spectrum-cli 5.0.2 → 5.1.0

package/src/security/runtime.js

@@ -0,0 +1,192 @@
+const io = require("../automation");
+const { fs, path, ensure, json, exec, request, sleep, temporary } = io;
+const { encoded } = require("../sbom/schema");
+function cleanEnv(env = process.env) {
+  return Object.fromEntries(
+    Object.entries(env).filter(
+      ([key]) =>
+        !/TOKEN|PASSWORD|SECRET|MATTERMOST|AUTHFILE/i.test(key) &&
+        !/^(GIT_CONFIG_|CI_|GLAB_|GITLAB_|YOUTRACK_|MATTERMOST_|NEXUS_)/.test(
+          key,
+        ) &&
+        (!key.startsWith("TRIVY_") ||
+          [
+            "TRIVY_DB_REPOSITORY",
+            "TRIVY_JAVA_DB_REPOSITORY",
+            "TRIVY_CACHE_DIR",
+          ].includes(key)),
+    ),
+  );
+}
+function run(args, cwd, options = {}, env = process.env) {
+  const clean = cleanEnv(env);
+  if (args[0] === "npm")
+    for (const key of ["NPM_TOKEN", "NODE_AUTH_TOKEN"])
+      if (env[key]) clean[key] = env[key];
+  return exec(args, { cwd, ...options, env: clean });
+}
+async function registryAuth(env, action) {
+  return temporary("nightly-registry-", async (directory) => {
+    const auths = {};
+    ensure(
+      Boolean(env.NEXUS_USER) === Boolean(env.NEXUS_PASSWORD),
+      "Configure both NEXUS_USER and NEXUS_PASSWORD",
+    );
+    if (env.NEXUS_USER && env.NEXUS_PASSWORD) {
+      ensure(
+        env.NIGHTLY_REGISTRY_HOSTS?.trim(),
+        "NIGHTLY_REGISTRY_HOSTS is required with registry credentials",
+      );
+      for (const host of env.NIGHTLY_REGISTRY_HOSTS.split(",")) {
+        ensure(
+          /^[a-zA-Z0-9.-]+(?::\d+)?(?![\s\S])/.test(host),
+          "Invalid registry hostname",
+        );
+        auths[host] = {
+          auth: Buffer.from(env.NEXUS_USER + ":" + env.NEXUS_PASSWORD).toString(
+            "base64",
+          ),
+        };
+      }
+    }
+    if (env.CI_REGISTRY_USER && env.CI_REGISTRY_PASSWORD)
+      auths[env.CI_REGISTRY] = {
+        auth: Buffer.from(
+          env.CI_REGISTRY_USER + ":" + env.CI_REGISTRY_PASSWORD,
+        ).toString("base64"),
+      };
+    const runtime = { ...env };
+    if (Object.keys(auths).length) {
+      const file = path.join(directory, "config.json");
+      fs.writeFileSync(file, JSON.stringify({ auths }), { mode: 0o600 });
+      runtime.DOCKER_CONFIG = directory;
+      runtime.REGISTRY_AUTH_FILE = file;
+    }
+    return action(runtime);
+  });
+}
+async function artifactRedirect(url, transport = request) {
+  for (let hop = 0; hop < 4; hop++) {
+    const parsed = new URL(url);
+    ensure(
+      parsed.protocol === "https:" && !parsed.username && !parsed.password,
+      "Unsafe artifact redirect",
+    );
+    let res;
+    try {
+      res = await transport(url, {
+        headers: { "User-Agent": "nightly-security" },
+      });
+    } catch {
+      throw new Error("Artifact download connection failed");
+    }
+    if (
+      [301, 302, 303, 307, 308].includes(res.status) &&
+      res.headers.get("location")
+    ) {
+      url = new URL(res.headers.get("location"), url).href;
+      continue;
+    }
+    ensure(
+      res.status >= 200 && res.status < 300,
+      `Artifact download failed (HTTP ${res.status})`,
+    );
+    return res.body;
+  }
+  throw new Error("Too many artifact redirects");
+}
+class API {
+  constructor(base, headers = {}, transport = request, pause = sleep) {
+    const parsed = new URL(base);
+    ensure(
+      parsed.protocol === "https:" && !parsed.username && !parsed.password,
+      "HTTPS is required for API endpoints",
+    );
+    this.base = base.replace(/\/(?![\s\S])/, "");
+    this.headers = headers;
