syncable_cli/analyzer/vulnerability/checkers/

javascript.rs

use std::path::Path;
use std::process::Command;
use log::{info, warn};
use crate::analyzer::dependency_parser::{DependencyInfo, Language};
use crate::analyzer::runtime::{RuntimeDetector, PackageManager};
use crate::analyzer::tool_management::ToolDetector;
use crate::analyzer::vulnerability::{VulnerableDependency, VulnerabilityError, VulnerabilityInfo, VulnerabilitySeverity};
use super::MutableLanguageVulnerabilityChecker;

pub struct JavaScriptVulnerabilityChecker {
    tool_detector: ToolDetector,
}

impl JavaScriptVulnerabilityChecker {
    pub fn new() -> Self {
        Self {
            tool_detector: ToolDetector::new(),
        }
    }
    
    fn execute_audit_for_manager(
        &mut self,
        manager: &PackageManager,
        project_path: &Path,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        match manager {
            PackageManager::Bun => self.execute_bun_audit(project_path, dependencies),
            PackageManager::Npm => self.execute_npm_audit(project_path, dependencies),
            PackageManager::Yarn => self.execute_yarn_audit(project_path, dependencies),
            PackageManager::Pnpm => self.execute_pnpm_audit(project_path, dependencies),
            PackageManager::Unknown => Ok(None),
        }
    }
    
    fn execute_bun_audit(
        &mut self,
        project_path: &Path,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        // Check if bun is available
        let bun_status = self.tool_detector.detect_tool("bun");
        if !bun_status.available {
            warn!("bun not found, skipping bun audit");
            return Ok(None);
        }
        
        info!("Executing bun audit in {}", project_path.display());
        
        // Execute bun audit --json
        let output = Command::new("bun")
            .args(&["audit", "--json"])
            .current_dir(project_path)
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run bun audit: {}", e)
            ))?;
        
        // bun audit returns non-zero exit code when vulnerabilities found
        // This is expected behavior, not an error
        if !output.status.success() && !output.stdout.is_empty() {
            info!("bun audit completed with findings");
        }
        
        if output.stdout.is_empty() {
            return Ok(None);
        }
        
        // Parse bun audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)
            .map_err(|e| VulnerabilityError::ParseError(
                format!("Failed to parse bun audit output: {}", e)
            ))?;
        
        self.parse_bun_audit_output(&audit_data, dependencies)
    }
    
    fn execute_npm_audit(
        &mut self,
        project_path: &Path,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        // Check if npm is available
        let npm_status = self.tool_detector.detect_tool("npm");
        if !npm_status.available {
            warn!("npm not found, skipping npm audit");
            return Ok(None);
        }
        
        info!("Executing npm audit in {}", project_path.display());
        
        // Execute npm audit --json
        let output = Command::new("npm")
            .args(&["audit", "--json"])
            .current_dir(project_path)
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run npm audit: {}", e)
            ))?;
        
        // npm audit returns 0 even when vulnerabilities are found
        // Non-zero exit code indicates an actual error
        if !output.status.success() && output.stdout.is_empty() {
            return Err(VulnerabilityError::CommandError(
                format!("npm audit failed with exit code {}: {}", 
                    output.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&output.stderr))
            ));
        }
        
        if output.stdout.is_empty() {
            return Ok(None);
        }
        
        // Parse npm audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)
            .map_err(|e| VulnerabilityError::ParseError(
                format!("Failed to parse npm audit output: {}", e)
            ))?;
        
        self.parse_npm_audit_output(&audit_data, dependencies)
    }
    
    fn execute_yarn_audit(
        &mut self,
        project_path: &Path,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        // Check if yarn is available
        let yarn_status = self.tool_detector.detect_tool("yarn");
        if !yarn_status.available {
            warn!("yarn not found, skipping yarn audit");
            return Ok(None);
        }
        
        info!("Executing yarn audit in {}", project_path.display());
        
        // Execute yarn audit --json
        let output = Command::new("yarn")
            .args(&["audit", "--json"])
            .current_dir(project_path)
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run yarn audit: {}", e)
            ))?;
        
