syncable_cli/analyzer/

vulnerability_checker.rs

use std::collections::HashMap;
use std::process::Command;
use std::path::Path;
use std::fs;

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use thiserror::Error;
use log::{info, warn, error, debug};
use rustsec;
use rayon::prelude::*;

use crate::analyzer::dependency_parser::{DependencyInfo, DependencyType, Language};
use crate::analyzer::tool_installer::ToolInstaller;

#[derive(Debug, Error)]
pub enum VulnerabilityError {
    #[error("Failed to check vulnerabilities: {0}")]
    CheckFailed(String),
    
    #[error("API error: {0}")]
    ApiError(String),
    
    #[error("Command execution failed: {0}")]
    CommandError(String),
    
    #[error("Parse error: {0}")]
    ParseError(String),
    
    #[error("IO error: {0}")]
    Io(#[from] std::io::Error),
    
    #[error("Rustsec error: {0}")]
    Rustsec(#[from] rustsec::Error),
    
    #[error("JSON error: {0}")]
    Json(#[from] serde_json::Error),
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct VulnerabilityInfo {
    pub id: String,
    pub severity: VulnerabilitySeverity,
    pub title: String,
    pub description: String,
    pub cve: Option<String>,
    pub ghsa: Option<String>,
    pub affected_versions: String,
    pub patched_versions: Option<String>,
    pub published_date: Option<DateTime<Utc>>,
    pub references: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord)]
pub enum VulnerabilitySeverity {
    Critical,
    High,
    Medium,
    Low,
    Info,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct VulnerabilityReport {
    pub checked_at: DateTime<Utc>,
    pub total_vulnerabilities: usize,
    pub critical_count: usize,
    pub high_count: usize,
    pub medium_count: usize,
    pub low_count: usize,
    pub vulnerable_dependencies: Vec<VulnerableDependency>,
}

#[derive(Debug, Serialize, Deserialize)]
pub struct VulnerableDependency {
    pub name: String,
    pub version: String,
    pub language: Language,
    pub vulnerabilities: Vec<VulnerabilityInfo>,
}

pub struct VulnerabilityChecker;

impl VulnerabilityChecker {
    pub fn new() -> Self {
        Self
    }
    
    /// Check all dependencies for vulnerabilities
    pub async fn check_all_dependencies(
        &self,
        dependencies: &HashMap<Language, Vec<DependencyInfo>>,
        project_path: &Path,
    ) -> Result<VulnerabilityReport, VulnerabilityError> {
        info!("Starting comprehensive vulnerability check");
        
        // Debug: Show dependency counts by language
        debug!("Dependencies found by language:");
        for (lang, deps) in dependencies {
            debug!("  {:?}: {} dependencies", lang, deps.len());
            if deps.len() > 0 {
                debug!("    Sample dependencies:");
                for dep in deps.iter().take(3) {
                    debug!("      - {} v{}", dep.name, dep.version);
                }
            }
        }
        
        // Auto-install required tools
        let mut installer = ToolInstaller::new();
        let languages: Vec<Language> = dependencies.keys().cloned().collect();
        
        info!("🔧 Checking and installing required vulnerability scanning tools...");
        installer.ensure_tools_for_languages(&languages)
            .map_err(|e| VulnerabilityError::CommandError(format!("Tool installation failed: {}", e)))?;
        
        // Show tool status
        installer.print_tool_status(&languages);
        
        let mut all_vulnerable_deps = Vec::new();
        
        // Process each language in parallel
        let results: Vec<_> = dependencies.par_iter()
            .map(|(language, deps)| {
                self.check_language_dependencies(language, deps, project_path)
            })
            .collect();
        
        // Collect results
        for result in results {
            match result {
                Ok(mut vuln_deps) => all_vulnerable_deps.append(&mut vuln_deps),
                Err(e) => warn!("Error checking vulnerabilities: {}", e),
            }
        }
        
