x-fidelity 2.13.1 → 2.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.xfi-config.json +5 -0
- package/CHANGELOG.md +39 -0
- package/CODE_OF_CONDUCT.md +28 -0
- package/CONTRIBUTING.md +53 -0
- package/README.md +368 -389
- package/cli-testing/installBatsTesting.sh +9 -0
- package/cli-testing/test_cli_options.bats +86 -0
- package/dist/archetypes/java-microservice.json +1 -5
- package/dist/core/cli.js +1 -0
- package/dist/core/engine/analyzer.js +14 -8
- package/dist/core/engine/analyzer.test.js +0 -1
- package/dist/core/engine/telemetryCollector.js +6 -10
- package/dist/core/engine/telemetryCollector.test.js +0 -11
- package/dist/facts/repoDependencyFacts.js +31 -8
- package/dist/facts/repoFilesystemFacts.js +10 -1
- package/dist/operators/index.js +27 -4
- package/dist/rules/noDatabases-iterative-rule.json +2 -2
- package/dist/rules/sensitiveLogging-iterative-rule.json +10 -2
- package/dist/server/cacheManager.js +54 -32
- package/dist/server/configServer.js +2 -2
- package/dist/server/middleware/validateTelemetryData.js +4 -2
- package/dist/server/middleware/validateUrlInput.js +11 -2
- package/dist/utils/configManager.js +42 -39
- package/dist/utils/exemptionLoader.js +38 -23
- package/dist/utils/inputValidation.js +23 -19
- package/dist/utils/inputValidation.test.js +19 -19
- package/dist/utils/jsonSchemas.js +20 -1
- package/dist/utils/openaiUtils.js +14 -1
- package/dist/utils/repoXFIConfigLoader.js +47 -0
- package/dist/utils/telemetry.js +2 -2
- package/dist/utils/utils.js +26 -0
- package/package.json +4 -2
- package/src/archetypes/java-microservice.json +1 -5
- package/src/core/cli.ts +1 -0
- package/src/core/engine/analyzer.test.ts +0 -1
- package/src/core/engine/analyzer.ts +18 -11
- package/src/core/engine/telemetryCollector.test.ts +0 -15
- package/src/core/engine/telemetryCollector.ts +5 -9
- package/src/facts/openaiAnalysisFacts.test.ts +1 -1
- package/src/facts/openaiAnalysisFacts.ts +1 -1
- package/src/facts/repoDependencyFacts.ts +36 -11
- package/src/facts/repoFilesystemFacts.ts +14 -10
- package/src/index.ts +0 -1
- package/src/operators/index.ts +28 -7
- package/src/rules/noDatabases-iterative-rule.json +2 -2
- package/src/rules/sensitiveLogging-iterative-rule.json +10 -2
- package/src/server/cacheManager.ts +62 -33
- package/src/server/configServer.ts +2 -2
- package/src/server/middleware/validateTelemetryData.ts +5 -3
- package/src/server/middleware/validateUrlInput.ts +14 -3
- package/src/types/typeDefs.ts +18 -1
- package/src/utils/configManager.ts +40 -40
- package/src/utils/exemptionLoader.ts +40 -26
- package/src/utils/inputValidation.test.ts +19 -19
- package/src/utils/inputValidation.ts +27 -25
- package/src/utils/jsonSchemas.ts +22 -2
- package/src/utils/openaiUtils.ts +14 -1
- package/src/utils/repoXFIConfigLoader.ts +33 -0
- package/src/utils/telemetry.ts +2 -2
- package/src/utils/utils.ts +25 -1
package/.xfi-config.json
ADDED
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,42 @@
|
|
|
1
|
+
# [2.15.0](https://github.com/zotoio/x-fidelity/compare/v2.14.0...v2.15.0) (2024-09-08)
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
### Bug Fixes
|
|
5
|
+
|
|
6
|
+
* **execution:** fact functions and cleanup ([8bd2cfa](https://github.com/zotoio/x-fidelity/commit/8bd2cfa8c4ea6a587fdf4259d34e14e09189fc27))
|
|
7
|
+
* Implement more robust error handling and logging ([f391052](https://github.com/zotoio/x-fidelity/commit/f391052b1b3fe8f56bb29deffaf567b2a32ce3d7))
|
|
8
|
+
* Implement safe handling of circular JSON references in repoDependencyFacts.ts ([49d95da](https://github.com/zotoio/x-fidelity/commit/49d95da03f4552de4533a0e86d37d4e168bd038e))