        // yarn audit behavior: returns 0 even when vulnerabilities are found
        // Non-zero exit code indicates an actual error
        if !output.status.success() && output.stdout.is_empty() {
            return Err(VulnerabilityError::CommandError(
                format!("yarn audit failed with exit code {}: {}", 
                    output.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&output.stderr))
            ));
        }
        
        if output.stdout.is_empty() {
            return Ok(None);
        }
        
        // Parse yarn audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)
            .map_err(|e| VulnerabilityError::ParseError(
                format!("Failed to parse yarn audit output: {}", e)
            ))?;
        
        self.parse_yarn_audit_output(&audit_data, dependencies)
    }
    
    fn execute_pnpm_audit(
        &mut self,
        project_path: &Path,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        // Check if pnpm is available
        let pnpm_status = self.tool_detector.detect_tool("pnpm");
        if !pnpm_status.available {
            warn!("pnpm not found, skipping pnpm audit");
            return Ok(None);
        }
        
        info!("Executing pnpm audit in {}", project_path.display());
        
        // Execute pnpm audit --json
        let output = Command::new("pnpm")
            .args(&["audit", "--json"])
            .current_dir(project_path)
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run pnpm audit: {}", e)
            ))?;
        
        // pnpm audit behavior: returns 0 even when vulnerabilities are found
        // Non-zero exit code indicates an actual error
        if !output.status.success() && output.stdout.is_empty() {
            return Err(VulnerabilityError::CommandError(
                format!("pnpm audit failed with exit code {}: {}", 
                    output.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&output.stderr))
            ));
        }
        
        if output.stdout.is_empty() {
            return Ok(None);
        }
        
        // Parse pnpm audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)
            .map_err(|e| VulnerabilityError::ParseError(
                format!("Failed to parse pnpm audit output: {}", e)
            ))?;
        
        self.parse_pnpm_audit_output(&audit_data, dependencies)
    }
    
    fn parse_bun_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        
        // Bun audit JSON structure parsing
        // Bun returns a JSON object where keys are package names and values are arrays of vulnerabilities
        if let Some(obj) = audit_data.as_object() {
            for (package_name, vulnerabilities) in obj {
                if let Some(vuln_array) = vulnerabilities.as_array() {
                    // Find matching dependency
                    if let Some(dep) = dependencies.iter().find(|d| d.name == *package_name) {
                        let mut package_vulns = Vec::new();
                        
                        for vulnerability in vuln_array {
                            // Extract vulnerability information
                            let id = vulnerability.get("id").and_then(|i| i.as_u64())
                                .map(|id| id.to_string())
                                .unwrap_or("unknown".to_string());
                            let title = vulnerability.get("title").and_then(|t| t.as_str())
                                .unwrap_or("Unknown vulnerability").to_string();
                            let description = vulnerability.get("title").and_then(|t| t.as_str())
                                .unwrap_or("").to_string();
                            let severity = self.parse_severity(vulnerability.get("severity").and_then(|s| s.as_str()));
                            let affected_versions = vulnerability.get("vulnerable_versions").and_then(|v| v.as_str())
                                .unwrap_or("*").to_string();
                            let cwe = vulnerability.get("cwe").and_then(|c| c.as_array())
                                .and_then(|arr| arr.first())
                                .and_then(|v| v.as_str())
                                .map(|s| s.to_string());
                            let url = vulnerability.get("url").and_then(|u| u.as_str())
                                .map(|s| s.to_string());
                            
                            let vuln_info = VulnerabilityInfo {
                                id,
                                vuln_type: "security".to_string(),  // Security vulnerability
                                severity,
                                title,
                                description,
                                cve: cwe.clone(), // Using CWE as CVE for now
                                ghsa: url.clone().filter(|u| u.contains("GHSA")).map(|u| {
                                    u.split('/').last().unwrap_or(&u).to_string()
                                }),
                                affected_versions,
                                patched_versions: None, // Bun doesn't provide this directly
                                published_date: None, // Bun audit may not provide this
                                references: url.map(|u| vec![u]).unwrap_or_default(),
                            };
                            
