srclawyer 0.6.1 → 0.6.2

package/dist/engine/workspacePatterns.js

@@ -0,0 +1,140 @@
+/**
+ * Validation for workspace glob patterns read from a SCANNED repo's own package.json -- i.e. input an
+ * attacker controls whenever the repo being scanned isn't the user's own. Brace expansion in glob
+ * libraries can be driven to stack overflow, memory exhaustion, or minutes of CPU by very short
+ * patterns (a 37-character `{1..300}{1..300}{1..300}` is enough), so patterns are bounded here before
+ * they ever reach a glob library. Real workspace patterns (`packages/*`, `{apps,packages}/*`,
+ * `tools/*\/packages/*`) are tens of characters with at most one small brace group.
+ */
+export const MAX_WORKSPACE_PATTERNS = 100;
+export const MAX_PATTERN_LENGTH = 200;
+export const MAX_BRACE_DEPTH = 2;
+export const MAX_BRACE_GROUPS = 3;
+export const MAX_BRACE_EXPANSION = 64;
+export const MAX_RANGE_SPAN = 100;
+const NUMERIC_RANGE = /^(-?\d+)\.\.(-?\d+)(?:\.\.(-?\d+))?$/;
+const ALPHA_RANGE = /^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/;
+/** Upper bound on how many strings a brace-bearing segment expands to; null if malformed or too wide. */
+function estimateExpansion(segment) {
+    let total = 1;
+    let i = 0;
+    while (i < segment.length) {
+        if (segment[i] === "}")
+            return null;
+        if (segment[i] !== "{") {
+            i += 1;
+            continue;
+        }
+        let depth = 1;
+        let j = i + 1;
+        while (j < segment.length && depth > 0) {
+            if (segment[j] === "{")
+                depth += 1;
+            else if (segment[j] === "}")
+                depth -= 1;
+            j += 1;
+        }
+        if (depth !== 0)
+            return null;
+        const inner = segment.slice(i + 1, j - 1);
+        const groupEstimate = estimateGroup(inner);
+        if (groupEstimate === null)
+            return null;
+        total *= groupEstimate;
+        if (total > MAX_BRACE_EXPANSION)
+            return null;
+        i = j;
+    }
+    return total;
+}
+function estimateGroup(inner) {
+    const numeric = NUMERIC_RANGE.exec(inner);
+    if (numeric) {
+        const span = Math.abs(Number(numeric[2]) - Number(numeric[1])) + 1;
+        const step = Math.abs(Number(numeric[3] ?? 1)) || 1;
+        return span > MAX_RANGE_SPAN ? null : Math.ceil(span / step);
+    }
+    if (ALPHA_RANGE.test(inner))
+        return 52;
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    for (let k = 0; k < inner.length; k++) {
+        if (inner[k] === "{")
+            depth += 1;
+        else if (inner[k] === "}")
+            depth -= 1;
+        else if (inner[k] === "," && depth === 0) {
+            parts.push(inner.slice(start, k));
+            start = k + 1;
+        }
+    }
+    parts.push(inner.slice(start));
+    let sum = 0;
+    for (const part of parts) {
+        const estimate = estimateExpansion(part);
+        if (estimate === null)
+            return null;
+        sum += estimate;
+    }
+    return sum;
+}
+function braceShapeProblem(pattern) {
+    let depth = 0;
+    let maxDepth = 0;
+    let groups = 0;
+    for (const ch of pattern) {
+        if (ch === "{") {
+            depth += 1;
+            groups += 1;
+            maxDepth = Math.max(maxDepth, depth);
+        }
+        else if (ch === "}") {
+            depth -= 1;
+            if (depth < 0)
+                return "unbalanced braces";
+        }
+    }
+    if (depth !== 0)
+        return "unbalanced braces";
+    if (maxDepth > MAX_BRACE_DEPTH)
+        return `brace nesting deeper than ${MAX_BRACE_DEPTH}`;
+    if (groups > MAX_BRACE_GROUPS)
+        return `more than ${MAX_BRACE_GROUPS} brace groups`;
+    if (estimateExpansion(pattern) === null)
+        return `brace expansion wider than ${MAX_BRACE_EXPANSION} alternatives`;
+    return null;
+}
+function patternProblem(pattern) {
+    if (typeof pattern !== "string")
+        return "an entry is not a string";
+    if (pattern.length === 0)
+        return "an entry is empty";
+    if (pattern.length > MAX_PATTERN_LENGTH)
+        return `an entry is longer than ${MAX_PATTERN_LENGTH} characters`;
+    if (pattern.includes("\0"))
+        return "an entry contains a NUL character";
+    if (pattern.includes("\\"))
+        return "an entry contains a backslash";
+    const body = pattern.startsWith("!") ? pattern.slice(1) : pattern;
+    if (body.startsWith("!"))
+        return "an entry has more than one leading '!'";
+    if (body.startsWith("/") || /^[A-Za-z]:/.test(body))
+        return "an entry is an absolute path";
+    if (body.split("/").includes(".."))
+        return "an entry escapes the repo root with '..'";
+    return braceShapeProblem(body);
+}
+/** `raw` is whatever package.json's `workspaces` (or `workspaces.packages`) held, unvalidated. */
+export function validateWorkspacePatterns(raw) {
+    if (!Array.isArray(raw))
+        return { ok: false, reason: "workspaces is not an array of patterns" };
+    if (raw.length > MAX_WORKSPACE_PATTERNS)
+        return { ok: false, reason: `more than ${MAX_WORKSPACE_PATTERNS} workspace patterns` };
+    for (const pattern of raw) {
+        const problem = patternProblem(pattern);
+        if (problem)
+            return { ok: false, reason: problem };
+    }
+    return { ok: true, patterns: raw };
+}

