apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/parsing/js/parser.py

@@ -0,0 +1,622 @@
+"""
+JavaScript/TypeScript parser using tree-sitter.
+
+Supports:
+- ES modules (import/export)
+- CommonJS (require/module.exports)
+- TypeScript (.ts/.tsx) via tree-sitter-typescript
+- NestJS decorators (@Controller, @Get, @Post, etc.)
+- Express.js route registration (app.get, router.post, etc.)
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+import tree_sitter_javascript as tsjs
+from tree_sitter import Language as TSLanguage
+from tree_sitter import Node, Parser
+
+from ...core.types import CodeLocation, Language, QualifiedName
+from ..base import (
+    BaseParser,
+    ParsedArgument,
+    ParsedCallSite,
+    ParsedClass,
+    ParsedDecorator,
+    ParsedFile,
+    ParsedFunction,
+    ParsedImport,
+)
+
+try:
+    import tree_sitter_typescript as tsts
+
+    _TS_LANGUAGE = TSLanguage(tsts.language_typescript())
+    _TS_PARSER: Parser | None = Parser(_TS_LANGUAGE)
+except Exception:
+    _TS_LANGUAGE = None  # type: ignore
+    _TS_PARSER = None
+
+_JS_LANGUAGE = TSLanguage(tsjs.language())
+_PARSER = Parser(_JS_LANGUAGE)
+
+if TYPE_CHECKING:
+    pass
+
+logger = logging.getLogger(__name__)
+
+
+# NestJS HTTP verb decorator names
+VERB_DECORATOR_NAMES: frozenset[str] = frozenset(
+    {
+        "Get",
+        "Post",
+        "Put",
+        "Patch",
+        "Delete",
+        "Options",
+        "Head",
+        "All",
+    }
+)
+
+# TypeScript accessibility/other modifier keywords to skip when parsing method names
+_MODIFIERS: frozenset[str] = frozenset(
+    {
+        "public",
+        "private",
+        "protected",
+        "static",
+        "abstract",
+        "override",
+        "readonly",
+        "async",
+    }
+)
+
+
+class JavaScriptParser(BaseParser):
+    """
+    Tree-sitter based JavaScript/TypeScript parser.
+
+    Extracts imports, classes (with decorators and methods), functions,
+    and call sites from JS/TS source files.
+    """
+
+    LANGUAGE: Language = Language.JAVASCRIPT
+    SUPPORTED_EXTENSIONS: frozenset[str] = frozenset(
+        {
+            ".js",
+            ".mjs",
+            ".cjs",
+            ".ts",
+            ".tsx",
+        }
+    )
+
+    def parse_file(self, file_path: Path) -> ParsedFile:
+        """Parse a JS/TS source file."""
+        try:
+            source_bytes = file_path.read_bytes()
+            return self._parse(source_bytes, file_path)
+        except Exception as exc:
+            from ...core.types import ParseError
+
+            pf = ParsedFile(path=file_path, language=self.LANGUAGE, success=False)
+            pf.error = ParseError(str(exc), file_path=file_path)
+            return pf
+
+    def parse_source(self, source: str, file_path: Path | None = None) -> ParsedFile:
+        """Parse JS/TS source code from a string."""
+        source_bytes = source.encode("utf-8", errors="replace")
+        fp = file_path or Path("<unknown>.js")
+        return self._parse(source_bytes, fp)
+
+    def _parse(self, source_bytes: bytes, file_path: Path) -> ParsedFile:
+        """Core parsing logic — selects TS or JS parser based on extension."""
+        ext = file_path.suffix.lower()
+        if ext in (".ts", ".tsx") and _TS_PARSER is not None:
+            parser = _TS_PARSER
+            is_ts = True
+        else:
+            parser = _PARSER
+            is_ts = False
+
+        tree = parser.parse(source_bytes)
+        root = tree.root_node
+
+        visitor = _Visitor(source_bytes, file_path, is_ts=is_ts)
+        visitor.visit(root)
+
+        pf = ParsedFile(path=file_path, language=self.LANGUAGE)
+        pf.imports = visitor.imports
+        pf.functions = visitor.functions
+        pf.classes = visitor.classes
+        pf.call_sites = visitor.call_sites
+        pf.line_count = source_bytes.count(b"\n") + 1
+
+        module_stem = file_path.stem
+        pf.module_name = module_stem
+
+        return pf
+
+
+class _Visitor:
+    """Walk a tree-sitter AST and extract parsed symbols."""