        // Sort by severity
        all_vulnerable_deps.sort_by(|a, b| {
            let a_max = a.vulnerabilities.iter()
                .map(|v| &v.severity)
                .max()
                .unwrap_or(&VulnerabilitySeverity::Info);
            let b_max = b.vulnerabilities.iter()
                .map(|v| &v.severity)
                .max()
                .unwrap_or(&VulnerabilitySeverity::Info);
            b_max.cmp(a_max)
        });
        
        // Count vulnerabilities by severity
        let mut critical_count = 0;
        let mut high_count = 0;
        let mut medium_count = 0;
        let mut low_count = 0;
        let mut total_vulnerabilities = 0;
        
        for dep in &all_vulnerable_deps {
            for vuln in &dep.vulnerabilities {
                total_vulnerabilities += 1;
                match vuln.severity {
                    VulnerabilitySeverity::Critical => critical_count += 1,
                    VulnerabilitySeverity::High => high_count += 1,
                    VulnerabilitySeverity::Medium => medium_count += 1,
                    VulnerabilitySeverity::Low => low_count += 1,
                    VulnerabilitySeverity::Info => {},
                }
            }
        }
        
        Ok(VulnerabilityReport {
            checked_at: Utc::now(),
            total_vulnerabilities,
            critical_count,
            high_count,
            medium_count,
            low_count,
            vulnerable_dependencies: all_vulnerable_deps,
        })
    }
    
    fn check_language_dependencies(
        &self,
        language: &Language,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking {} dependencies for {:?}", dependencies.len(), language);
        
        match language {
            Language::Rust => self.check_rust_dependencies(dependencies),
            Language::JavaScript | Language::TypeScript => {
                self.check_npm_dependencies(dependencies, project_path)
            },
            Language::Python => self.check_python_dependencies(dependencies, project_path),
            Language::Go => self.check_go_dependencies(dependencies, project_path),
            Language::Java | Language::Kotlin => {
                self.check_java_dependencies(dependencies, project_path)
            },
            _ => {
                warn!("Vulnerability checking not yet implemented for {:?}", language);
                Ok(vec![])
            }
        }
    }
    
    /// Check Rust dependencies using RustSec database
    fn check_rust_dependencies(
        &self,
        dependencies: &[DependencyInfo],
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking Rust dependencies with cargo-audit");
        
        // Check if cargo-audit is installed
        let check_output = Command::new("cargo")
            .args(&["audit", "--version"])
            .output();
            
        if check_output.is_err() || !check_output.unwrap().status.success() {
            warn!("cargo-audit not installed. Install with: cargo install cargo-audit");
            warn!("Skipping Rust vulnerability checks");
            return Ok(vec![]);
        }
        
        // Run cargo audit in JSON format
        let output = Command::new("cargo")
            .args(&["audit", "--json"])
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run cargo audit: {}", e)
            ))?;
        
        if output.stdout.is_empty() {
            return Ok(vec![]);
        }
        
        // Parse cargo audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)?;
        
        self.parse_cargo_audit_output(&audit_data, dependencies)
    }
    
    /// Check JavaScript/TypeScript dependencies using npm audit
    fn check_npm_dependencies(
        &self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking npm dependencies with npm audit");
        
        // Check if package.json exists
        let package_json_path = project_path.join("package.json");
        if !package_json_path.exists() {
            debug!("No package.json found, skipping npm audit");
            return Ok(vec![]);
        }
        
        // Run npm audit
        let output = Command::new("npm")
            .args(&["audit", "--json"])
            .current_dir(project_path)
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run npm audit: {}", e)
            ))?;
        
        // Parse npm audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)?;
        
        self.parse_npm_audit_output(&audit_data, dependencies)
    }
    
    /// Check Python dependencies using pip-audit
    fn check_python_dependencies(
        &self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking Python dependencies with pip-audit");
        
        // Check for requirements.txt
        let requirements_file = project_path.join("requirements.txt");
        if !requirements_file.exists() {
            debug!("No requirements.txt found, creating temporary file");
            