package/dist/policy/generatePolicy.js

@@ -108,6 +108,17 @@ function renderUnsupportedStackWarning(warning) {
 function renderProtectedLogicWarning(warning) {
     return ["> **WARNING: PROTECTED-LOGIC SERVICE UNAVAILABLE — POLICY MAY BE INCOMPLETE**", ">", `> ${warning}`].join("\n");
 }
+// Same reasoning as the other warning banners: the policy file is committed and shared without the
+// console output, and a rejected workspace config means packages outside the default locations were
+// never scanned.
+function renderWorkspaceWarning(warning) {
+    return ["> **WARNING: WORKSPACE CONFIGURATION REJECTED — SCAN MAY BE INCOMPLETE**", ">", `> ${warning}`].join("\n");
+}
+// Same reasoning as the other banners: files skipped for size mean findings in them are missing from
+// a policy file that will be committed and shared without the console output.
+function renderSkippedFilesWarning(warning) {
+    return ["> **WARNING: FILES SKIPPED OR NOT ANALYZED — SCAN INCOMPLETE**", ">", `> ${warning}`].join("\n");
+}
 function placeholder(label) {
     return `[TO COMPLETE: ${label}]`;
 }
@@ -154,16 +165,22 @@ function renderIdentitySection(config, placeholders) {
 // can simultaneously list detected third-party integrations (e.g. Stripe) in the Third-Party Data
 // Processors section above. These sentences deliberately (1) use CCPA/CPRA's own defined terms rather
 // than casual language, (2) frame the statement as the user's own self-declared setup answer, not a
-// legal conclusion drawn by this tool, and (3) always close with an explicit cross-reference back to
-// the detected-processors section, in all three states (true/false/placeholder), so the two sections
-// are never read in isolation from each other. See docs/legal-wording-review.md -- this is drafted,
+// legal conclusion drawn by this tool, and (3) close with a cross-reference back to the
+// detected-processors section, in all three states (true/false/placeholder), so the two sections are
+// never read in isolation from each other -- EXCEPT that the cross-reference only names that section
+// when it actually exists in this document (hasProcessorSection); otherwise it would point at a
+// heading that was never rendered, whether because nothing was detected or because detection itself
+// was incomplete (unsupported stack). See docs/legal-wording-review.md -- this is drafted,
 // attorney-reviewable starting wording, not settled language.
-function renderDataPracticesSection(config, placeholders) {
+function renderDataPracticesSection(config, placeholders, hasProcessorSection) {
     const retention = valueOrPlaceholder(config?.dataRetentionPolicy, "data retention period or policy", placeholders);
     const deletion = valueOrPlaceholder(config?.accountDeletionInstructions, "how a user can delete their account or request data deletion", placeholders);
     const sellShare = triStateSentence(config?.sellsOrSharesData, 'whether personal data is sold or shared with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA)', 'Based on information provided during setup, this product has been declared to sell or share personal data with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA).', 'Based on information provided during setup, this product has not been declared to sell or share personal data with third parties, as "sell" and "share" are defined under applicable law (e.g. CCPA/CPRA).', placeholders);
     const advertising = triStateSentence(config?.usesDataForAdvertising, "whether personal data is used for cross-context behavioral advertising", "Based on information provided during setup, this product has been declared to use personal data for cross-context behavioral advertising.", "Based on information provided during setup, this product has not been declared to use personal data for cross-context behavioral advertising.", placeholders);
