shippingszn 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/checks/headers.js +89 -33
- package/dist/index.js +1 -1
- package/package.json +1 -1
package/dist/checks/headers.js
CHANGED
|
@@ -7,48 +7,104 @@ const SECURITY_HEADER_NAMES = [
|
|
|
7
7
|
"X-Frame-Options",
|
|
8
8
|
"Referrer-Policy",
|
|
9
9
|
];
|
|
10
|
+
const CANDIDATE_EXTENSIONS = new Set([
|
|
11
|
+
".ts",
|
|
12
|
+
".tsx",
|
|
13
|
+
".js",
|
|
14
|
+
".jsx",
|
|
15
|
+
".mjs",
|
|
16
|
+
".cjs",
|
|
17
|
+
".mts",
|
|
18
|
+
".cts",
|
|
19
|
+
".json",
|
|
20
|
+
".toml",
|
|
21
|
+
]);
|
|
22
|
+
const CANDIDATE_BASENAMES = new Set([
|
|
23
|
+
"vite.config.ts",
|
|
24
|
+
"vite.config.js",
|
|
25
|
+
"vite.config.mjs",
|
|
26
|
+
"vite.config.cjs",
|
|
27
|
+
"next.config.js",
|
|
28
|
+
"next.config.mjs",
|
|
29
|
+
"next.config.ts",
|
|
30
|
+
"nuxt.config.ts",
|
|
31
|
+
"svelte.config.js",
|
|
32
|
+
"astro.config.mjs",
|
|
33
|
+
"astro.config.ts",
|
|
34
|
+
"vercel.json",
|
|
35
|
+
"netlify.toml",
|
|
36
|
+
]);
|
|
37
|
+
// Directories whose files commonly define server / middleware / route /
|
|
38
|
+
// header code. We scan every eligible file under these trees, not just a
|
|
39
|
+
// single "entry" file, so hand-rolled security-header middleware (e.g.
|
|
40
|
+
// a dedicated server/security.ts) is detected just as reliably as helmet().
|
|
41
|
+
const CANDIDATE_DIR_SEGMENTS = [
|
|
42
|
+
"server/",
|
|
43
|
+
"api/",
|
|
44
|
+
"backend/",
|
|
45
|
+
"middleware/",
|
|
46
|
+
"middlewares/",
|
|
47
|
+
"lib/server/",
|
|
48
|
+
"src/server/",
|
|
49
|
+
"src/api/",
|
|
50
|
+
"src/middleware/",
|
|
51
|
+
"src/middlewares/",
|
|
52
|
+
"apps/server/",
|
|
53
|
+
"apps/api/",
|
|
54
|
+
"packages/server/",
|
|
55
|
+
"packages/api/",
|
|
56
|
+
"artifacts/server/",
|
|
57
|
+
"artifacts/api-server/",
|
|
58
|
+
];
|
|
59
|
+
function isCandidateFile(relPath) {
|
|
60
|
+
const lower = relPath.replace(/\\/g, "/").toLowerCase();
|
|
61
|
+
if (lower.includes("/node_modules/") ||
|
|
62
|
+
lower.includes("/dist/") ||
|
|
63
|
+
lower.includes("/build/") ||
|
|
64
|
+
lower.includes("/.next/") ||
|
|
65
|
+
lower.endsWith(".test.ts") ||
|
|
66
|
+
lower.endsWith(".spec.ts") ||
|
|
67
|
+
lower.endsWith(".test.tsx") ||
|
|
68
|
+
lower.endsWith(".spec.tsx") ||
|
|
69
|
+
lower.endsWith(".test.js") ||
|
|
70
|
+
lower.endsWith(".spec.js")) {
|
|
71
|
+
return false;
|
|
72
|
+
}
|
|
73
|
+
const base = path.basename(lower);
|
|
74
|
+
if (CANDIDATE_BASENAMES.has(base))