|
|
9
|
+
* **loading:** consistency with archetype ([47f52e4](https://github.com/zotoio/x-fidelity/commit/47f52e477c1e2ca69c49af767e9af5c8b76a7979))
|
|
10
|
+
* Update import statement in repoFilesystemFacts.ts ([903326c](https://github.com/zotoio/x-fidelity/commit/903326cb1dc33da38d5a9fcf7a45f01c4f1f4876))
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
### Features
|
|
14
|
+
|
|
15
|
+
* Add JSON schema validation for .xfi-config.json file ([a7d0a75](https://github.com/zotoio/x-fidelity/commit/a7d0a755abe18ae07f8c1ef938b0eb2239af968b))
|
|
16
|
+
* Add rule to check for 'nuit' and 'elevate' package imports in the same file ([70d0994](https://github.com/zotoio/x-fidelity/commit/70d09947ff9149da22047a0d2f9dc62448de9fd0))
|
|
17
|
+
* Add support for .xfi-config.json file ([e9b60d3](https://github.com/zotoio/x-fidelity/commit/e9b60d31ac1037d6f40505deff5126f18409c269))
|
|
18
|
+
* Add support for .xfi-config.json file with sensitiveFileFalsePositives ([5eda4f4](https://github.com/zotoio/x-fidelity/commit/5eda4f4df4d5df048d6342e890825064e78b93e0))
|
|
19
|
+
* Add XFIConfig to ResultMetadata and define FileData and ValidationResult types ([ce71d90](https://github.com/zotoio/x-fidelity/commit/ce71d903c5211d1101bf49080a0fc3978b4cdaf2))
|
|
20
|
+
* Centralize loading of .xfi-config.json and add it as a fact ([2cca682](https://github.com/zotoio/x-fidelity/commit/2cca68203f2cd04d6802e25e3647455279d009a2))
|
|
21
|
+
* create 'bats' subdirectory and move BATS-related content ([1cc0bff](https://github.com/zotoio/x-fidelity/commit/1cc0bff7fec4d0d1b4c7ea60dd8fef027bc689f2))
|
|
22
|
+
* improve and modernize the bats test ([586b546](https://github.com/zotoio/x-fidelity/commit/586b546e50de46d5afe4e2dcde34af7fe65bbdb7))
|
|
23
|
+
* Improve repoDependencyAnalysis function ([a5638ca](https://github.com/zotoio/x-fidelity/commit/a5638cad789bc52533862dd91b9a964da785c666))
|
|
24
|
+
* Rename XFIConfig to RepoXFIConfig ([f91574d](https://github.com/zotoio/x-fidelity/commit/f91574d7c9ab4a1e64a9b2b8fb34fb84929a87bd))
|
|
25
|
+
* **repoconfig:** support for local control of false positive sensitive values ([db0b09a](https://github.com/zotoio/x-fidelity/commit/db0b09ae08dea2cc82a26a6a671615033805396b))
|
|
26
|
+
* **testing:** cli blackbox testing ([a634258](https://github.com/zotoio/x-fidelity/commit/a6342584a4a7cdfd630437fd9894a02039d0099d))
|
|
27
|
+
|
|
28
|
+
# [2.14.0](https://github.com/zotoio/x-fidelity/compare/v2.13.1...v2.14.0) (2024-08-29)
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
### Bug Fixes
|
|
32
|
+
|
|
33
|
+
* **exemptions:** exclude repos that do not have a remote configured ([c49c4c7](https://github.com/zotoio/x-fidelity/commit/c49c4c7284101822395a6f57b28b0cd302e5505e))
|
|
34
|
+
|
|
35
|
+
|
|
36
|
+
### Features
|
|
37
|
+
|
|
38
|
+
* Add exemptions feature to manage rule exceptions ([0a91ad8](https://github.com/zotoio/x-fidelity/commit/0a91ad8153651f971c3e34013233f91a0d960ec8))
|
|
39
|
+
|
|
1
40
|
## [2.13.1](https://github.com/zotoio/x-fidelity/compare/v2.13.0...v2.13.1) (2024-08-28)
|
|
2
41
|
|
|
3
42
|
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Contributor Code of Conduct
|
|
2
|
+
|
|
3
|
+
## 1. **Purpose**
|
|
4
|
+
This Code of Conduct outlines our expectations for participants within the community, as well as the steps to report unacceptable behavior. We are committed to providing a welcoming and inspiring community for all.
|
|
5
|
+
|
|
6
|
+
## 2. **Scope**
|
|
7
|
+
This Code of Conduct applies to all contributions to the repository, including issues, pull requests, code reviews, and any other community interaction.