     const aiServices = triStateSentence(config?.sendsDataToAiServices, "whether user data is sent to third-party AI services as part of this product's own functionality", "User data may be sent to third-party AI services as part of this product's own functionality.", "User data is not sent to third-party AI services as part of this product's own functionality.", placeholders);
+    const processorsCrossReference = hasProcessorSection
+        ? "See the Third-Party Data Processors section above for the specific third-party integrations detected in this codebase; the declarations above describe this product's own stated practices and do not override what was actually detected there."
+        : "This document does not include a Third-Party Data Processors section (none were detected, or detection may have been incomplete -- see any warning above); the declarations above describe this product's own stated practices only and do not override any third-party integrations this codebase may actually use.";
     return [
         "## Data Retention, Deletion, and Use",
         "",
@@ -171,7 +188,7 @@ function renderDataPracticesSection(config, placeholders) {
         `To delete your account or request deletion of your personal data: ${deletion}`,
         sellShare,
         advertising,
-        "See the Third-Party Data Processors section above for the specific third-party integrations detected in this codebase; the declarations above describe this product's own stated practices and do not override what was actually detected there.",
+        processorsCrossReference,
         aiServices,
     ].join("\n");
 }
@@ -228,17 +245,26 @@ export function generatePolicyMarkdown(result, config, llmError, protectedLogicW
     });
     const declinedFindings = result.findings.filter((f) => outcomeOf(f) === "declined");
     const reviewFindings = result.findings.filter((f) => outcomeOf(f) === "unresolved");
-    // Rendered first (before the final parts[] is assembled) so the shared placeholders array is fully
+    // Computed first so renderDataPracticesSection knows whether the Third-Party Data Processors
+    // section (rendered later, below) actually exists in this document before it cross-references it.
+    const processorSection = renderProcessorSection(confidentFindings);
+    // Rendered next (before the final parts[] is assembled) so the shared placeholders array is fully
     // populated in time for the top-of-document summary below.
     const placeholders = [];
     const identitySection = renderIdentitySection(config, placeholders);
-    const dataPracticesSection = renderDataPracticesSection(config, placeholders);
+    const dataPracticesSection = renderDataPracticesSection(config, placeholders, processorSection !== null);
     const rightsSection = renderRightsSection(config, placeholders);
     const childrensPrivacySection = renderChildrensPrivacySection(config, placeholders);
     const parts = ["# Privacy Policy", ""];
     if (result.unsupportedStackWarning) {
         parts.push(renderUnsupportedStackWarning(result.unsupportedStackWarning), "");
     }
+    if (result.workspaceWarning) {
+        parts.push(renderWorkspaceWarning(result.workspaceWarning), "");
+    }
+    if (result.skippedFilesWarning) {
+        parts.push(renderSkippedFilesWarning(result.skippedFilesWarning), "");
+    }
     if (protectedLogicWarning) {
         parts.push(renderProtectedLogicWarning(protectedLogicWarning), "");
     }
@@ -259,7 +285,6 @@ export function generatePolicyMarkdown(result, config, llmError, protectedLogicW
     else {
         parts.push("No data-collection patterns were confidently identified in this codebase.");
     }
-    const processorSection = renderProcessorSection(confidentFindings);
     if (processorSection) {
         parts.push("", processorSection);
     }