+    this.transport = transport;
+    this.pause = pause;
+  }
+  async request(method, location, data, { raw = false, query } = {}) {
+    let url = this.base + "/" + location.replace(/^\//, "");
+    if (query) url += "?" + new URLSearchParams(query);
+    const headers = {
+      Accept: "application/json",
+      "User-Agent": "nightly-security",
+      ...this.headers,
+    };
+    if (data !== undefined) headers["Content-Type"] = "application/json";
+    for (let attempt = 0; attempt < 3; attempt++) {
+      let res;
+      try {
+        res = await this.transport(url, {
+          method,
+          headers,
+          body: data === undefined ? undefined : JSON.stringify(data),
+        });
+      } catch {
+        throw new Error(`API ${method} connection failed`);
+      }
+      if (
+        method === "GET" &&
+        raw &&
+        [301, 302, 303, 307, 308].includes(res.status) &&
+        res.headers.get("location")
+      )
+        return artifactRedirect(
+          new URL(res.headers.get("location"), url).href,
+          this.transport,
+        );
+      if (
+        method === "GET" &&
+        [429, 502, 503, 504].includes(res.status) &&
+        attempt < 2
+      ) {
+        await this.pause(1000 * 2 ** attempt);
+        continue;
+      }
+      if (res.status < 200 || res.status >= 300) {
+        const error = new Error(`API ${method} failed (HTTP ${res.status})`);
+        error.status = res.status;
+        throw error;
+      }
+      return raw ? res.body : json(res.body.length ? res.body : "null");
+    }
+    throw new Error("API retries exhausted");
+  }
+  get(location, options) {
+    return this.request("GET", location, undefined, options);
+  }
+  post(location, data) {
+    return this.request("POST", location, data);
+  }
+}
+function glab(env = process.env) {
+  ensure(
+    env.CI_API_V4_URL && env.GLAB_BOT_PAT,
+    "GitLab API and GLAB_BOT_PAT are required",
+  );
+  return new API(env.CI_API_V4_URL, { "PRIVATE-TOKEN": env.GLAB_BOT_PAT });
+}
+const projectPath = (project) => "projects/" + encoded(String(project));
+async function pages(api, location, query = {}) {
+  const result = [];
+  for (let page = 1; ; page++) {
+    const batch = await api.get(location, {
+      query: { ...query, per_page: 100, page },
+    });
+    ensure(Array.isArray(batch), "Expected paginated API list");
+    result.push(...batch);
+    if (batch.length < 100) return result;
+  }
+}
+module.exports = {
+  cleanEnv,
+  run,
+  registryAuth,
+  artifactRedirect,
+  API,
+  glab,
+  projectPath,
+  pages,
+};

package/src/security/scan.js

@@ -0,0 +1,300 @@
+const {
+  fs,
+  path,
+  ensure,
+  read,
+  save,
+  json,
+  temporary,
+  repositoryPath,
+  DIGEST,
+} = require("../automation");
+const { run, API } = require("./runtime");
+const {
+  npmFindings,
+  trivyFindings,
+  nodeFindings,
+  mergeFindings,
+} = require("./findings");
+const { required, checkExecutables } = require("../preflight/automation");
+const { isDryRun, reportPreflight } = require("../cli/command-executor");
+const NODE_FEED = "nodejs/security-wg/main/vuln/core/index.json";
+function runtimeFromDockerfile(text) {
+  const args = {},
+    stages = {};
+  let last;
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    if (/^ARG /i.test(line) && !Object.keys(stages).length) {
+      const match = line.slice(4).match(/^([^=]+)(?:=(.*))?(?![\s\S])/);
+      args[match[1]] = (match[2] || "").replace(/^["']|["'](?![\s\S])/g, "");
+    }
+    if (!/^FROM /i.test(line)) continue;
+    // FROM accepts only literal images/aliases/global ARGs. No shell evaluation.