                            package_vulns.push(vuln_info);
                        }
                        
                        if !package_vulns.is_empty() {
                            vulnerable_deps.push(VulnerableDependency {
                                name: dep.name.clone(),
                                version: dep.version.clone(),
                                language: Language::JavaScript,
                                vulnerabilities: package_vulns,
                            });
                        }
                    }
                }
            }
        }
        
        if vulnerable_deps.is_empty() {
            Ok(None)
        } else {
            Ok(Some(vulnerable_deps))
        }
    }
    
    fn parse_npm_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        
        // NPM audit JSON structure parsing
        // NPM returns a JSON object with a "vulnerabilities" field containing package vulnerabilities
        if let Some(vulnerabilities) = audit_data.get("vulnerabilities").and_then(|v| v.as_object()) {
            for (package_name, vulnerability_info) in vulnerabilities {
                // Find matching dependency
                if let Some(dep) = dependencies.iter().find(|d| d.name == *package_name) {
                    let mut package_vulns = Vec::new();
                    
                    // Get vulnerability details from the "via" array
                    if let Some(via) = vulnerability_info.get("via").and_then(|v| v.as_array()) {
                        for advisory in via {
                            if let Some(advisory_obj) = advisory.as_object() {
                                // Skip if this is just a reference to another package
                                if advisory_obj.contains_key("source") && !advisory_obj.contains_key("title") {
                                    continue;
                                }
                                
                                let id = advisory_obj.get("source")
                                    .and_then(|s| s.as_u64())
                                    .map(|id| id.to_string())
                                    .or_else(|| advisory_obj.get("url")
                                        .and_then(|u| u.as_str())
                                        .and_then(|url| {
                                            if url.contains("GHSA") {
                                                url.split('/').last().map(|s| s.to_string())
                                            } else {
                                                None
                                            }
                                        }))
                                    .unwrap_or("unknown".to_string());
                                
                                let title = advisory_obj.get("title").and_then(|t| t.as_str())
                                    .unwrap_or("Unknown vulnerability").to_string();
                                let description = title.clone();
                                let severity = self.parse_severity(advisory_obj.get("severity").and_then(|s| s.as_str()));
                                
                                let range = advisory_obj.get("range").and_then(|r| r.as_str())
                                    .unwrap_or("*").to_string();
                                
                                let cwe = advisory_obj.get("cwe").and_then(|c| c.as_array())
                                    .and_then(|arr| arr.first())
                                    .and_then(|v| v.as_str())
                                    .map(|s| s.to_string());
                                
                                let url = advisory_obj.get("url").and_then(|u| u.as_str())
                                    .map(|s| s.to_string());
                                
                                let vuln_info = VulnerabilityInfo {
                                    id,
                                    vuln_type: "security".to_string(),  // Security vulnerability
                                    severity,
                                    title,
                                    description,
                                    cve: cwe.clone(),
                                    ghsa: url.clone().filter(|u| u.contains("GHSA")).map(|u| {
                                        u.split('/').last().unwrap_or(&u).to_string()
                                    }),
                                    affected_versions: range,
                                    patched_versions: None, // NPM doesn't provide this directly in via
                                    published_date: None,
                                    references: url.map(|u| vec![u]).unwrap_or_default(),
                                };
                                
                                package_vulns.push(vuln_info);
                            }
                        }
                    }
                    
                    if !package_vulns.is_empty() {
                        vulnerable_deps.push(VulnerableDependency {
                            name: dep.name.clone(),
                            version: dep.version.clone(),
                            language: Language::JavaScript,
                            vulnerabilities: package_vulns,
                        });
                    }
                }
            }
        }
        
        if vulnerable_deps.is_empty() {
            Ok(None)
        } else {
            Ok(Some(vulnerable_deps))
        }
    }
    
    fn parse_yarn_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        
        // Yarn audit JSON structure parsing
        // Yarn returns audit data in a different format than npm
        if let Some(data) = audit_data.get("data").and_then(|d| d.as_object()) {
            if let Some(advisories) = data.get("advisories").and_then(|a| a.as_object()) {
                for (advisory_id, advisory) in advisories {
                    if let Some(advisory_obj) = advisory.as_object() {
                        let package_name = advisory_obj.get("module_name").and_then(|n| n.as_str())
                            .unwrap_or("").to_string();
                        
