weavatrix 0.1.1 → 0.1.3

package/src/security/malware-heuristics.sweep.js

@@ -1,122 +1,122 @@
-// Content sweeps for the malware scanner (split out of malware-heuristics.js): a ripgrep sweep
-// over all content roots when rg is available, else a bounded Node fallback over entry files.
-import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { runCommand } from "../process.js";
-import { CONTENT_RULES, classifyContent } from "./registry-sig.js";
-import { normPath } from "./malware-heuristics.exclusions.js";
-
-const SKIP_GLOBS = [
-  "!**/*.map", "!**/*.md", "!**/*.mdx", "!**/*.markdown", "!**/*.mdown", "!**/*.mkd", "!**/*.rst", "!**/*.d.ts",
-  "!**/doc/**", "!**/docs/**", "!**/documentation/**",
-  "!**/test/**", "!**/tests/**", "!**/__tests__/**", "!**/fixtures/**", "!**/example/**", "!**/examples/**"
-];
-
-function globalRuleRegex(rule) {
-  const flags = rule.re.flags.includes("g") ? rule.re.flags : `${rule.re.flags}g`;
-  return new RegExp(rule.re.source, flags);
-}
-
-function matchRuleOffsets(rule, lineText, subText = "") {
-  const text = String(lineText || "");
-  if (text) {
-    const offsets = [];
-    const re = globalRuleRegex(rule);
-    let guard = 0;
-    let m;
-    while ((m = re.exec(text)) && guard++ < 24) {
-      offsets.push(m.index);
-      if (!m[0].length) re.lastIndex++;
-    }
-    if (!offsets.length && rule.key === "obfuscated-code") {
-      const at = subText ? text.indexOf(subText) : 0;
-      if (at >= 0) offsets.push(at);
-    }
-    return offsets;
-  }
-  if (subText && (rule.key === "obfuscated-code" || rule.re.test(subText))) return [0];
-  return [];
-}
-
-function rootOfFile(file, roots) {
-  const f = normPath(file).toLowerCase();
-  return roots.find((r) => {
-    const root = normPath(r.root).toLowerCase();
-    return f === root || f.startsWith(`${root}/`);
-  });
-}
-
-function chunks(list, size) {
-  const out = [];
-  for (let i = 0; i < list.length; i += size) out.push(list.slice(i, i + size));
-  return out;
-}
-
-export async function rgSweep(rg, contentRoots, timeoutMs) {
-  const hits = []; // {pkg, file, line, text, rule}
-  let errored = 0; // a failed/broken rule must not masquerade as "scanned, 0 hits"
-  let total = 0;
-  for (const rule of CONTENT_RULES) {
-    for (const group of chunks(contentRoots, 40)) {
-      total++;
-      const args = ["--json", "-i", "--no-ignore", "--hidden", "--follow", "--max-filesize", "2M", "--max-count", "20", ...SKIP_GLOBS.flatMap((g) => ["-g", g]), "-e", rule.pattern, "--", ...group.map((r) => r.root)];
-      let r;
-      try { r = await runCommand(rg, args, { timeoutMs }); } catch { errored++; continue; }
-      if (r.exitCode === 2 && !String(r.stdout || "").trim()) { errored++; continue; }
-      for (const line of String(r.stdout || "").split(/\r?\n/)) {
-        if (!line) continue;
-        let obj; try { obj = JSON.parse(line); } catch { continue; }
-        if (obj.type !== "match") continue;
-        const file = obj.data?.path?.text || "";
-        const root = rootOfFile(file, group);
-        const pkg = root?.pathToPkg(file) || "";
-        if (!pkg) continue;
-        const lineText = String(obj.data?.lines?.text || "");
-        const subText = String(obj.data?.submatches?.[0]?.match?.text || "");
-        for (const at of matchRuleOffsets(rule, lineText, subText)) {
-          const text = (lineText ? lineText.slice(Math.max(0, at - 60), at + 180) : subText).trim().slice(0, 240);
-          hits.push({ pkg, file, line: obj.data?.line_number || 0, text, rule });
-        }
-      }
-    }
-  }
-  return { hits, errored, total };
-}
-