+    const parts =
+      line
+        .replace(/\s+#.*(?![\s\S])/, "")
+        .match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+    const offset = parts[1]?.startsWith("--platform=") ? 2 : 1;
+    let image = (parts[offset] || "")
+      .replace(/^["']|["'](?![\s\S])/g, "")
+      .replace(
+        /\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g,
+        (_, a, b) => args[a || b] ?? "$UNRESOLVED",
+      );
+    ensure(
+      image && !image.includes("$") && image !== "scratch",
+      "Runtime FROM cannot be resolved safely",
+    );
+    last = stages[image.toLowerCase()] || image;
+    const alias =
+      parts[offset + 1]?.toUpperCase() === "AS" && parts[offset + 2]
+        ? parts[offset + 2].toLowerCase()
+        : String(Object.keys(stages).length);
+    stages[alias] = last;
+  }
+  ensure(last, "No runtime FROM found");
+  return last;
+}
+class Scanner {
+  constructor(env = process.env, deps = {}) {
+    this.env = env;
+    this.deps = deps;
+  }
+  run(args, cwd, options) {
+    return (this.deps.run || run)(args, cwd, options, this.env);
+  }
+  async auditNpm(root, evidence) {
+    const proc = this.run(
+        ["npm", "audit", "--omit=dev", "--audit-level=high", "--json"],
+        root,
+        { allowed: [0, 1] },
+      ),
+      report = json(proc.stdout);
+    if (evidence) save(evidence, report);
+    const values = await npmFindings(report, this.deps.aliases);
+    ensure(
+      proc.status === 0 || values.length,
+      "npm audit failed without HIGH/CRITICAL findings",
+    );
+    return [report, values];
+  }
+  immutableImage(image) {
+    const digest = this.run([
+      "skopeo",
+      "inspect",
+      "--format",
+      "{{.Digest}}",
+      "docker://" + image,
+    ]).stdout.trim();
+    ensure(DIGEST.test(digest), "Registry did not return an image digest");
+    return image.split("@")[0] + "@" + digest;
+  }
+  nodeVersion(image, platform) {
+    const container = this.run([
+      "buildah",
+      "from",
+      "--platform",
+      platform,
+      image,
+    ]).stdout.trim();
+    try {
+      const value = this.run([
+        "buildah",
+        "run",
+        "--isolation=chroot",
+        container,
+        "--",
+        this.env.NIGHTLY_NODE_BINARY || "/nodejs/bin/node",
+        "--version",
+      ])
+        .stdout.trim()
+        .replace(/^v/, "");
+      ensure(
+        /^\d+\.\d+\.\d+(?![\s\S])/.test(value),
+        "Cannot determine runtime Node.js version",
+      );
+      return value;
+    } finally {
+      this.run(["buildah", "rm", container]);
+    }
+  }
+  async feed() {
+    return this.deps.feed
+      ? this.deps.feed()
+      : new API("https://raw.githubusercontent.com").get(NODE_FEED);
+  }
+  async scanImage(image, platform, feed) {
+    ensure(
+      ["linux/amd64", "linux/arm64"].includes(platform),
+      "Unsupported runtime platform",
+    );
+    const report = await temporary("nightly-trivy-", async (dir) => {
+      const filename = path.join(dir, "report.json");
+      this.run([
+        "trivy",
+        "image",
+        "--scanners",
+        "vuln",
+        "--severity",
+        "HIGH,CRITICAL",
+        "--skip-db-update=false",
+        "--ignore-unfixed=false",
+        "--ignorefile",
+        "/dev/null",
+        "--config",
+        "/dev/null",
+        "--platform",
+        platform,
+        "--format",
+        "json",
+        "--output",
+        filename,
+        image,
+      ]);
+      return read(filename);
+    });
+    const values = trivyFindings(report);
+    let version = null;
+    if ((this.env.NIGHTLY_CHECK_NODE || "true") === "true") {
+      version = this.nodeVersion(image, platform);
+      feed = feed || (await this.feed());
+      ensure(
+        feed && Object.keys(feed).length,
+        "Empty Node.js vulnerability feed",
+      );
+      values.push(...nodeFindings(version, feed));
+    }
+    return [report, mergeFindings(values), version];
+  }
+  config() {
+    const e = this.env;
+    for (const key of [
+      "CI_PROJECT_ID",
+      "CI_PROJECT_PATH",
+      "CI_COMMIT_SHA",
+      "CI_PIPELINE_ID",
+      "CI_PIPELINE_URL",
+      "CI_JOB_ID",
+    ])