                        // Find matching dependency
                        if let Some(dep) = dependencies.iter().find(|d| d.name == package_name) {
                            let id = advisory_id.clone();
                            let title = advisory_obj.get("title").and_then(|t| t.as_str())
                                .unwrap_or("Unknown vulnerability").to_string();
                            let description = advisory_obj.get("overview").and_then(|o| o.as_str())
                                .unwrap_or("").to_string();
                            let severity = self.parse_severity(advisory_obj.get("severity").and_then(|s| s.as_str()));
                            let vulnerable_versions = advisory_obj.get("vulnerable_versions").and_then(|v| v.as_str())
                                .unwrap_or("*").to_string();
                            
                            let cve = advisory_obj.get("cves").and_then(|c| c.as_array())
                                .and_then(|arr| arr.first())
                                .and_then(|v| v.as_str())
                                .map(|s| s.to_string());
                            
                            let url = advisory_obj.get("url").and_then(|u| u.as_str())
                                .map(|s| s.to_string());
                            
                            let vuln_info = VulnerabilityInfo {
                                id,
                                vuln_type: "security".to_string(),  // Security vulnerability
                                severity,
                                title,
                                description,
                                cve,
                                ghsa: url.clone().filter(|u| u.contains("GHSA")).map(|u| {
                                    u.split('/').last().unwrap_or(&u).to_string()
                                }),
                                affected_versions: vulnerable_versions,
                                patched_versions: advisory_obj.get("patched_versions").and_then(|p| p.as_str()).map(|s| s.to_string()),
                                published_date: None,
                                references: url.map(|u| vec![u]).unwrap_or_default(),
                            };
                            
                            // Check if we already have this dependency
                            if let Some(existing) = vulnerable_deps.iter_mut().find(|vuln_dep| vuln_dep.name == package_name) {
                                existing.vulnerabilities.push(vuln_info);
                            } else {
                                vulnerable_deps.push(VulnerableDependency {
                                    name: dep.name.clone(),
                                    version: dep.version.clone(),
                                    language: Language::JavaScript,
                                    vulnerabilities: vec![vuln_info],
                                });
                            }
                        }
                    }
                }
            }
        }
        
        if vulnerable_deps.is_empty() {
            Ok(None)
        } else {
            Ok(Some(vulnerable_deps))
        }
    }
    
    fn parse_pnpm_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
        // PNPM audit output is similar to NPM
        self.parse_npm_audit_output(audit_data, dependencies)
    }
    
    fn parse_severity(&self, severity: Option<&str>) -> VulnerabilitySeverity {
        match severity.map(|s| s.to_lowercase()).as_deref() {
            Some("critical") => VulnerabilitySeverity::Critical,
            Some("high") => VulnerabilitySeverity::High,
            Some("moderate") => VulnerabilitySeverity::Medium,
            Some("medium") => VulnerabilitySeverity::Medium,
            Some("low") => VulnerabilitySeverity::Low,
            _ => VulnerabilitySeverity::Medium, // Default to medium if not specified
        }
    }
}

impl MutableLanguageVulnerabilityChecker for JavaScriptVulnerabilityChecker {
    fn check_vulnerabilities(
        &mut self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking JavaScript/TypeScript dependencies");
        
        let runtime_detector = RuntimeDetector::new(project_path.to_path_buf());
        let _detection_result = runtime_detector.detect_js_runtime_and_package_manager();
        
        info!("Runtime detection: {}", runtime_detector.get_detection_summary());
        
        // Get all available package managers
        let available_managers = runtime_detector.detect_all_package_managers();
        
        // Execute audit commands for each available manager
        let mut all_vulnerabilities = Vec::new();
        
        for manager in available_managers {
            if let Some(vulns) = self.execute_audit_for_manager(&manager, project_path, dependencies)? {
                all_vulnerabilities.extend(vulns);
            }
        }
        
        Ok(all_vulnerabilities)
    }
}