+
+    def __init__(self, source: bytes, file_path: Path, is_ts: bool = False) -> None:
+        self._src = source
+        self._file = file_path
+        self._is_ts = is_ts
+        self._module = file_path.stem
+
+        self.imports: list[ParsedImport] = []
+        self.functions: list[ParsedFunction] = []
+        self.classes: list[ParsedClass] = []
+        self.call_sites: list[ParsedCallSite] = []
+
+    def _text(self, node: Node) -> str:
+        return self._src[node.start_byte : node.end_byte].decode("utf-8", errors="replace")
+
+    def _loc(self, node: Node) -> CodeLocation:
+        return CodeLocation(
+            file=self._file,
+            line=node.start_point[0] + 1,
+            column=node.start_point[1],
+            end_line=node.end_point[0] + 1,
+            end_column=node.end_point[1],
+        )
+
+    def visit(self, node: Node) -> None:
+        """Dispatch node to the appropriate visitor method."""
+        handler_name = f"_visit_{node.type}"
+        handler = getattr(self, handler_name, None)
+        if handler:
+            handler(node)
+        else:
+            for child in node.children:
+                self.visit(child)
+
+    # =========================================================================
+    # Import extraction
+    # =========================================================================
+
+    def _visit_import_statement(self, node: Node) -> None:
+        """Handle ES import statement: import X from 'module'"""
+        source_node = node.child_by_field_name("source")
+        if source_node is None:
+            return
+
+        module = self._text(source_node).strip("'\"")
+        names: list[str] = []
+
+        for child in node.children:
+            if child.type == "import_clause":
+                for sub in child.children:
+                    if sub.type == "identifier":
+                        names.append(self._text(sub))
+                    elif sub.type in ("named_imports", "namespace_import"):
+                        for item in sub.children:
+                            if item.type in ("import_specifier", "identifier"):
+                                name_node = item.child_by_field_name("name") or item
+                                if name_node.type == "identifier":
+                                    names.append(self._text(name_node))
+
+        self.imports.append(
+            ParsedImport(
+                module=module,
+                names=names,
+                location=self._loc(node),
+            )
+        )
+
+    def _visit_lexical_declaration(self, node: Node) -> None:
+        """Handle const/let declarations — extract require() as imports."""
+        self._extract_require_import(node)
+        for child in node.children:
+            self.visit(child)
+
+    def _visit_variable_declaration(self, node: Node) -> None:
+        """Handle var declarations — extract require() as imports."""
+        self._extract_require_import(node)
+        for child in node.children:
+            self.visit(child)
+
+    def _extract_require_import(self, node: Node) -> None:
+        """Extract CommonJS require() import from declaration node."""
+        src = self._text(node)
+        if "require(" not in src:
+            return
+
+        import re
+
+        # const foo = require('bar')  or  const { foo } = require('bar')
+        m = re.search(r'require\s*\(\s*[\'"]([^\'"]+)[\'"]\s*\)', src)
+        if not m:
+            return
+
+        module = m.group(1)
+        names: list[str] = []
+
+        # Try to extract destructured names: const { Router } = require('express')
+        dest = re.search(r"const\s*\{([^}]+)\}\s*=", src)
+        if dest:
+            for raw_name in dest.group(1).split(","):
+                name = raw_name.strip()
+                if name:
+                    names.append(name)
+        else:
+            # const express = require('express') → just record as "express"
+            id_m = re.match(r"(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)", src)
+            if id_m:
+                names.append(id_m.group(1))
+
+        self.imports.append(
+            ParsedImport(
+                module=module,
+                names=names,
+                location=self._loc(node),
+            )
+        )
+
+    # =========================================================================
+    # Export statement (for `export class Foo ...`)
+    # =========================================================================
+
+    def _visit_export_statement(self, node: Node) -> None:
+        """Handle export statements — delegate class/function to inner visitor."""
