Skip to content

refactor: improve warnings usage and TS definitions #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 18, 2022
Merged

refactor: improve warnings usage and TS definitions #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 21 additions & 22 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,24 +77,23 @@ The analysis will return: `http` (in try), `crypto`, `util` and `fs`.

This section describes how use `warnings` export.

The structure of the `warnings` is as follows:
```js
/**
* @property {object} warnings - The default values for Constants.
* @property {string} warnings[name] - The default warning name (parsingError, unsafeImport etc...).
* @property {string} warnings[name].i18n - i18n token.
* @property {string} warnings[name].code - Used to perform unit tests.
* @property {string} warnings[name].severity - Warning severity.
*/

export const warnings = Object.freeze({
parsingError: {
i18n: "sast_warnings.ast_error"
code: "ast-error",
severity: "Information"
},
...otherWarnings
});
```ts
type WarningName = "parsing-error"
| "encoded-literal"
| "unsafe-regex"
| "unsafe-stmt"
| "unsafe-assign"
| "short-identifiers"
| "suspicious-literal"
| "obfuscated-code"
| "weak-crypto"
| "unsafe-import";

declare const warnings: Record<WarningName, {
i18n: string;
severity: "Information" | "Warning" | "Critical";
experimental?: boolean;
}>;
```

We make a call to `i18n` through the package `NodeSecure/i18n` to get the translation.
Expand All @@ -103,7 +102,7 @@ We make a call to `i18n` through the package `NodeSecure/i18n` to get the transl
import * as jsxray from "@nodesecure/js-x-ray";
import * as i18n from "@nodesecure/i18n";

console.log(i18n.getToken(jsxray.warnings.parsingError.i18n));
console.log(i18n.getToken(jsxray.warnings["parsing-error"].i18n));
```