package/dist/report/formatText.js

@@ -8,7 +8,23 @@ export function formatText(result) {
         lines.push(BANNER_RULE);
         lines.push("");
     }
+    if (result.workspaceWarning) {
+        lines.push(BANNER_RULE);
+        lines.push("WARNING:");
+        lines.push(result.workspaceWarning);
+        lines.push(BANNER_RULE);
+        lines.push("");
+    }
+    if (result.skippedFilesWarning) {
+        lines.push(BANNER_RULE);
+        lines.push("WARNING:");
+        lines.push(result.skippedFilesWarning);
+        lines.push(BANNER_RULE);
+        lines.push("");
+    }
     lines.push(`Scanned ${result.filesScanned} file(s) across ${result.projects.length} project(s).`);
+    if (result.templateSyntaxNote)
+        lines.push(`Note: ${result.templateSyntaxNote}`);
     lines.push(`Found ${result.findings.length} finding(s), ${result.ambiguousCount} requiring review.`);
     lines.push("");
     const byProcessor = result.findings.filter((f) => f.processor);

package/dist/rules/htmlRules.d.ts

@@ -1,6 +1,17 @@
 import type { Finding } from "../engine/types.js";
+export declare const MAX_INLINE_SCRIPT_PADDING_CHARS = 16000000;
+export declare function findInputTags(html: string): Array<{
+    index: number;
+    tag: string;
+}>;
 export declare function runHtmlInputRules(html: string, filePath: string, root: string): Finding[];
 export interface ExtractedScript {
     code: string;
 }
+export interface InlineScriptExtraction {
+    scripts: ExtractedScript[];
+    /** Inline scripts not extracted because the padding budget ran out (see MAX_INLINE_SCRIPT_PADDING_CHARS). */
+    skippedCount: number;
+}
+export declare function extractInlineScriptsBounded(html: string): InlineScriptExtraction;
 export declare function extractInlineScripts(html: string): ExtractedScript[];