-// no-rg fallback: each package's package.json main/bin entries + root JS files, bounded
-export function nodeSweep(nmDir, pkgDirs, capFiles = 3000) {
-  const hits = [];
-  let seenFiles = 0;
-  for (const { pkg, dir } of pkgDirs) {
-    if (seenFiles >= capFiles) break;
-    let pj = null;
-    try { pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")); } catch { continue; }
-    const cands = new Set();
-    for (const f of [pj.main, pj.module, pj.browser]) if (typeof f === "string") cands.add(f);
-    if (pj.bin) for (const b of typeof pj.bin === "string" ? [pj.bin] : Object.values(pj.bin)) cands.add(b);
-    let rootJs = [];
-    try { rootJs = readdirSync(dir).filter((f) => /\.(c|m)?js$/.test(f)).slice(0, 6); } catch { /* gone */ }
-    for (const f of rootJs) cands.add(f);
-    if (!cands.size) cands.add("index.js");
-    for (const rel of cands) {
-      if (seenFiles >= capFiles) break;
-      const full = join(dir, String(rel));
-      try {
-        if (!existsSync(full) || statSync(full).size > 2_000_000) continue;
-        seenFiles++;
-        const text = readFileSync(full, "utf8");
-        for (const rule of classifyContent(text)) {
-          for (const at of matchRuleOffsets(rule, text)) {
-            // snippet keeps up to 60 chars of same-line PRE-context (like the rg path) so the
-            // comment/doc-context noise filter can see "// see" markers before the match
-            const lineStart = text.lastIndexOf("\n", at) + 1;
-            const nl = text.indexOf("\n", at);
-            const snippet = text.slice(Math.max(lineStart, at - 60), Math.min(nl < 0 ? text.length : nl, at + 200)).trim().slice(0, 240);
-            hits.push({ pkg, file: full, line: at >= 0 ? text.slice(0, at).split("\n").length : 0, text: snippet, rule });
-          }
-        }
-      } catch { /* unreadable */ }
-    }
-  }
-  return hits;
-}
+// Content sweeps for the malware scanner (split out of malware-heuristics.js): a ripgrep sweep
+// over all content roots when rg is available, else a bounded Node fallback over entry files.
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { runCommand } from "../process.js";
+import { CONTENT_RULES, classifyContent } from "./registry-sig.js";
+import { normPath } from "./malware-heuristics.exclusions.js";
+
+const SKIP_GLOBS = [
+  "!**/*.map", "!**/*.md", "!**/*.mdx", "!**/*.markdown", "!**/*.mdown", "!**/*.mkd", "!**/*.rst", "!**/*.d.ts",
+  "!**/doc/**", "!**/docs/**", "!**/documentation/**",
+  "!**/test/**", "!**/tests/**", "!**/__tests__/**", "!**/fixtures/**", "!**/example/**", "!**/examples/**"
+];
+
+function globalRuleRegex(rule) {
+  const flags = rule.re.flags.includes("g") ? rule.re.flags : `${rule.re.flags}g`;
+  return new RegExp(rule.re.source, flags);
+}
+
+function matchRuleOffsets(rule, lineText, subText = "") {
+  const text = String(lineText || "");
+  if (text) {
+    const offsets = [];
+    const re = globalRuleRegex(rule);
+    let guard = 0;
+    let m;
+    while ((m = re.exec(text)) && guard++ < 24) {
+      offsets.push(m.index);
+      if (!m[0].length) re.lastIndex++;
+    }
+    if (!offsets.length && rule.key === "obfuscated-code") {
+      const at = subText ? text.indexOf(subText) : 0;
+      if (at >= 0) offsets.push(at);
+    }
+    return offsets;
+  }
+  if (subText && (rule.key === "obfuscated-code" || rule.re.test(subText))) return [0];
+  return [];
+}
+
+function rootOfFile(file, roots) {
+  const f = normPath(file).toLowerCase();
+  return roots.find((r) => {
+    const root = normPath(r.root).toLowerCase();
+    return f === root || f.startsWith(`${root}/`);
+  });
+}
+
+function chunks(list, size) {