            // Create a temporary requirements file
            let temp_req = project_path.join(".temp_requirements_for_audit.txt");
            let mut content = String::new();
            
            for dep in dependencies {
                if dep.dep_type == DependencyType::Production {
                    content.push_str(&format!("{}=={}\n", dep.name, dep.version));
                }
            }
            
            fs::write(&temp_req, content)?;
            
            // Run pip-audit on temp file
            let output = Command::new("pip-audit")
                .args(&["-r", temp_req.to_str().unwrap(), "--format", "json"])
                .output()
                .map_err(|e| {
                    // Clean up temp file
                    let _ = fs::remove_file(&temp_req);
                    VulnerabilityError::CommandError(
                        format!("Failed to run pip-audit (is it installed?): {}", e)
                    )
                })?;
            
            // Clean up temp file
            let _ = fs::remove_file(&temp_req);
            
            if !output.status.success() && output.stdout.is_empty() {
                let stderr = String::from_utf8_lossy(&output.stderr);
                return Err(VulnerabilityError::CommandError(
                    format!("pip-audit failed: {}", stderr)
                ));
            }
            
            // Parse pip-audit output
            let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)?;
            return self.parse_pip_audit_output(&audit_data, dependencies);
        }
        
        // Use existing requirements.txt
        let output = Command::new("pip-audit")
            .args(&["-r", requirements_file.to_str().unwrap(), "--format", "json"])
            .current_dir(project_path)
            .output()
            .map_err(|e| VulnerabilityError::CommandError(
                format!("Failed to run pip-audit (is it installed?): {}", e)
            ))?;
        
        if !output.status.success() && output.stdout.is_empty() {
            let stderr = String::from_utf8_lossy(&output.stderr);
            return Err(VulnerabilityError::CommandError(
                format!("pip-audit failed: {}", stderr)
            ));
        }
        
        // Parse pip-audit output
        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)?;
        
        self.parse_pip_audit_output(&audit_data, dependencies)
    }
    
    /// Check Go dependencies using govulncheck
    fn check_go_dependencies(
        &self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking Go dependencies with govulncheck");
        
        // Check if go.mod exists
        let go_mod_path = project_path.join("go.mod");
        if !go_mod_path.exists() {
            debug!("No go.mod found, skipping govulncheck");
            return Ok(vec![]);
        }
        
        // Try different paths for govulncheck
        let govulncheck_commands = vec![
            "govulncheck".to_string(),
            format!("{}/go/bin/govulncheck", std::env::var("HOME").unwrap_or_else(|_| ".".to_string())),
        ];
        
        let mut last_error = None;
        
        for govulncheck_cmd in govulncheck_commands {
            debug!("Trying govulncheck command: {}", govulncheck_cmd);
            
                         // Run govulncheck
             let output = Command::new(&govulncheck_cmd)
                 .args(&["-json", "./..."])
                 .current_dir(project_path)
                 .output();
                
            match output {
                Ok(result) => {

                    
                    if result.status.success() || !result.stdout.is_empty() {
                        info!("Successfully ran govulncheck using: {}", govulncheck_cmd);
                        return self.parse_govulncheck_output(&result.stdout, dependencies);
                    } else {
                        let stderr = String::from_utf8_lossy(&result.stderr);
                        debug!("govulncheck failed with {}: {}", govulncheck_cmd, stderr);
                        last_error = Some(format!("govulncheck failed: {}", stderr));
                    }
                }
                Err(e) => {
                    debug!("Could not execute {}: {}", govulncheck_cmd, e);
                    last_error = Some(format!("Failed to run govulncheck: {}", e));
                }
            }
        }
        
        // If all attempts failed, return the last error
        if let Some(error) = last_error {
            warn!("govulncheck not available: {}", error);
            warn!("Install with: go install golang.org/x/vuln/cmd/govulncheck@latest");
            warn!("Make sure ~/go/bin is in your PATH");
        }
        