package/dist/rules/htmlRules.js

@@ -1,27 +1,65 @@
 import { relative } from "node:path";
 import { classifyFieldName } from "./dataCategoryLexicon.js";
 import { isSafeFieldName } from "./safeFieldNames.js";
-const INPUT_TAG_RE = /<input\b[^>]*>/gi;
-const SCRIPT_TAG_RE = /<script([^>]*)>([\s\S]*?)<\/script>/gi;
+// Tag matching is a start-anchor regex plus indexOf, not `<input\b[^>]*>` / `<script([^>]*)>([\s\S]*?)</script>`:
+// on a file full of unclosed tags those single regexes rescan to the end of the file from every start
+// (quadratic -- 200KB of "<input " took 8s), whereas this finds the same matches in one linear pass,
+// since a tag with no closing delimiter after one start can't have one after any later start either.
+const INPUT_START_RE = /<input\b/gi;
+const SCRIPT_START_RE = /<script/gi;
+const SCRIPT_CLOSE_RE = /<\/script>/gi;
+// Padding inline scripts with one "\n" per preceding line (so rule line numbers match the original
+// file) costs O(script count x line count) characters on a file with many scripts; this bounds the
+// total so a hostile file can't exhaust memory. Scripts past the budget are reported, never dropped
+// silently.
+export const MAX_INLINE_SCRIPT_PADDING_CHARS = 16_000_000;
 const NON_DATA_INPUT_TYPES = new Set(["submit", "button", "reset", "image"]);
 function getAttr(tag, name) {
     const match = new RegExp(`${name}\\s*=\\s*["']([^"']*)["']`, "i").exec(tag);
     return match ? match[1] : null;
 }
-function lineAt(html, index) {
-    return html.slice(0, index).split("\n").length;
+// 1-based line number of a character offset, via a one-time index of line starts and a binary search
+// (the previous slice-and-split per lookup was O(file size) each).
+function makeLineLookup(text) {
+    const lineStarts = [0];
+    for (let i = text.indexOf("\n"); i !== -1; i = text.indexOf("\n", i + 1))
+        lineStarts.push(i + 1);
+    return (index) => {
+        let lo = 0;
+        let hi = lineStarts.length - 1;
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (lineStarts[mid] <= index)
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        return lo + 1;
+    };
+}
+export function findInputTags(html) {
+    const tags = [];
+    const startRe = new RegExp(INPUT_START_RE.source, INPUT_START_RE.flags);
+    let match;
+    while ((match = startRe.exec(html))) {
+        const end = html.indexOf(">", match.index);
+        if (end === -1)
+            break;
+        startRe.lastIndex = end + 1;
+        tags.push({ index: match.index, tag: html.slice(match.index, end + 1) });
+    }
+    return tags;
 }
 export function runHtmlInputRules(html, filePath, root) {
     const relPath = relative(root, filePath);
     const findings = [];
-    let match;
-    while ((match = INPUT_TAG_RE.exec(html))) {
-        const tag = match[0];
+    const lineAt = makeLineLookup(html);
+    for (const { index, tag } of findInputTags(html)) {
         const type = (getAttr(tag, "type") ?? "text").toLowerCase();
         if (NON_DATA_INPUT_TYPES.has(type))
             continue;
         const identifier = getAttr(tag, "id") ?? getAttr(tag, "name");
-        const line = lineAt(html, match.index);
+        const line = lineAt(index);
         if (type === "password") {
             findings.push(makeFinding(relPath, line, tag, "authentication_credentials", "high", false, `<input type="password"> field collects a credential.`));
             continue;
@@ -56,20 +94,38 @@ function makeFinding(relPath, line, tag, category, confidence, requiresReview, d
         requiresReview,
     };
 }
-export function extractInlineScripts(html) {
+export function extractInlineScriptsBounded(html) {
     const scripts = [];
+    const lineAt = makeLineLookup(html);
+    const startRe = new RegExp(SCRIPT_START_RE.source, SCRIPT_START_RE.flags);
+    const closeRe = new RegExp(SCRIPT_CLOSE_RE.source, SCRIPT_CLOSE_RE.flags);
+    let paddingUsed = 0;
+    let skippedCount = 0;
     let match;
-    while ((match = SCRIPT_TAG_RE.exec(html))) {
-        const attrs = match[1];
+    while ((match = startRe.exec(html))) {
+        const openEnd = html.indexOf(">", match.index);
+        if (openEnd === -1)
+            break;
+        closeRe.lastIndex = openEnd + 1;
+        const close = closeRe.exec(html);
+        if (!close)
+            break;
+        startRe.lastIndex = close.index + close[0].length;
+        const attrs = html.slice(match.index + "<script".length, openEnd);
         if (/\bsrc\s*=/i.test(attrs))
             continue;
         if (/\btype\s*=\s*["'](?!(?:text\/javascript|module|application\/javascript)["'])[^"']*["']/i.test(attrs))
             continue;
-        const body = match[2];
-        const openTagLength = "<script".length + attrs.length + 1;
-        const contentStart = match.index + openTagLength;
-        const linesBefore = html.slice(0, contentStart).split("\n").length - 1;
-        scripts.push({ code: "\n".repeat(linesBefore) + body });
+        const linesBefore = lineAt(openEnd + 1) - 1;
+        if (paddingUsed + linesBefore > MAX_INLINE_SCRIPT_PADDING_CHARS) {
+            skippedCount += 1;
+            continue;
+        }
+        paddingUsed += linesBefore;
+        scripts.push({ code: "\n".repeat(linesBefore) + html.slice(openEnd + 1, close.index) });
     }
-    return scripts;
+    return { scripts, skippedCount };
+}
+export function extractInlineScripts(html) {
+    return extractInlineScriptsBounded(html).scripts;
 }