+      ensure(e[key], key + " is required");
+    return {
+      project_id: e.CI_PROJECT_ID,
+      project_path: e.CI_PROJECT_PATH,
+      sha: e.CI_COMMIT_SHA,
+      branch: e.NIGHTLY_MAIN_BRANCH || "master",
+      youtrack_project: e.NIGHTLY_YOUTRACK_PROJECT || "",
+      subsystem: e.NIGHTLY_YOUTRACK_SUBSYSTEM || "",
+      time_article: e.NIGHTLY_YOUTRACK_TIME_TRACKING_ARTICLE || "",
+      tester: e.NIGHTLY_YOUTRACK_TESTER || "",
+      pipeline_id: e.CI_PIPELINE_ID,
+      pipeline_url: e.CI_PIPELINE_URL,
+    };
+  }
+  async preflight(root) {
+    this.config();
+    required(this.env, [
+      "NIGHTLY_YOUTRACK_PROJECT",
+      "NIGHTLY_YOUTRACK_TIME_TRACKING_ARTICLE",
+      "NIGHTLY_YOUTRACK_TESTER",
+    ]);
+    const tools = ["trivy", "skopeo"];
+    if ((this.env.NIGHTLY_NPM_ENABLED || "true") === "true") {
+      ensure(
+        fs.statSync(repositoryPath(root, "package-lock.json")).isFile(),
+        "package-lock.json is required",
+      );
+      read(repositoryPath(root, "package-lock.json"));
+      tools.push("npm");
+    }
+    if ((this.env.NIGHTLY_CHECK_NODE || "true") === "true")
+      tools.push("buildah");
+    (this.deps.checkExecutables || checkExecutables)(tools, this.env);
+    const platforms = (this.env.NIGHTLY_PLATFORMS || "linux/amd64").split(",");
+    ensure(
+      platforms.length &&
+        platforms.every((platform) =>
+          ["linux/amd64", "linux/arm64"].includes(platform),
+        ),
+      "Unsupported runtime platform",
+    );
+    const dockerfile = repositoryPath(
+      root,
+      this.env.NIGHTLY_DOCKERFILE || "build/Dockerfile",
+    );
+    this.immutableImage(
+      runtimeFromDockerfile(fs.readFileSync(dockerfile, "utf8")),
+    );
+    reportPreflight(
+      "security scan",
+      "scan-inputs",
+      "проверены настройки, файлы, инструменты и доступ к runtime-образу",
+    );
+  }
+  async scan(root = process.cwd(), { dry = isDryRun() } = {}) {
+    if (dry) {
+      await this.preflight(root);
+      return 0;
+    }
+    const output = path.join(root, "security-report"),
+      report = {
+        schemaVersion: 1,
+        config: this.config(),
+        findings: [],
+        errors: [],
+        runtime: {},
+      };
+    try {
+      required(this.env, [
+        "NIGHTLY_YOUTRACK_PROJECT",
+        "NIGHTLY_YOUTRACK_TIME_TRACKING_ARTICLE",
+        "NIGHTLY_YOUTRACK_TESTER",
+      ]);
+      if ((this.env.NIGHTLY_NPM_ENABLED || "true") === "true") {
+        try {
+          ensure(
+            fs.statSync(repositoryPath(root, "package-lock.json")).isFile(),
+            "package-lock.json is required",
+          );
+          const [, values] = await this.auditNpm(
+            root,
+            path.join(output, "npm.json"),
+          );
+          report.findings.push(...values);
+        } catch (error) {
+          report.errors.push("npm: " + error.message);
+        }
+      }
+      try {
+        const dockerfile = this.env.NIGHTLY_DOCKERFILE || "build/Dockerfile",
+          image = this.immutableImage(
+            runtimeFromDockerfile(
+              fs.readFileSync(repositoryPath(root, dockerfile), "utf8"),
+            ),
+          ),
+          platforms = (this.env.NIGHTLY_PLATFORMS || "linux/amd64").split(",");
+        report.runtime = { image, dockerfile, platforms };
+        for (const [index, platform] of platforms.entries()) {
+          const [raw, values, version] = await this.scanImage(image, platform);
+          save(path.join(output, `runtime-${index}.json`), raw);
+          report.runtime[platform] = { node: version };
+          report.findings.push(...values);
+        }
+      } catch (error) {
+        report.errors.push("runtime: " + error.message);
+      }
+    } catch (error) {
+      report.errors.push(error.message);
+    } finally {
+      report.findings = mergeFindings(report.findings);
+      save(path.join(output, "findings.json"), report);
+      fs.writeFileSync(
+        path.join(output, "scan.env"),
+        "NIGHTLY_SCAN_JOB_ID=" + this.env.CI_JOB_ID + "\n",
+      );
+    }
+    return report.errors.length ? 1 : 0;
+  }
+}
+module.exports = { Scanner, runtimeFromDockerfile, NODE_FEED };