+  const out = [];
+  for (let i = 0; i < list.length; i += size) out.push(list.slice(i, i + size));
+  return out;
+}
+
+export async function rgSweep(rg, contentRoots, timeoutMs) {
+  const hits = []; // {pkg, file, line, text, rule}
+  let errored = 0; // a failed/broken rule must not masquerade as "scanned, 0 hits"
+  let total = 0;
+  for (const rule of CONTENT_RULES) {
+    for (const group of chunks(contentRoots, 40)) {
+      total++;
+      const args = ["--json", "-i", "--no-ignore", "--hidden", "--follow", "--max-filesize", "2M", "--max-count", "20", ...SKIP_GLOBS.flatMap((g) => ["-g", g]), "-e", rule.pattern, "--", ...group.map((r) => r.root)];
+      let r;
+      try { r = await runCommand(rg, args, { timeoutMs }); } catch { errored++; continue; }
+      if (r.exitCode === 2 && !String(r.stdout || "").trim()) { errored++; continue; }
+      for (const line of String(r.stdout || "").split(/\r?\n/)) {
+        if (!line) continue;
+        let obj; try { obj = JSON.parse(line); } catch { continue; }
+        if (obj.type !== "match") continue;
+        const file = obj.data?.path?.text || "";
+        const root = rootOfFile(file, group);
+        const pkg = root?.pathToPkg(file) || "";
+        if (!pkg) continue;
+        const lineText = String(obj.data?.lines?.text || "");
+        const subText = String(obj.data?.submatches?.[0]?.match?.text || "");
+        for (const at of matchRuleOffsets(rule, lineText, subText)) {
+          const text = (lineText ? lineText.slice(Math.max(0, at - 60), at + 180) : subText).trim().slice(0, 240);
+          hits.push({ pkg, file, line: obj.data?.line_number || 0, text, rule });
+        }
+      }
+    }
+  }
+  return { hits, errored, total };
+}
+
+// no-rg fallback: each package's package.json main/bin entries + root JS files, bounded
+export function nodeSweep(nmDir, pkgDirs, capFiles = 3000) {
+  const hits = [];
+  let seenFiles = 0;
+  for (const { pkg, dir } of pkgDirs) {
+    if (seenFiles >= capFiles) break;
+    let pj = null;
+    try { pj = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")); } catch { continue; }
+    const cands = new Set();
+    for (const f of [pj.main, pj.module, pj.browser]) if (typeof f === "string") cands.add(f);
+    if (pj.bin) for (const b of typeof pj.bin === "string" ? [pj.bin] : Object.values(pj.bin)) cands.add(b);
+    let rootJs = [];
+    try { rootJs = readdirSync(dir).filter((f) => /\.(c|m)?js$/.test(f)).slice(0, 6); } catch { /* gone */ }
+    for (const f of rootJs) cands.add(f);
+    if (!cands.size) cands.add("index.js");
+    for (const rel of cands) {
+      if (seenFiles >= capFiles) break;
+      const full = join(dir, String(rel));
+      try {
+        if (!existsSync(full) || statSync(full).size > 2_000_000) continue;
+        seenFiles++;
+        const text = readFileSync(full, "utf8");
+        for (const rule of classifyContent(text)) {
+          for (const at of matchRuleOffsets(rule, text)) {
+            // snippet keeps up to 60 chars of same-line PRE-context (like the rg path) so the
+            // comment/doc-context noise filter can see "// see" markers before the match
+            const lineStart = text.lastIndexOf("\n", at) + 1;
+            const nl = text.indexOf("\n", at);
+            const snippet = text.slice(Math.max(lineStart, at - 60), Math.min(nl < 0 ? text.length : nl, at + 200)).trim().slice(0, 240);
+            hits.push({ pkg, file: full, line: at >= 0 ? text.slice(0, at).split("\n").length : 0, text: snippet, rule });
+          }
+        }
+      } catch { /* unreadable */ }
+    }
+  }
+  return hits;
+}