+        for child in node.children:
+            if child.type == "class_declaration":
+                self._visit_class_declaration(child, parent_node=node)
+            elif child.type == "function_declaration":
+                self._visit_function_declaration(child)
+            else:
+                self.visit(child)
+
+    # =========================================================================
+    # Class extraction
+    # =========================================================================
+
+    def _visit_class_declaration(self, node: Node, parent_node: Node | None = None) -> None:
+        """Extract class with decorators and methods."""
+        name_node = node.child_by_field_name("name")
+        if name_node is None:
+            return
+
+        class_name = self._text(name_node)
+
+        # Collect decorators from the node itself and from parent_node (export statement)
+        decorators: list[ParsedDecorator] = []
+        for search_node in [parent_node, node] if parent_node else [node]:
+            if search_node is None:
+                continue
+            for child in search_node.children:
+                if child.type == "decorator":
+                    dec = self._parse_decorator(child)
+                    if dec:
+                        decorators.append(dec)
+
+        # Build class object
+        cls = ParsedClass(
+            name=class_name,
+            qualified_name=QualifiedName(module=self._module, name=class_name),
+            location=self._loc(node),
+            decorators=decorators,
+        )
+
+        # Visit the class body for methods
+        body = node.child_by_field_name("body")
+        if body:
+            # In the TS parser, decorators on methods appear as sibling statements
+            # BEFORE the method_definition in the class body. We accumulate them.
+            pending_decorators: list[ParsedDecorator] = []
+            for child in body.children:
+                if child.type == "decorator":
+                    dec = self._parse_decorator(child)
+                    if dec:
+                        pending_decorators.append(dec)
+                elif child.type == "method_definition":
+                    method = self._visit_method_definition(
+                        child, extra_decorators=pending_decorators
+                    )
+                    if method:
+                        method.owner_type = class_name
+                        cls.methods.append(method)
+                    pending_decorators = []
+                elif child.type == "field_definition" or child.type == "public_field_definition":
+                    method = self._visit_field_definition(
+                        child, extra_decorators=pending_decorators
+                    )
+                    if method:
+                        method.owner_type = class_name
+                        cls.methods.append(method)
+                    pending_decorators = []
+                else:
+                    if pending_decorators and child.type not in (
+                        "{",
+                        "}",
+                        ";",
+                        "comment",
+                    ):
+                        pending_decorators = []
+
+        self.classes.append(cls)
+
+    def _visit_method_definition(
+        self,
+        node: Node,
+        extra_decorators: list[ParsedDecorator] | None = None,
+    ) -> ParsedFunction | None:
+        """Extract a method definition from a class body."""
+        name_node = node.child_by_field_name("name")
+        if name_node is None:
+            # TS sometimes wraps `public methodName()` as ERROR node; try text fallback
+            name = self._extract_method_name_from_text(node)
+            if not name:
+                return None
+        else:
+            name = self._text(name_node)
+            # Strip TS accessibility modifiers that appear as part of the name node text
+            if name in _MODIFIERS:
+                # The real name is after the modifier
+                rest = self._text(node)
+                import re
+
+                m = re.search(
+                    r"\b(?:" + "|".join(_MODIFIERS) + r")\s+([A-Za-z_$][A-Za-z0-9_$]*)", rest
+                )
+                if m:
+                    name = m.group(1)
+                else:
+                    return None
+
+        # Collect decorators directly on the method node
+        decorators: list[ParsedDecorator] = list(extra_decorators or [])
+        for child in node.children:
+            if child.type == "decorator":
+                dec = self._parse_decorator(child)
+                if dec:
+                    decorators.append(dec)
+
+        return ParsedFunction(
+            name=name,
+            qualified_name=QualifiedName(module=self._module, name=name),
+            location=self._loc(node),
+            decorators=decorators,
+        )
+
+    def _extract_method_name_from_text(self, node: Node) -> str | None:
+        """Fallback: extract method name from raw text of an ERROR or modifier node."""