        Ok(vec![])
    }
    
    /// Check Java dependencies using OWASP dependency-check
    fn check_java_dependencies(
        &self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        info!("Checking Java dependencies with multiple scanners");
        
        // Try grype first
        debug!("Attempting grype scan for Java dependencies");
        let grype_result = self.check_java_with_grype(dependencies, project_path);
        
        match grype_result {
            Ok(vulnerabilities) if !vulnerabilities.is_empty() => {
                info!("Found {} vulnerabilities with grype", vulnerabilities.len());
                return Ok(vulnerabilities);
            }
            Ok(_) => {
                warn!("grype found no vulnerabilities for {} Java dependencies", dependencies.len());
                debug!("This could indicate:");
                debug!("  - Dependencies are secure (unlikely for {} deps)", dependencies.len());
                debug!("  - grype's Java vulnerability database is incomplete");
                debug!("  - Project needs to be built for better scanning");
            }
            Err(e) => {
                warn!("grype scan failed: {}", e);
            }
        }
        
        // Try OWASP Dependency Check as fallback
        info!("Attempting OWASP Dependency Check as fallback");
        if let Ok(owasp_vulnerabilities) = self.check_java_with_owasp_dc(dependencies, project_path) {
            if !owasp_vulnerabilities.is_empty() {
                info!("Found {} vulnerabilities with OWASP Dependency Check", owasp_vulnerabilities.len());
                return Ok(owasp_vulnerabilities);
            }
        }
        
        // Try online vulnerability checking for known vulnerable packages
        info!("Checking against known vulnerable packages");
        let known_vulns = self.check_known_vulnerable_java_packages(dependencies);
        if !known_vulns.is_empty() {
            warn!("Found {} known vulnerable packages that scanners missed!", known_vulns.len());
            return Ok(known_vulns);
        }
        
        warn!("No vulnerabilities found by any scanner for {} Java dependencies", dependencies.len());
        warn!("Consider:");
        warn!("  1. Building the project: mvn package");
        warn!("  2. Using a different scanner like Snyk");
        warn!("  3. Checking dependencies manually");
        
        Ok(vec![])
    }
    
    /// Check Java dependencies using grype (original implementation)
    fn check_java_with_grype(
        &self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        // Try different grype locations
        let grype_home = format!("{}/.local/bin/grype", std::env::var("HOME").unwrap_or_default());
        let grype_cmds = vec![
            "grype",
            grype_home.as_str(),
        ];
        
        let mut last_error = None;
        
        for grype_cmd in &grype_cmds {
            // Check if grype is installed
            let check_output = Command::new(grype_cmd)
                .arg("version")
                .output();
                
            if check_output.is_err() || !check_output.unwrap().status.success() {
                continue;
            }
            
            // Try multiple scanning approaches
            let maven_repo_path = format!("{}/.m2/repository", std::env::var("HOME").unwrap_or_default());
            let scan_approaches = vec![
                // Scan project directory
                (vec!["dir:.", "-o", "json", "--only-fixed=false", "--only-notfixed=false"], "project directory"),
                // Scan Maven repository for specific dependencies
                (vec![maven_repo_path.as_str(), "-o", "json"], "Maven repository"),
            ];
            
            for (args, description) in scan_approaches {
                debug!("Trying grype on {} with command: {} {}", description, grype_cmd, args.join(" "));
                
                let output = Command::new(grype_cmd)
                    .args(&args)
                    .current_dir(project_path)
                    .output();
                    
                match output {
                    Ok(result) => {
                        if result.status.success() || !result.stdout.is_empty() {
                            debug!("grype scan of {} completed", description);
                            let vulnerabilities = self.parse_grype_output(&result.stdout, dependencies, Language::Java)?;
                            if !vulnerabilities.is_empty() {
                                info!("Found {} vulnerabilities scanning {}", vulnerabilities.len(), description);
                                return Ok(vulnerabilities);
                            } else {
                                debug!("No vulnerabilities found scanning {}", description);
                            }
                        } else {
                            let stderr = String::from_utf8_lossy(&result.stderr);
                            debug!("grype scan of {} failed: {}", description, stderr);
                            last_error = Some(format!("grype failed on {}: {}", description, stderr));
                        }
                    }
                    Err(e) => {
                        debug!("Failed to run grype {} on {}: {}", grype_cmd, description, e);
                        last_error = Some(format!("Failed to run grype: {}", e));
                    }
                }
            }
        }
        