|
|
8
|
+
|
|
9
|
+
## 3. **Expected Behavior**
|
|
10
|
+
- **Respectful Communication:** Be respectful and considerate in your communications. Constructive criticism is encouraged, but personal attacks, insults, or derogatory language are not tolerated.
|
|
11
|
+
- **Inclusivity:** Contribute in ways that foster an inclusive environment, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
|
|
12
|
+
- **Collaboration:** Work collaboratively with others, and be open to learning from different perspectives. Welcome new contributors and be patient with questions or mistakes.
|
|
13
|
+
- **Responsibility:** Take responsibility for your contributions and ensure they align with the project's goals and quality standards.
|
|
14
|
+
|
|
15
|
+
## 4. **Unacceptable Behavior**
|
|
16
|
+
- **Harassment:** Any form of harassment, including but not limited to offensive comments related to gender, gender identity, sexual orientation, disability, physical appearance, body size, race, religion.
|
|
17
|
+
- **Discrimination:** Discriminatory or exclusionary behavior that undermines the community.
|
|
18
|
+
- **Trolling:** Disruptive behavior, trolling, or spamming.
|
|
19
|
+
- **Violence or Threats:** Violence or threats of violence against others.
|
|
20
|
+
|
|
21
|
+
## 5. **Reporting Issues**
|
|
22
|
+
If you experience or witness unacceptable behavior, please report it by contacting [Maintainer's Email Address]. All complaints will be reviewed and investigated, with the outcomes communicated as deemed appropriate.
|
|
23
|
+
|
|
24
|
+
## 6. **Enforcement**
|
|
25
|
+
Community members who violate this Code of Conduct may face consequences, including but not limited to a temporary or permanent ban from the repository, depending on the severity of the violation.
|
|
26
|
+
|
|
27
|
+
## 7. **Attribution**
|
|
28
|
+
This Code of Conduct is adapted from the Contributor Covenant, version 2.1, available at [Contributor Covenant](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).
|
package/CONTRIBUTING.md
ADDED
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
# Contributing to x-fidelity
|
|
2
|
+
|
|
3
|
+
We welcome contributions to x-fidelity! This document provides guidelines for contributing to the project.
|
|
4
|
+
|
|
5
|
+
## Getting Started
|
|
6
|
+
|
|
7
|
+
1. Fork the repository on GitHub.
|
|
8
|
+
2. Clone your fork locally.
|
|
9
|
+
3. Install dependencies with `yarn install`.
|
|
10
|
+
4. Create a new branch for your feature or bug fix.
|
|
11
|
+
|
|
12
|
+
## Making Changes
|
|
13
|
+
|
|
14
|
+
1. Make your changes in your feature branch.
|
|
15
|
+
2. Add or update tests as necessary.
|
|
16
|
+
3. Ensure all tests pass by running `yarn test`.
|
|
17
|
+
4. Ensure the code lints properly by running `yarn lint`.
|
|
18
|
+
|
|
19
|
+
## Commit Messages
|
|
20
|
+
|
|
21
|
+
We use conventional commits to standardize our commit messages. Please use the `yarn commit` script to create your commit messages. This script will guide you through the process of creating a properly formatted commit message.
|
|
22
|
+
|
|
23
|
+
To commit your changes:
|
|
24
|
+
|
|
25
|
+
```
|
|
26
|
+
git add .
|
|
27
|
+
yarn commit
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
Follow the prompts to select the type of change, scope, and write a short description.
|
|
31
|
+
|
|
32
|
+
## Submitting a Pull Request
|
|
33
|
+
|
|
34
|
+
1. Push your changes to your fork on GitHub.
|
|
35
|
+
2. Create a pull request from your fork to the main x-fidelity repository.
|
|
36
|
+
3. In your pull request description, please provide:
|
|
37
|
+
- A clear and detailed explanation of the changes
|
|
38
|
+
- The motivation for the changes
|
|
39
|
+
- Any potential impacts on existing functionality
|
|
40
|
+
- Screenshots or code snippets if applicable
|
|
41
|
+
|
|
42
|
+
## Pull Request Review Process
|
|
43
|
+
|
|
44
|
+
1. Maintainers will review your pull request.
|
|
45
|
+
2. They may ask for changes or clarifications.
|
|
46
|
+
3. Make any requested changes in your feature branch and push the updates.
|
|
47
|
+
4. Once approved, a maintainer will merge your pull request.
|
|
48
|
+
|
|
49
|
+
## Code of Conduct
|
|
50
|
+
|
|
51
|
+
Please note that this project is released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
|
|
52
|
+
|
|
53
|
+
Thank you for contributing to x-fidelity!
|