+        import re
+
+        text = self._text(node)
+        # Remove modifiers and find the first identifier
+        for mod in sorted(_MODIFIERS, key=len, reverse=True):
+            text = re.sub(r"\b" + mod + r"\b\s*", "", text)
+        m = re.match(r"\s*([A-Za-z_$][A-Za-z0-9_$]*)", text.strip())
+        return m.group(1) if m else None
+
+    def _visit_field_definition(
+        self,
+        node: Node,
+        extra_decorators: list[ParsedDecorator] | None = None,
+    ) -> ParsedFunction | None:
+        """
+        Handle field_definition nodes that have verb decorators.
+
+        tree-sitter sometimes parses NestJS methods as field_definitions when
+        the TypeScript parser encounters methods with HTTP verb decorators.
+        We treat them as methods for route extraction purposes.
+        """
+        # Only care about fields that have verb decorators
+        decs = list(extra_decorators or [])
+        has_verb = any(d.name in VERB_DECORATOR_NAMES for d in decs)
+        if not has_verb:
+            return None
+
+        name_node = node.child_by_field_name("name") or node.child_by_field_name("property")
+        if name_node is None:
+            return None
+
+        name = self._text(name_node)
+        if name in _MODIFIERS:
+            return None
+
+        return ParsedFunction(
+            name=name,
+            qualified_name=QualifiedName(module=self._module, name=name),
+            location=self._loc(node),
+            decorators=decs,
+        )
+
+    # =========================================================================
+    # Function extraction
+    # =========================================================================
+
+    def _visit_function_declaration(self, node: Node) -> None:
+        """Extract a top-level function declaration."""
+        name_node = node.child_by_field_name("name")
+        if name_node is None:
+            return
+
+        name = self._text(name_node)
+        func = ParsedFunction(
+            name=name,
+            qualified_name=QualifiedName(module=self._module, name=name),
+            location=self._loc(node),
+        )
+        self.functions.append(func)
+        # Also visit the body for nested calls
+        body = node.child_by_field_name("body")
+        if body:
+            for child in body.children:
+                self.visit(child)
+
+    # =========================================================================
+    # Call site extraction
+    # =========================================================================
+
+    def _visit_expression_statement(self, node: Node) -> None:
+        """Visit expression statement — extract call sites."""
+        for child in node.children:
+            self._try_call_site(child)
+            self.visit(child)
+
+    def _try_call_site(self, node: Node) -> None:
+        """Attempt to extract a call site from an expression node."""
+        if node.type not in ("call_expression", "await_expression"):
+            return
+
+        target = node
+        if node.type == "await_expression":
+            # await someCall(...) — dig into the call
+            for child in node.children:
+                if child.type == "call_expression":
+                    target = child
+                    break
+            if target is node:
+                return
+
+        fn = target.child_by_field_name("function")
+        args_node = target.child_by_field_name("arguments")
+        if fn is None:
+            return
+
+        callee_name = ""
+        is_method_call = False
+        receiver_expression: str | None = None
+
+        if fn.type == "member_expression":
+            obj = fn.child_by_field_name("object")
+            prop = fn.child_by_field_name("property")
+            if obj and prop:
+                receiver_expression = self._text(obj)
+                callee_name = self._text(prop)
+                is_method_call = True
+        elif fn.type == "identifier":
+            callee_name = self._text(fn)
+        else:
+            callee_name = self._text(fn)
+
+        if not callee_name:
+            return
+
+        # Parse arguments
+        arguments: list[ParsedArgument] = []
+        if args_node:
+            pos = 0
+            for child in args_node.children:
+                if child.type in (",", "(", ")"):
+                    continue
+                arg = self._parse_argument(child, pos)
+                arguments.append(arg)
+                pos += 1
+
+        call = ParsedCallSite(
+            callee_name=callee_name,
+            location=self._loc(target),
+            is_method_call=is_method_call,
+            receiver_expression=receiver_expression,
+            arguments=arguments,
+        )
+        self.call_sites.append(call)
+
+    # =========================================================================
+    # Decorator parsing
+    # =========================================================================
+
+    def _parse_decorator(self, node: Node) -> ParsedDecorator | None:
+        """Parse a decorator node into a ParsedDecorator."""
