jsdet_cli/

venin.rs

use std::collections::BTreeMap;
use std::fs;
use std::path::{Path, PathBuf};
use std::process::Command;

use anyhow::{Context, Result, bail};
use serde::Deserialize;

use crate::npm::{PackageFinding, PackageScanResult, RuleSeverity};

const VENIN_BIN_ENV: &str = "JSDET_VENIN_BIN";
const VENIN_FRAMEWORKS_ENV: &str = "JSDET_VENIN_FRAMEWORKS";

/// Runs Venin taint analysis against a JavaScript package directory and converts
/// high-confidence findings into jsdet's npm finding format.
///
/// # Examples
///
/// ```rust,no_run
/// use jsdet_cli::venin::scan_npm_package_with_venin;
///
/// let result = scan_npm_package_with_venin("/tmp/real-scan/express").unwrap();
/// println!("{}", result.findings.len());
/// ```
pub fn scan_npm_package_with_venin(path: impl AsRef<Path>) -> Result<PackageScanResult> {
    let package_dir = path.as_ref();
    if !package_dir.is_dir() {
        bail!(
            "failed to taint-scan {}. Fix: provide a directory containing JavaScript source",
            package_dir.display()
        );
    }

    let (venin_bin, frameworks_dir) = resolve_venin_installation()?;
    let manifest = read_package_manifest(package_dir)?;
    let output = Command::new(&venin_bin)
        .arg("scan")
        .arg(package_dir)
        .arg("--frameworks")
        .arg(&frameworks_dir)
        .arg("--language")
        .arg("java-script")
        .arg("--mode")
        .arg("fast")
        .arg("--format")
        .arg("json")
        .output()
        .with_context(|| {
            format!(
                "failed to launch Venin at {}. Fix: verify the binary is executable or set {}",
                venin_bin.display(),
                VENIN_BIN_ENV
            )
        })?;

    if !output.status.success() {
        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
        bail!(
            "Venin taint scan failed for {}. Fix: verify the project parses under Venin and that framework rules exist at {}. stderr: {}",
            package_dir.display(),
            frameworks_dir.display(),
            stderr
        );
    }

    let report: VeninScanReport = serde_json::from_slice(&output.stdout).with_context(|| {
        format!(
            "failed to parse Venin JSON output for {}. Fix: ensure Venin emits valid --format json output",
            package_dir.display()
        )
    })?;

    Ok(PackageScanResult {
        package_name: manifest.name,
        package_version: manifest.version,
        findings: convert_findings(package_dir, report.findings),
    })
}

#[derive(Debug, Clone)]
struct VeninInstallation {
    bin: PathBuf,
    frameworks: PathBuf,
}

fn resolve_venin_installation() -> Result<(PathBuf, PathBuf)> {
    if let (Some(bin), Some(frameworks)) = (
        std::env::var_os(VENIN_BIN_ENV),
        std::env::var_os(VENIN_FRAMEWORKS_ENV),
    ) {
        let installation = VeninInstallation {
            bin: PathBuf::from(bin),
            frameworks: PathBuf::from(frameworks),
        };
        validate_installation(&installation)?;
        return Ok((installation.bin, installation.frameworks));
    }

    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
    let repo_root = manifest_dir
        .parent()
        .and_then(Path::parent)
        .map(Path::to_path_buf)
        .context("failed to resolve jsdet workspace root. Fix: run from a valid jsdet checkout")?;

    let candidates = [
        repo_root.join("software/venin"),
        repo_root.join("../software/venin"),
        repo_root.join("../../software/venin"),
    ];

    for candidate in candidates {
        let installation = VeninInstallation {
            bin: candidate.join("target/release/venin"),
            frameworks: candidate.join("frameworks"),
        };
        if installation.bin.is_file() && installation.frameworks.is_dir() {
            return Ok((installation.bin, installation.frameworks));
        }

        let installation = VeninInstallation {
            bin: candidate.join("target/debug/venin"),
            frameworks: candidate.join("frameworks"),
        };
        if installation.bin.is_file() && installation.frameworks.is_dir() {
            return Ok((installation.bin, installation.frameworks));
        }
    }

    bail!(
        "failed to locate Venin. Fix: build Venin under software/venin/target/{{debug,release}}/venin or set {} and {}",
        VENIN_BIN_ENV,
        VENIN_FRAMEWORKS_ENV
    );
}

fn validate_installation(installation: &VeninInstallation) -> Result<()> {
    if !installation.bin.is_file() {
        bail!(
            "{} points to {}, which is not a file. Fix: set it to the Venin CLI binary",
            VENIN_BIN_ENV,
            installation.bin.display()
        );
    }
    if !installation.frameworks.is_dir() {
        bail!(
            "{} points to {}, which is not a directory. Fix: set it to Venin's frameworks directory",
            VENIN_FRAMEWORKS_ENV,
            installation.frameworks.display()
        );
    }
    Ok(())
}

fn convert_findings(package_dir: &Path, findings: Vec<VeninFinding>) -> Vec<PackageFinding> {
    let mut deduped = BTreeMap::<String, PackageFinding>::new();

