile v1/m.test(text) || /^\S.*:\n {2}version "/m.test(text))
+        return parseClassic(text, manifest);
+    throw new Error("unrecognized yarn.lock format");
+}

package/dist/match.js

@@ -0,0 +1,81 @@
+import { compareParsed, parse } from "./semver.js";
+export const SEVERITY_ORDER = ["malicious", "critical", "high", "moderate", "low", "unknown"];
+export function severityRank(s) {
+    return SEVERITY_ORDER.indexOf(s);
+}
+export function severityOf(vuln) {
+    if (vuln.id.startsWith("MAL-") || vuln.aliases?.some((a) => a.startsWith("MAL-")))
+        return "malicious";
+    const raw = vuln.database_specific?.severity;
+    switch (typeof raw === "string" ? raw.toUpperCase() : "") {
+        case "CRITICAL":
+            return "critical";
+        case "HIGH":
+            return "high";
+        case "MODERATE":
+        case "MEDIUM":
+            return "moderate";
+        case "LOW":
+            return "low";
+        default:
+            return "unknown";
+    }
+}
+const ZERO = { major: 0, minor: 0, patch: 0, pre: [] };
+function eventVersion(e) {
+    const v = e.introduced ?? e.fixed ?? e.last_affected ?? e.limit;
+    if (v === undefined)
+        return null;
+    if (e.introduced === "0")
+        return { ...ZERO, pre: [0] }; // lower than anything, incl. 0.0.0-x
+    return parse(v);
+}
+export function evaluate(vuln, name, version) {
+    const v = parse(version);
+    if (!v)
+        return { affected: false };
+    let affected = false;
+    const fixes = [];
+    for (const aff of vuln.affected ?? []) {
+        if (aff.package?.ecosystem !== "npm" || aff.package?.name !== name)
+            continue;
+        if (Array.isArray(aff.versions) && aff.versions.includes(version))
+            affected = true;
+        for (const range of aff.ranges ?? []) {
+            if (range.type !== "SEMVER" && range.type !== "ECOSYSTEM")
+                continue;
+            const events = (range.events ?? [])
+                .map((e) => ({ e, sv: eventVersion(e) }))
+                .filter((x) => x.sv !== null)
+                .sort((a, b) => compareParsed(a.sv, b.sv));
+            let inRange = false;
+            for (const { e, sv } of events) {
+                const c = compareParsed(v, sv);
+                if (e.introduced !== undefined) {
+                    if (c >= 0)
+                        inRange = true;
+                }
+                else if (e.fixed !== undefined) {
+                    if (c >= 0)
+                        inRange = false;
+                    else
+                        fixes.push({ raw: e.fixed, sv });
+                }
+                else if (e.last_affected !== undefined) {
+                    if (c > 0)
+                        inRange = false;
+                }
+                else if (e.limit !== undefined) {
+                    if (c >= 0)
+                        inRange = false;
+                }
+            }
+            if (inRange)
+                affected = true;
+        }
+    }
+    if (!affected)
+        return { affected };
+    fixes.sort((a, b) => compareParsed(a.sv, b.sv));
+    return fixes[0] ? { affected, fixedIn: fixes[0].raw } : { affected };
+}