+
+        # The decorator node has children: '@' + expression
+        # e.g.  @Controller('prefix')  or  @Get()  or  @Module({...})
+        text = self._text(node)
+        # Strip leading @
+        text = text.lstrip("@").strip()
+
+        # Name is everything before the first '('
+        name = text[: text.index("(")].strip() if "(" in text else text.strip()
+
+        dec = ParsedDecorator(
+            name=name,
+            location=self._loc(node),
+        )
+
+        # Try to parse arguments
+        # Find the arguments node inside the call_expression within the decorator
+        for child in node.children:
+            if child.type in ("call_expression",):
+                args = child.child_by_field_name("arguments")
+                if args:
+                    pos = 0
+                    for arg_child in args.children:
+                        if arg_child.type in (",", "(", ")"):
+                            continue
+                        arg_text = self._text(arg_child).strip("'\"")
+                        if arg_child.type in ("string", "template_string"):
+                            dec.arguments["value"] = arg_text
+                            dec.positional_args.append(arg_text)
+                        elif arg_child.type == "object":
+                            # Object literal: { path: 'x', version: 1 }
+                            obj_text = self._text(arg_child)
+                            dec.arguments["value"] = obj_text
+                            dec.positional_args.append(obj_text)
+                        elif arg_child.type == "identifier" or arg_child.type in (
+                            "number",
+                            "true",
+                            "false",
+                        ):
+                            dec.arguments["value"] = arg_text
+                            dec.positional_args.append(arg_text)
+                        elif arg_child.type == "member_expression":
+                            # e.g. RoleEnum.admin, Permission.READ
+                            dec.positional_args.append(self._text(arg_child))
+                        elif arg_child.type == "call_expression":
+                            # e.g. AuthGuard('jwt'), Roles('admin')
+                            dec.positional_args.append(self._text(arg_child))
+                        pos += 1
+
+        return dec
+
+    # =========================================================================
+    # Argument parsing
+    # =========================================================================
+
+    def _parse_argument(self, node: Node, position: int) -> ParsedArgument:
+        """Parse a call argument node into a ParsedArgument."""
+        arg = ParsedArgument(position=position)
+
+        if node.type in ("string", "template_string"):
+            raw = self._text(node)
+            arg.is_literal = True
+            arg.literal_value = raw.strip("'\"")
+            arg.literal_type = "str"
+        elif node.type in ("number",):
+            arg.is_literal = True
+            raw = self._text(node)
+            arg.literal_value = raw
+            arg.literal_type = "number"
+        elif node.type in ("true", "false"):
+            arg.is_literal = True
+            arg.literal_value = self._text(node) == "true"
+            arg.literal_type = "bool"
+        elif node.type == "identifier":
+            arg.is_variable = True
+            arg.variable_name = self._text(node)
+        elif node.type == "arrow_function":
+            arg.is_expression = True
+            arg.expression_text = self._text(node)
+        else:
+            arg.is_expression = True
+            arg.expression_text = self._text(node)
+
+        return arg
+
+
+# Auto-register
+from ..base import ParserRegistry as _PR  # noqa: E402
+
+_PR.register(JavaScriptParser())

apisec_code_bolt/parsing/jvm/__init__.py

@@ -0,0 +1,7 @@
+"""JVM (Java/Kotlin) parsing using the javalang Python library."""
+
+from ..base import ParserRegistry
+from .parser import JavaParser
+
+# Register the Java parser so the analyzer can dispatch .java files
+ParserRegistry.register(JavaParser())