package/dist/rules/zodPreFilter.js

@@ -101,6 +101,15 @@ function findElidableInnerLines(file, rootRange, protectedLines) {
     });
     return elidable;
 }
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+// Whole-identifier match with explicit identifier-character boundaries, not `\b${name}\b`: `$` is a
+// legal identifier character but a regex anchor, and `\b` doesn't treat it as a word character, so the
+// old form silently never matched an import named like `$schema` and dropped it from the fragment.
+function mentionsIdentifier(text, name) {
+    return new RegExp(`(?<![\\w$])${escapeRegExp(name)}(?![\\w$])`).test(text);
+}
 function importedLocalNames(decl) {
     return decl.specifiers.map((spec) => spec.local.name);
 }
@@ -166,7 +175,7 @@ export function findZodCandidates(source, filePath, root) {
     for (const stmt of body) {
         if (stmt.type !== "ImportDeclaration")
             continue;
-        const referenced = importedLocalNames(stmt).some((name) => new RegExp(`\\b${name}\\b`).test(coreText));
+        const referenced = importedLocalNames(stmt).some((name) => mentionsIdentifier(coreText, name));
         if (referenced)
             includeRange(lineRange(stmt));
     }

package/dist/schemaParsers/openapi.d.ts

@@ -1,2 +1,7 @@
 import type { Finding } from "../engine/types.js";
-export declare function parseOpenApiSpec(filePath: string, root: string): Finding[];
+/** Set by parseOpenApiSpec so the caller can surface a malformed document instead of silently getting
+ *  fewer (or no) findings -- the YAML parser recovers from errors rather than throwing. */
+export interface OpenApiParseReport {
+    hadErrors: boolean;
+}
+export declare function parseOpenApiSpec(filePath: string, root: string, report?: OpenApiParseReport): Finding[];

package/dist/schemaParsers/openapi.js

@@ -3,10 +3,12 @@ import { relative } from "node:path";
 import { parseDocument, LineCounter, isMap, isPair, isScalar } from "yaml";
 import { classifyFieldName, isAmbiguousFieldName } from "../rules/dataCategoryLexicon.js";
 import { isSafeFieldName } from "../rules/safeFieldNames.js";
-export function parseOpenApiSpec(filePath, root) {
+export function parseOpenApiSpec(filePath, root, report) {
     const raw = readFileSync(filePath, "utf8");
     const lineCounter = new LineCounter();
     const doc = parseDocument(raw, { lineCounter, keepSourceTokens: true });
+    if (report && doc.errors.length > 0)
+        report.hadErrors = true;
     if (!doc.contents)
         return [];
     const relPath = relative(root, filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "srclawyer",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Static analysis engine that derives privacy policy documentation directly from source code",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -38,8 +38,8 @@
     "@babel/parser": "^7.25.6",
     "@babel/traverse": "^7.25.6",
     "commander": "^12.1.0",
-    "fast-glob": "^3.3.2",
     "js-yaml": "^4.1.0",
+    "tinyglobby": "^0.2.17",
     "typescript": "^5.6.2",
     "web-tree-sitter": "^0.27.0",
     "yaml": "^2.5.1"