        // If no grype command worked, return error
        if let Some(err) = last_error {
            return Err(VulnerabilityError::CommandError(err));
        }
        
        warn!("grype not installed. Install with: brew install grype");
        Ok(vec![])
    }
    
    /// Check Java dependencies using OWASP Dependency Check
    fn check_java_with_owasp_dc(
        &self,
        dependencies: &[DependencyInfo],
        project_path: &Path,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        // Check if dependency-check is available
        let dc_cmds = vec![
            "dependency-check",
            "dependency-check.sh",
            "/opt/homebrew/bin/dependency-check",
        ];
        
        for dc_cmd in dc_cmds {
            let check_output = Command::new(dc_cmd)
                .arg("--version")
                .output();
                
            if check_output.is_ok() && check_output.unwrap().status.success() {
                debug!("Found OWASP Dependency Check: {}", dc_cmd);
                
                // Run dependency check
                let output = Command::new(dc_cmd)
                    .args(&[
                        "--project", "vulnerability-scan",
                        "--scan", ".",
                        "--format", "JSON",
                        "--out", "./dependency-check-report",
                        "--enableRetired",
                    ])
                    .current_dir(project_path)
                    .output();
                    
                match output {
                    Ok(result) if result.status.success() => {
                        let report_file = project_path.join("dependency-check-report").join("dependency-check-report.json");
                        if report_file.exists() {
                            let report_content = fs::read_to_string(&report_file)?;
                            let report_data: serde_json::Value = serde_json::from_str(&report_content)?;
                            
                            // Clean up report files
                            let _ = fs::remove_dir_all(project_path.join("dependency-check-report"));
                            
                            return self.parse_owasp_dependency_check_output(&report_data, dependencies);
                        }
                    }
                    _ => {
                        debug!("OWASP Dependency Check failed or not configured properly");
                    }
                }
            }
        }
        
        debug!("OWASP Dependency Check not available");
        Ok(vec![])
    }
    
    /// Check against known vulnerable Java packages
    fn check_known_vulnerable_java_packages(
        &self,
        dependencies: &[DependencyInfo],
    ) -> Vec<VulnerableDependency> {
        let mut vulnerable_deps = Vec::new();
        
