xploitscan 1.3.1 → 1.3.2

package/README.md

@@ -155,6 +155,14 @@ legacy/**              scanner
 For a single reviewed-and-accepted finding, prefer an inline
 `// VC<id>-OK: <reason>` comment instead of a file- or path-wide rule.
 
+**Where it is looked up.** Every `.xploitscanignore` between your project root
+and the directory being scanned applies, so `xploitscan scan packages/web/src`
+still honours the file at the top of the repo. Patterns are interpreted
+relative to the file that declares them — a root file naming
+`packages/web/src/lib/demo.ts` matches that file whether you scan the repo root
+or `packages/web/src` — and a nested file takes precedence over a broader rule
+above it, the same way `.gitignore` does.
+
 ### Vendored and generated code
 
 Some of what a scanner finds isn't code you wrote. AI app builders copy

package/dist/index.js

@@ -27,7 +27,7 @@ import {
 import { Command } from "commander";
 
 // src/commands/scan.ts
-import { resolve as resolve2, join as join6 } from "path";
+import { resolve as resolve3, join as join6 } from "path";
 import { watch as fsWatch, existsSync as existsSync5 } from "fs";
 import ora from "ora";
 import chalk2 from "chalk";
@@ -36,12 +36,54 @@ import chalk2 from "chalk";
 import fg from "fast-glob";
 import ignore2 from "ignore";
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
-import { join as join2, resolve } from "path";
+import { join as join2, resolve as resolve2 } from "path";
 
 // src/utils/ignore-rules.ts
 import ignore from "ignore";
-import { readFileSync, existsSync } from "fs";
-import { join } from "path";
+import { readFileSync } from "fs";
+
+// src/utils/ignore-discovery.ts
+import { existsSync } from "fs";
+import { dirname, join, relative, resolve, sep } from "path";
+function discoverIgnoreFiles(directory) {
+  const found = [];
+  let dir = resolve(directory);
+  for (; ; ) {
+    const file = join(dir, ".xploitscanignore");
+    if (existsSync(file)) found.push({ file, dir });
+    if (existsSync(join(dir, ".git"))) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return found.reverse();
+}
+function rebasePattern(pattern, fromDir, toDir) {
+  const trimmed = pattern.trim();
+  if (trimmed === "" || trimmed.startsWith("#")) return pattern;
+  const from = resolve(fromDir);
+  const to = resolve(toDir);
+  if (from === to) return pattern;
+  const rel = relative(from, to).split(sep).join("/");
+  if (rel === "" || rel.startsWith("..")) return pattern;
+  const negated = trimmed.startsWith("!");
+  const body = negated ? trimmed.slice(1) : trimmed;
+  const anchored = body.startsWith("/");
+  const bare = anchored ? body.slice(1) : body;
+  const withoutTrailing = bare.endsWith("/") ? bare.slice(0, -1) : bare;
+  if (!anchored && !withoutTrailing.includes("/")) return pattern;
+  const keep = (p) => negated ? `!${p}` : p;
+  if (withoutTrailing === rel || rel.startsWith(`${withoutTrailing}/`)) {
+    return keep("**");
+  }
+  if (bare.startsWith(`${rel}/`)) return keep(bare.slice(rel.length + 1));
+  return null;
+}
+function rebaseContent(content, fromDir, toDir) {
+  return content.split("\n").map((line) => rebasePattern(line, fromDir, toDir)).filter((line) => line !== null).join("\n");
+}
+
+// src/utils/ignore-rules.ts
 var RULE_TOKEN = "(?:VC\\d+|scanner)";
 var RULE_SCOPED_RE = new RegExp(
   `^\\s*([^#].*?\\S)\\s+(${RULE_TOKEN}(?:\\s*,\\s*${RULE_TOKEN})*)\\s*$`,
@@ -50,12 +92,17 @@ var RULE_SCOPED_RE = new RegExp(
 function isRuleScopedLine(line) {
   return RULE_SCOPED_RE.test(line);
 }
-function parseRuleIgnores(content) {
+function parseRuleIgnores(content, fromDir, toDir) {
   const entries = [];
   for (const line of content.split("\n")) {
     const m = line.match(RULE_SCOPED_RE);
     if (!m) continue;
-    const glob = m[1].trim();
+    let glob = m[1].trim();
+    if (fromDir && toDir) {
+      const rebased = rebasePattern(glob, fromDir, toDir);
+      if (rebased === null) continue;
+      glob = rebased;
+    }
     const rules = new Set(
       m[2].split(",").map((r) => r.trim().toUpperCase())
     );
@@ -64,13 +111,14 @@ function parseRuleIgnores(content) {
   return entries;
 }
 function loadRuleIgnores(dir) {
-  const p = join(dir, ".xploitscanignore");
-  if (!existsSync(p)) return [];
-  try {
-    return parseRuleIgnores(readFileSync(p, "utf-8"));
-  } catch {
-    return [];
+  const entries = [];
+  for (const { file, dir: ignoreDir } of discoverIgnoreFiles(dir)) {
+    try {
+      entries.push(...parseRuleIgnores(readFileSync(file, "utf-8"), ignoreDir, dir));
+    } catch {
+    }
   }
+  return entries;
 }
 function applyRuleIgnores(findings, entries) {
   if (entries.length === 0) return { kept: findings, suppressed: [] };
@@ -225,10 +273,12 @@ async function collectFiles(directory) {
     const gitignoreContent = readFileSync2(gitignorePath, "utf-8");
     ig.add(gitignoreContent);
   }
-  const xploitscanIgnorePath = join2(directory, ".xploitscanignore");
-  if (existsSync2(xploitscanIgnorePath)) {
-    const xploitscanIgnoreContent = readFileSync2(xploitscanIgnorePath, "utf-8").split("\n").filter((line) => !isRuleScopedLine(line)).join("\n");
-    ig.add(xploitscanIgnoreContent);
+  for (const { file, dir } of discoverIgnoreFiles(directory)) {
+    try {
+      const content = readFileSync2(file, "utf-8").split("\n").filter((line) => !isRuleScopedLine(line)).join("\n");
+      ig.add(rebaseContent(content, dir, directory));
+    } catch {
+    }
   }
   ig.add(ALWAYS_IGNORE);
   const patterns = SOURCE_EXTENSIONS.map((ext) => `**/*.${ext}`);
@@ -247,8 +297,8 @@ async function collectFiles(directory) {
 }
 function readFileContents(directory, filePath) {
   try {
-    const fullPath = resolve(join2(directory, filePath));
-    if (!fullPath.startsWith(resolve(directory))) {
+    const fullPath = resolve2(join2(directory, filePath));
+    if (!fullPath.startsWith(resolve2(directory))) {
       throw new Error("Path traversal detected");
     }
     return readFileSync2(fullPath, "utf-8");
@@ -368,9 +418,9 @@ function semgrepSeverityToXploitscan(level) {
   return SEVERITY_MAP[level] ?? "medium";
 }
 async function isSemgrepInstalled() {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     execFile("semgrep", ["--version"], (error) => {
-      resolve3(!error);
+      resolve4(!error);
     });
   });
 }
@@ -401,7 +451,7 @@ async function runSemgrep(directory, customRulesDir) {
       args.push("--config", customRulesDir);
     }
     args.push(directory);
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       const proc = execFile(
         "semgrep",
         args,
@@ -410,7 +460,7 @@ async function runSemgrep(directory, customRulesDir) {
           if (error && error.code !== 1) {
             reject(new Error(`Semgrep failed: ${stderr || error.message}`));
           } else {
-            resolve3();
+            resolve4();
           }
         }
       );
@@ -496,9 +546,9 @@ var RULE_SEVERITY = {
   "firebase-api-key": "high"
 };
 async function isGitleaksInstalled() {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     execFile2("gitleaks", ["version"], (error) => {
-      resolve3(!error);
+      resolve4(!error);
     });
   });
 }
@@ -524,7 +574,7 @@ async function runGitleaks(directory) {
       "0"
       // Don't fail on findings
     ];
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       execFile2(
         "gitleaks",
         args,
@@ -534,7 +584,7 @@ async function runGitleaks(directory) {
             const sanitizedError = (stderr || error.message).slice(0, 200);
             reject(new Error(`Gitleaks failed: ${sanitizedError}`));
           } else {
-            resolve3();
+            resolve4();
           }
         }
       );
@@ -2099,7 +2149,7 @@ function renderDatadogReport(result) {
 