## Warnings Legends
Expand Down Expand Up @@ -142,7 +141,7 @@ The method take a first argument which is the code you want to analyse. It will
```ts
interface Report {
dependencies: ASTDeps;
warnings: Warning<BaseWarning>[];
warnings: Warning[];
idsLengthAvg: number;
stringScore: number;
isOneLineRequire: boolean;
Expand All @@ -166,12 +165,12 @@ Run the SAST scanner on a given JavaScript file.
```ts
export type ReportOnFile = {
ok: true,
warnings: Warning<BaseWarning>[];
warnings: Warning[];
dependencies: ASTDeps;
isMinified: boolean;
} | {
ok: false,
warnings: Warning<BaseWarning>[];
warnings: Warning[];
}
```

Expand Down
172 changes: 33 additions & 139 deletions index.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,140 +1,34 @@
declare class ASTDeps {
constructor();
removeByName(name: string): void;
add(depName: string): void;
getDependenciesInTryStatement(): IterableIterator<string>;

public isInTryStmt: boolean;
public dependencies: Record<string, JSXRay.Dependency>;
public readonly size: number;
}

declare namespace JSXRay {
type kindWithValue = "parsing-error"
| "encoded-literal"
| "unsafe-regex"
| "unsafe-stmt"
| "unsafe-assign"
| "short-identifiers"
| "suspicious-literal"
| "obfuscated-code"
| "weak-crypto";

type WarningLocation = [[number, number], [number, number]];
interface BaseWarning {
kind: "unsafe-import" | kindWithValue;
file?: string;
value: string;
location: WarningLocation | WarningLocation[];
}

type Warning<T extends BaseWarning> = T extends { kind: kindWithValue } ? T : Omit<T, "value">;

interface Report {
dependencies: ASTDeps;
warnings: Warning<BaseWarning>[];
idsLengthAvg: number;
stringScore: number;
isOneLineRequire: boolean;
}

interface SourceLocation {
start: {
line: number;
column: number;
};
end: {
line: number;
column: number;
}
}

interface Dependency {
unsafe: boolean;
inTry: boolean;
location?: SourceLocation;
}

interface WarningsNames {
parsingError: {
code: "ast-error",
i18n: "sast_warnings.ast_error",
severity: "Information"
},
unsafeImport: {
code: "unsafe-import",
i18n: "sast_warnings.unsafe_import",
severity: "Warning"
},
unsafeRegex: {
code: "unsafe-regex",
i18n: "sast_warnings.unsafe_regex",
severity: "Warning"
},
unsafeStmt: {
code: "unsafe-stmt",
i18n: "sast_warnings.unsafe_stmt",
severity: "Warning"
},
unsafeAssign: {
code: "unsafe-assign",
i18n: "sast_warnings.unsafe_assign",
severity: "Warning"
},
encodedLiteral: {
code: "encoded-literal",
i18n: "sast_warnings.encoded_literal",
severity: "Information"
},
shortIdentifiers: {
code: "short-identifiers",
i18n: "sast_warnings.short_identifiers",
severity: "Warning"
},
suspiciousLiteral: {
code: "suspicious-literal",
i18n: "sast_warnings.suspicious_literal",
severity: "Warning"
},
obfuscatedCode: {
code: "obfuscated-code",
i18n: "sast_warnings.obfuscated_code",
severity: "Critical"
},
weakCrypto: {
code: "weak-crypto",
i18n: "sast_warnings.weak_crypto",
severity: "Information",
experimental: true
}
}

interface RuntimeOptions {
module?: boolean;
isMinified?: boolean;
}

export function runASTAnalysis(str: string, options?: RuntimeOptions): Report;

export type ReportOnFile = {
ok: true,
warnings: Warning<BaseWarning>[];
dependencies: ASTDeps;
isMinified: boolean;
} | {
ok: false,
warnings: Warning<BaseWarning>[];
}

export interface RuntimeFileOptions {
packageName?: string;
module?: boolean;
}

export function runASTAnalysisOnFile(pathToFile: string, options?: RuntimeFileOptions): Promise<ReportOnFile>;

export const warnings: WarningsNames;
import {
runASTAnalysis,
runASTAnalysisOnFile,
Report,
ReportOnFile,
RuntimeFileOptions,
RuntimeOptions
} from "./types/api";
import {
Warning,
WarningDefault,
WarningLocation,
WarningName,
WarningNameWithValue
} from "./types/warnings";
import { ASTDeps } from "./types/astdeps";

declare const warnings: Record<WarningName, Pick<WarningDefault, "experimental" | "i18n" | "severity">>;

export {
warnings,
runASTAnalysis,
runASTAnalysisOnFile,
Report,
ReportOnFile,
RuntimeFileOptions,
RuntimeOptions,
ASTDeps,
Warning,
WarningDefault,
WarningLocation,
WarningName,
WarningNameWithValue
}

export = JSXRay;
export as namespace JSXRay;
58 changes: 2 additions & 56 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import isMinified from "is-minified-code";

// Import Internal Dependencies
import Analysis from "./src/Analysis.js";
import { warnings } from "./src/warnings.js";

export function runASTAnalysis(str, options = Object.create(null)) {
const { module = true, isMinified = false } = options;
Expand Down Expand Up @@ -83,59 +84,4 @@ export async function runASTAnalysisOnFile(pathToFile, options = {}) {
}
}

export const warnings = Object.freeze({
parsingError: {
code: "ast-error",
i18n: "sast_warnings.ast_error",
severity: "Information"
},
unsafeImport: {
code: "unsafe-import",
i18n: "sast_warnings.unsafe_import",
severity: "Warning"
},
unsafeRegex: {
code: "unsafe-regex",
i18n: "sast_warnings.unsafe_regex",
severity: "Warning"
},
unsafeStmt: {
code: "unsafe-stmt",
i18n: "sast_warnings.unsafe_stmt",
severity: "Warning"
},
unsafeAssign: {
code: "unsafe-assign",
i18n: "sast_warnings.unsafe_assign",
severity: "Warning"
},
encodedLiteral: {
code: "encoded-literal",
i18n: "sast_warnings.encoded_literal",
severity: "Information"
},
shortIdentifiers: {
code: "short-identifiers",
i18n: "sast_warnings.short_identifiers",
severity: "Warning"
},
suspiciousLiteral: {
code: "suspicious-literal",
i18n: "sast_warnings.suspicious_literal",
severity: "Warning"
},
obfuscatedCode: {
code: "obfuscated-code",
i18n: "sast_warnings.obfuscated_code",
severity: "Critical",
experimental: true
},
weakCrypto: {
code: "weak-crypto",
i18n: "sast_warnings.weak_crypto",
severity: "Information",
experimental: true
}
});


export { warnings };
Loading