        // Known vulnerable packages and versions
        let known_vulnerabilities = vec![
            ("io.jsonwebtoken:jjwt", "0.9.1", vec![
                VulnerabilityInfo {
                    id: "CVE-2019-7644".to_string(),
                    severity: VulnerabilitySeverity::High,
                    title: "JWT signature verification bypass in JJWT".to_string(),
                    description: "JJWT before 0.10.5 allows attackers to bypass signature verification by providing a public key that the attacker controls.".to_string(),
                    cve: Some("CVE-2019-7644".to_string()),
                    ghsa: Some("GHSA-3p3g-vpw6-4w66".to_string()),
                    affected_versions: "< 0.10.5".to_string(),
                    patched_versions: Some(">= 0.10.5".to_string()),
                    published_date: None,
                    references: vec![
                        "https://github.com/jwtk/jjwt/issues/515".to_string(),
                        "https://nvd.nist.gov/vuln/detail/CVE-2019-7644".to_string(),
                    ],
                },
            ]),
            ("org.apache.logging.log4j:log4j-core", "2.17.1", vec![
                VulnerabilityInfo {
                    id: "CVE-2021-44228".to_string(),
                    severity: VulnerabilitySeverity::Critical,
                    title: "Log4j Remote Code Execution (Log4Shell)".to_string(),
                    description: "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.".to_string(),
                    cve: Some("CVE-2021-44228".to_string()),
                    ghsa: Some("GHSA-jfh8-c2jp-5v3q".to_string()),
                    affected_versions: ">= 2.0-beta9, <= 2.15.0".to_string(),
                    patched_versions: Some(">= 2.17.1".to_string()),
                    published_date: None,
                    references: vec![
                        "https://logging.apache.org/log4j/2.x/security.html".to_string(),
                        "https://nvd.nist.gov/vuln/detail/CVE-2021-44228".to_string(),
                    ],
                },
            ]),
            ("com.fasterxml.jackson.core:jackson-databind", "2.14.2", vec![
                VulnerabilityInfo {
                    id: "CVE-2022-42003".to_string(),
                    severity: VulnerabilitySeverity::High,
                    title: "Jackson Databind deserialization vulnerability".to_string(),
                    description: "In FasterXML jackson-databind before versions 2.13.4.1 and 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting.".to_string(),
                    cve: Some("CVE-2022-42003".to_string()),
                    ghsa: Some("GHSA-jjjh-jjxp-wpff".to_string()),
                    affected_versions: "< 2.13.4.1".to_string(),
                    patched_versions: Some(">= 2.13.4.1".to_string()),
                    published_date: None,
                    references: vec![
                        "https://github.com/FasterXML/jackson-databind/issues/3582".to_string(),
                        "https://nvd.nist.gov/vuln/detail/CVE-2022-42003".to_string(),
                    ],
                },
            ]),
        ];
        
        for (package_name, _vulnerable_version, vulns) in known_vulnerabilities {
            if let Some(dep) = dependencies.iter().find(|d| d.name == package_name) {
                debug!("Found known vulnerable package: {} v{}", dep.name, dep.version);
                vulnerable_deps.push(VulnerableDependency {
                    name: dep.name.clone(),
                    version: dep.version.clone(),
                    language: Language::Java,
                    vulnerabilities: vulns,
                });
            }
        }
        
        vulnerable_deps
    }
    
    #[allow(dead_code)]
    fn map_rustsec_severity(&self, severity: &Option<rustsec::advisory::Severity>) -> VulnerabilitySeverity {
        match severity {
            Some(rustsec::advisory::Severity::Critical) => VulnerabilitySeverity::Critical,
            Some(rustsec::advisory::Severity::High) => VulnerabilitySeverity::High,
            Some(rustsec::advisory::Severity::Medium) => VulnerabilitySeverity::Medium,
            Some(rustsec::advisory::Severity::Low) => VulnerabilitySeverity::Low,
            Some(rustsec::advisory::Severity::None) | None => VulnerabilitySeverity::Info,
        }
    }
    
    fn parse_npm_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        let mut vulnerable_deps = Vec::new();
        
        if let Some(vulnerabilities) = audit_data.get("vulnerabilities").and_then(|v| v.as_object()) {
            for (pkg_name, vuln_data) in vulnerabilities {
                if let Some(dep) = dependencies.iter().find(|d| d.name == *pkg_name) {
                    let mut vuln_infos = Vec::new();
                    
                    if let Some(via) = vuln_data.get("via").and_then(|v| v.as_array()) {
                        for item in via {
                            if let Some(obj) = item.as_object() {
                                vuln_infos.push(VulnerabilityInfo {
                                    id: obj.get("source")
                                        .and_then(|s| s.as_str())
                                        .unwrap_or("unknown")
                                        .to_string(),
                                    severity: self.parse_npm_severity(
                                        obj.get("severity")
                                            .and_then(|s| s.as_str())
                                            .unwrap_or("low")
                                    ),
                                    title: obj.get("title")
                                        .and_then(|s| s.as_str())
                                        .unwrap_or("Unknown vulnerability")
                                        .to_string(),
                                    description: obj.get("overview")
                                        .and_then(|s| s.as_str())
                                        .unwrap_or("")
                                        .to_string(),
                                    cve: obj.get("cve")
                                        .and_then(|s| s.as_str())
                                        .map(|s| s.to_string()),
                                    ghsa: obj.get("ghsa")
                                        .and_then(|s| s.as_str())
                                        .map(|s| s.to_string()),
                                    affected_versions: obj.get("vulnerable_versions")
                                        .and_then(|s| s.as_str())
                                        .unwrap_or("*")
                                        .to_string(),
                                    patched_versions: obj.get("patched_versions")
                                        .and_then(|s| s.as_str())
                                        .map(|s| s.to_string()),
                                    published_date: None,
                                    references: vec![],
                                });
                            }
                        }
                    }
                    