 // src/commands/scan.ts
 async function scanCommand(directory, options) {
-  const dir = resolve2(directory || ".");
+  const dir = resolve3(directory || ".");
   const format = options.format ?? "terminal";
   const verbose = options.verbose ?? false;
   const startTime = Date.now();
@@ -2271,8 +2321,8 @@ ${isMonthlyCap ? "Monthly" : "Daily"} scan limit reached.`));
   }
   spinner.text = "Running external scanners...";
   spinner.color = "yellow";
-  const rulesDir = resolve2(join6(import.meta.dirname, "../../rules"));
-  const fallbackRulesDir = resolve2(join6(dir, "../rules"));
+  const rulesDir = resolve3(join6(import.meta.dirname, "../../rules"));
+  const fallbackRulesDir = resolve3(join6(dir, "../rules"));
   const [semgrepResult, gitleaksResult] = await Promise.allSettled([
     runSemgrep(dir, rulesDir).catch(() => runSemgrep(dir, fallbackRulesDir)).catch(() => ({ findings: [], available: false })),
     runGitleaks(dir).catch(() => ({ findings: [], available: false }))
@@ -2562,7 +2612,7 @@ async function whoamiCommand() {
   }
 }
 async function waitForBrowserLogin() {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve4, reject) => {
     const expectedState = randomUUID();
     const server = createServer((req, res) => {
       if (!req.url) {
@@ -2595,7 +2645,7 @@ async function waitForBrowserLogin() {
             </html>
           `);
           server.close();
-          resolve3({ token, email, userId });
+          resolve4({ token, email, userId });
         } else {
           res.writeHead(400);
           res.end("Missing parameters");
@@ -2790,11 +2840,11 @@ async function uninstallHookCommand() {
 // src/commands/cursor.ts
 import chalk5 from "chalk";
 import { mkdirSync, existsSync as existsSync7, writeFileSync as writeFileSync2, readFileSync as readFileSync5 } from "fs";
-import { join as join8, dirname } from "path";
+import { join as join8, dirname as dirname2 } from "path";
 import { fileURLToPath } from "url";
 async function cursorInstallCommand(opts = {}) {
   const cwd = process.cwd();
-  const here = dirname(fileURLToPath(import.meta.url));
+  const here = dirname2(fileURLToPath(import.meta.url));
   const candidates = [
     join8(here, "templates"),
     join8(here, "..", "templates"),
@@ -2834,7 +2884,7 @@ async function cursorInstallCommand(opts = {}) {
 var program = new Command();
 program.name("xploitscan").description(
   "AI security scanner for vibe-coded apps. Find vulnerabilities before attackers do."
-).version("1.3.1");
+).version("1.3.2");
 program.command("scan").description("Scan a directory for security vulnerabilities").argument("[directory]", "Directory to scan", ".").option("--no-ai", "Skip AI-powered analysis").option(
   "-f, --format <format>",
   "Output format: terminal, json, sarif, splunk-hec, elastic-ecs, datadog-logs",