    for finding in findings {
        let Some(severity) = RuleSeverity::from_reported_str(&finding.severity) else {
            continue;
        };
        if !matches!(severity, RuleSeverity::Critical | RuleSeverity::High) {
            continue;
        }

        let sink = &finding.sink;
        let cwe = normalize_cwe(&finding.cwe);
        let file = relativize_path(package_dir, &sink.file);
        let evidence = build_evidence(&finding, sink);
        let rule_id = cwe
            .clone()
            .unwrap_or_else(|| sink.category.to_ascii_uppercase());
        let key = format!(
            "{}:{}:{}",
            file,
            sink.line,
            cwe.as_deref().unwrap_or("UNKNOWN")
        );
        let message = build_message(&finding, sink);

        let candidate = PackageFinding {
            id: rule_id,
            severity,
            cwe,
            description: format!(
                "{} Fix: validate, sanitize, or constrain the tainted value before it reaches {}",
                message, sink.function
            ),
            file,
            line: sink.line,
            evidence,
        };

        match deduped.get(&key) {
            Some(existing)
                if severity_rank(existing.severity) > severity_rank(candidate.severity) => {}
            Some(existing)
                if severity_rank(existing.severity) == severity_rank(candidate.severity)
                    && !existing.description.is_empty()
                    && existing.evidence.len() >= candidate.evidence.len() => {}
            _ => {
                deduped.insert(key, candidate);
            }
        }
    }

    deduped.into_values().collect()
}

fn severity_rank(severity: RuleSeverity) -> u8 {
    match severity {
        RuleSeverity::Critical => 4,
        RuleSeverity::High => 3,
        RuleSeverity::Medium => 2,
        RuleSeverity::Low => 1,
        _ => 0,
    }
}

trait RuleSeverityExt {
    fn from_reported_str(value: &str) -> Option<RuleSeverity>;
}

impl RuleSeverityExt for RuleSeverity {
    fn from_reported_str(value: &str) -> Option<RuleSeverity> {
        match value.trim().to_ascii_uppercase().as_str() {
            "CRITICAL" => Some(RuleSeverity::Critical),
            "HIGH" => Some(RuleSeverity::High),
            "MEDIUM" => Some(RuleSeverity::Medium),
            "LOW" => Some(RuleSeverity::Low),
            _ => None,
        }
    }
}

fn build_message(finding: &VeninFinding, sink: &VeninLocation) -> String {
    format!(
        "{} ({} at {}:{})",
        finding.title, sink.category, sink.file, sink.line
    )
}

fn build_evidence(finding: &VeninFinding, sink: &VeninLocation) -> String {
    let source = &finding.source;
    let mut parts = Vec::with_capacity(finding.steps.len() + 2);
    parts.push(format!(
        "source {}:{} {}",
        source.file,
        source.line,
        source.snippet.trim()
    ));
    for step in &finding.steps {
        let snippet = step.snippet.trim();
        if snippet.is_empty() {
            parts.push(format!(
                "step {}:{} {}",
                step.file, step.line, step.description
            ));
        } else {
            parts.push(format!(
                "step {}:{} {} [{}]",
                step.file, step.line, step.description, snippet
            ));
        }
    }
    parts.push(format!(
        "sink {}:{} {}",
        sink.file,
        sink.line,
        sink.snippet.trim()
    ));
    parts.join(" -> ")
}

fn relativize_path(package_dir: &Path, file: &str) -> String {
    let path = Path::new(file);
    path.strip_prefix(package_dir)
        .unwrap_or(path)
        .to_string_lossy()
        .replace('\\', "/")
}

fn normalize_cwe(cwe: &str) -> Option<String> {
    let trimmed = cwe.trim();
    if trimmed.is_empty() {
        None
    } else {
        Some(trimmed.to_ascii_uppercase())
    }
}

#[derive(Debug, Clone, Deserialize)]
struct PackageManifest {
    #[serde(default)]
    name: String,
    #[serde(default)]
    version: String,
}

fn read_package_manifest(package_dir: &Path) -> Result<PackageManifest> {
    let package_json = package_dir.join("package.json");
    if !package_json.is_file() {
        return Ok(PackageManifest {
            name: package_dir
                .file_name()
                .and_then(|name| name.to_str())
                .map_or_else(|| "unknown-package".to_string(), ToOwned::to_owned),
            version: "0.0.0".to_string(),
        });
    }

    let text = fs::read_to_string(&package_json).with_context(|| {
        format!(
            "failed to read {}. Fix: provide a readable package.json or remove the broken manifest",
            package_json.display()
        )
    })?;
    let manifest: PackageManifest = serde_json::from_str(&text).with_context(|| {
        format!(
            "failed to parse {}. Fix: ensure package.json is valid JSON",
            package_json.display()
        )
    })?;

    Ok(PackageManifest {
        name: if manifest.name.trim().is_empty() {
            package_dir
                .file_name()
                .and_then(|name| name.to_str())
                .map_or_else(|| "unknown-package".to_string(), ToOwned::to_owned)
        } else {
            manifest.name
        },
        version: if manifest.version.trim().is_empty() {
            "0.0.0".to_string()
        } else {
            manifest.version
        },
    })
}