                    if !vuln_infos.is_empty() {
                        vulnerable_deps.push(VulnerableDependency {
                            name: dep.name.clone(),
                            version: dep.version.clone(),
                            language: Language::JavaScript,
                            vulnerabilities: vuln_infos,
                        });
                    }
                }
            }
        }
        
        Ok(vulnerable_deps)
    }
    
    fn parse_pip_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        
        // pip-audit JSON format: {"dependencies": [{"name": "package", "version": "1.0", "vulns": [...]}]}
        if let Some(deps) = audit_data.get("dependencies").and_then(|d| d.as_array()) {
            for dep_obj in deps {
                if let Some(dep_data) = dep_obj.as_object() {
                    let name = dep_data.get("name")
                        .and_then(|n| n.as_str())
                        .unwrap_or("")
                        .to_string();
                    
                    let version = dep_data.get("version")
                        .and_then(|v| v.as_str())
                        .unwrap_or("")
                        .to_string();
                    
                    if let Some(vulns) = dep_data.get("vulns").and_then(|v| v.as_array()) {
                        if vulns.is_empty() {
                            continue;
                        }
                        
                        if let Some(dep) = dependencies.iter().find(|d| d.name == name) {
                            let mut vuln_infos = Vec::new();
                            
                            for vuln in vulns {
                                if let Some(vuln_obj) = vuln.as_object() {
                                    vuln_infos.push(VulnerabilityInfo {
                                        id: vuln_obj.get("id")
                                            .and_then(|s| s.as_str())
                                            .unwrap_or("unknown")
                                            .to_string(),
                                        severity: self.parse_pip_severity(
                                            vuln_obj.get("severity")
                                                .and_then(|s| s.as_str())
                                        ),
                                        title: vuln_obj.get("description")
                                            .and_then(|s| s.as_str())
                                            .unwrap_or("Unknown vulnerability")
                                            .to_string(),
                                        description: vuln_obj.get("description")
                                            .and_then(|s| s.as_str())
                                            .unwrap_or("")
                                            .to_string(),
                                        cve: vuln_obj.get("aliases")
                                            .and_then(|a| a.as_array())
                                            .and_then(|arr| {
                                                let cve_aliases: Vec<&str> = arr.iter()
                                                    .filter_map(|v| v.as_str())
                                                    .filter(|s| s.starts_with("CVE-"))
                                                    .collect();
                                                cve_aliases.first().map(|s| s.to_string())
                                            }),
                                        ghsa: vuln_obj.get("aliases")
                                            .and_then(|a| a.as_array())
                                            .and_then(|arr| {
                                                let ghsa_aliases: Vec<&str> = arr.iter()
                                                    .filter_map(|v| v.as_str())
                                                    .filter(|s| s.starts_with("GHSA-"))
                                                    .collect();
                                                ghsa_aliases.first().map(|s| s.to_string())
                                            }),
                                        affected_versions: vuln_obj.get("fix_versions")
                                            .and_then(|f| f.as_array())
                                            .and_then(|arr| arr.first())
                                            .and_then(|s| s.as_str())
                                            .map(|s| format!("< {}", s))
                                            .unwrap_or_else(|| "*".to_string()),
                                        patched_versions: vuln_obj.get("fix_versions")
                                            .and_then(|f| f.as_array())
                                            .and_then(|arr| arr.first())
                                            .and_then(|s| s.as_str())
                                            .map(|s| s.to_string()),
                                        published_date: None,
                                        references: vec![],
                                    });
                                }
                            }
                            