|
|
75
|
+
return true;
|
|
76
|
+
const ext = path.extname(lower);
|
|
77
|
+
if (!CANDIDATE_EXTENSIONS.has(ext))
|
|
78
|
+
return false;
|
|
79
|
+
if (/\b(?:server|index|app|main|bootstrap|middleware|security)\.(?:t|j|m|c)?sx?$/.test(base)) {
|
|
80
|
+
return true;
|
|
81
|
+
}
|
|
82
|
+
for (const seg of CANDIDATE_DIR_SEGMENTS) {
|
|
83
|
+
if (lower.includes("/" + seg) || lower.startsWith(seg))
|
|
84
|
+
return true;
|
|
85
|
+
}
|
|
86
|
+
return false;
|
|
87
|
+
}
|
|
10
88
|
export async function checkSecurityHeaders(ctx) {
|
|
11
|
-
const
|
|
12
|
-
|
|
13
|
-
if (rp.endsWith(".test.ts") || rp.endsWith(".spec.ts"))
|
|
14
|
-
return false;
|
|
15
|
-
return (rp.endsWith("vite.config.ts") ||
|
|
16
|
-
rp.endsWith("vite.config.js") ||
|
|
17
|
-
rp.endsWith("next.config.js") ||
|
|
18
|
-
rp.endsWith("next.config.mjs") ||
|
|
19
|
-
rp.endsWith("next.config.ts") ||
|
|
20
|
-
rp.endsWith("nuxt.config.ts") ||
|
|
21
|
-
rp.endsWith("svelte.config.js") ||
|
|
22
|
-
rp.endsWith("astro.config.mjs") ||
|
|
23
|
-
rp.endsWith("astro.config.ts") ||
|
|
24
|
-
rp.endsWith("vercel.json") ||
|
|
25
|
-
rp.endsWith("netlify.toml") ||
|
|
26
|
-
/server\/index\.(t|j)s$/.test(rp) ||
|
|
27
|
-
/^server\.(t|j)s$/.test(path.basename(rp)) ||
|
|
28
|
-
/\bapp\.(t|j)s$/.test(rp) ||
|
|
29
|
-
/\bindex\.(t|j)s$/.test(rp));
|
|
30
|
-
});
|
|
31
|
-
if (candidateFiles.length === 0)
|
|
89
|
+
const candidates = ctx.files.filter((f) => isCandidateFile(f.relPath));
|
|
90
|
+
if (candidates.length === 0)
|
|
32
91
|
return [];
|
|
33
|
-
|
|
34
|
-
for (const file of candidateFiles) {
|
|
92
|
+
for (const file of candidates) {
|
|
35
93
|
const content = await readFileSafe(file);
|
|
36
94
|
if (!content)
|
|
37
95
|
continue;
|
|
96
|
+
const lower = content.toLowerCase();
|
|
38
97
|
for (const h of SECURITY_HEADER_NAMES) {
|
|
39
|
-
if (
|
|
40
|
-
|
|
41
|
-
break;
|
|
42
|
-
}
|
|
98
|
+
if (lower.includes(h.toLowerCase()))
|
|
99
|
+
return [];
|
|
43
100
|
}
|
|
44
|
-
if (
|
|
45
|
-
|
|
101
|
+
if (lower.includes("helmet(") ||
|
|
102
|
+
lower.includes('require("helmet")') ||
|
|
103
|
+
lower.includes('from "helmet"') ||
|
|
104
|
+
lower.includes("from 'helmet'")) {
|
|
105
|
+
return [];
|
|
46
106
|
}
|
|
47
|
-
if (foundAny)
|
|
48
|
-
break;
|
|
49
107
|
}
|
|
50
|
-
if (foundAny)
|
|
51
|
-
return [];
|
|
52
108
|
return [
|
|
53
109
|
{
|
|
54
110
|
checkId: "missing-security-headers",
|
package/dist/index.js
CHANGED
package/package.json
CHANGED