#[derive(Debug, Clone, Deserialize)]
struct VeninScanReport {
    #[serde(default)]
    findings: Vec<VeninFinding>,
}

#[derive(Debug, Clone, Deserialize)]
struct VeninFinding {
    severity: String,
    title: String,
    cwe: String,
    source: VeninLocation,
    #[serde(default)]
    steps: Vec<VeninStep>,
    sink: VeninLocation,
}

#[derive(Debug, Clone, Deserialize)]
struct VeninLocation {
    file: String,
    line: usize,
    #[serde(default)]
    snippet: String,
    #[serde(default)]
    category: String,
    #[serde(default)]
    function: String,
}

#[derive(Debug, Clone, Deserialize)]
struct VeninStep {
    file: String,
    line: usize,
    description: String,
    #[serde(default)]
    snippet: String,
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::ffi::OsString;

    #[test]
    fn converts_and_deduplicates_high_and_critical_venin_findings() {
        let package_dir = Path::new("/tmp/pkg");
        let findings = vec![
            VeninFinding {
                severity: "HIGH".to_string(),
                title: "SQL Injection".to_string(),
                cwe: "CWE-89".to_string(),
                source: VeninLocation {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 3,
                    snippet: "req.query.id".to_string(),
                    category: "http-param".to_string(),
                    function: "query".to_string(),
                },
                steps: vec![VeninStep {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 4,
                    description: "taint propagated through call".to_string(),
                    snippet: "lookup(req.query.id)".to_string(),
                }],
                sink: VeninLocation {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 9,
                    snippet: "db.query(sql)".to_string(),
                    category: "sql-injection".to_string(),
                    function: "db.query".to_string(),
                },
            },
            VeninFinding {
                severity: "HIGH".to_string(),
                title: "SQL Injection".to_string(),
                cwe: "CWE-89".to_string(),
                source: VeninLocation {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 3,
                    snippet: "req.query.id".to_string(),
                    category: "http-param".to_string(),
                    function: "query".to_string(),
                },
                steps: vec![],
                sink: VeninLocation {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 9,
                    snippet: "db.query(sql)".to_string(),
                    category: "sql-injection".to_string(),
                    function: "db.query".to_string(),
                },
            },
            VeninFinding {
                severity: "MEDIUM".to_string(),
                title: "Open Redirect".to_string(),
                cwe: "CWE-601".to_string(),
                source: VeninLocation {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 12,
                    snippet: "req.get".to_string(),
                    category: "http-header".to_string(),
                    function: "get".to_string(),
                },
                steps: vec![],
                sink: VeninLocation {
                    file: "/tmp/pkg/index.js".to_string(),
                    line: 12,
                    snippet: "res.redirect(url)".to_string(),
                    category: "open-redirect".to_string(),
                    function: "redirect".to_string(),
                },
            },
        ];

        let converted = convert_findings(package_dir, findings);

        assert_eq!(converted.len(), 1);
        assert_eq!(converted[0].id, "CWE-89");
        assert_eq!(converted[0].file, "index.js");
        assert_eq!(converted[0].line, 9);
        assert_eq!(converted[0].severity, RuleSeverity::High);
        assert!(
            converted[0]
                .evidence
                .contains("source /tmp/pkg/index.js:3 req.query.id")
        );
        assert!(
            converted[0]
                .evidence
                .contains("sink /tmp/pkg/index.js:9 db.query(sql)")
        );
    }

    #[test]
    fn honors_env_override_when_present() {
        let tempdir = tempfile::tempdir().expect("tempdir");
        let bin = tempdir.path().join("venin");
        let frameworks = tempdir.path().join("frameworks");
        fs::write(&bin, "#!/bin/sh\nexit 0\n").expect("write mock bin");
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            let mut perms = fs::metadata(&bin).expect("stat mock bin").permissions();
            perms.set_mode(0o755);
            fs::set_permissions(&bin, perms).expect("chmod mock bin");
        }
        fs::create_dir(&frameworks).expect("create frameworks dir");

        let old_bin: Option<OsString> = std::env::var_os(VENIN_BIN_ENV);
        let old_frameworks: Option<OsString> = std::env::var_os(VENIN_FRAMEWORKS_ENV);
        unsafe {
            std::env::set_var(VENIN_BIN_ENV, &bin);
            std::env::set_var(VENIN_FRAMEWORKS_ENV, &frameworks);
        }

        let resolved = resolve_venin_installation().expect("resolve install");

        match old_bin {
            Some(value) => unsafe { std::env::set_var(VENIN_BIN_ENV, value) },
            None => unsafe { std::env::remove_var(VENIN_BIN_ENV) },
        }
        match old_frameworks {
            Some(value) => unsafe { std::env::set_var(VENIN_FRAMEWORKS_ENV, value) },
            None => unsafe { std::env::remove_var(VENIN_FRAMEWORKS_ENV) },
        }

        assert_eq!(resolved.0, bin);
        assert_eq!(resolved.1, frameworks);
    }
}