                            if !vuln_infos.is_empty() {
                                vulnerable_deps.push(VulnerableDependency {
                                    name: dep.name.clone(),
                                    version: dep.version.clone(),
                                    language: Language::Python,
                                    vulnerabilities: vuln_infos,
                                });
                            }
                        }
                    }
                }
            }
        }
        
        Ok(vulnerable_deps)
    }
    
    fn parse_govulncheck_output(
        &self,
        output: &[u8],
        dependencies: &[DependencyInfo],
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        let output_str = String::from_utf8_lossy(output);
        
        // govulncheck outputs multiple JSON objects separated by newlines
        // We need to parse each complete JSON object
        let mut current_json = String::new();
        let mut brace_count = 0;
        
        for line in output_str.lines() {
            let trimmed = line.trim();
            if trimmed.is_empty() {
                continue;
            }
            
            current_json.push_str(line);
            current_json.push('\n');
            
            // Count braces to determine when we have a complete JSON object
            for ch in line.chars() {
                match ch {
                    '{' => brace_count += 1,
                    '}' => brace_count -= 1,
                    _ => {}
                }
            }
            
            // When brace count reaches 0, we have a complete JSON object
            if brace_count == 0 && !current_json.trim().is_empty() {
                if let Ok(json_val) = serde_json::from_str::<serde_json::Value>(&current_json) {

                    
                    if let Some(obj) = json_val.as_object() {
                        // Look for "finding" entries which contain actual vulnerabilities affecting the code
                        if obj.contains_key("finding") {
                            if let Some(finding) = obj.get("finding").and_then(|f| f.as_object()) {
                                let osv_id = finding.get("osv")
                                    .and_then(|s| s.as_str())
                                    .unwrap_or("unknown");
                                

                                
                                // Skip if we've already processed this vulnerability
                                if vulnerable_deps.iter().any(|dep| 
                                    dep.vulnerabilities.iter().any(|v| v.id == osv_id)
                                ) {

                                    // Reset for next JSON object
                                    current_json.clear();
                                    continue;
                                }
                                
                                // Get the trace information to find the affected module
                                if let Some(trace) = finding.get("trace").and_then(|t| t.as_array()) {
                                    if let Some(first_trace) = trace.first().and_then(|t| t.as_object()) {
                                        let module_path = first_trace.get("module")
                                            .and_then(|m| m.as_str())
                                            .unwrap_or("");
                                        
                                        let module_version = first_trace.get("version")
                                            .and_then(|v| v.as_str())
                                            .unwrap_or("");
                                        
                                        // Find matching dependency
                                        if let Some(dep) = dependencies.iter().find(|d| {
                                            let matches = module_path.contains(&d.name) || 
                                                d.name.contains(module_path) ||
                                                d.name == module_path;
                                            

                                            
                                            matches
                                        }) {
                                            let fixed_version = finding.get("fixed_version")
                                                .and_then(|v| v.as_str())
                                                .map(|v| v.to_string());
                                            
                                            let vuln_info = VulnerabilityInfo {
                                                id: osv_id.to_string(),
                                                severity: VulnerabilitySeverity::High, // Default to high for Go vulnerabilities
                                                title: format!("Vulnerability {} in {}", osv_id, module_path),
                                                description: format!("Vulnerability {} found in module {} version {}", osv_id, module_path, module_version),
                                                cve: None,
                                                ghsa: None,
                                                affected_versions: format!("< {}", fixed_version.as_deref().unwrap_or("unknown")),
                                                patched_versions: fixed_version,
                                                published_date: None,
                                                references: vec![format!("https://pkg.go.dev/vuln/{}", osv_id)],
                                            };
                                            
                                            // Check if we already have this dependency
                                            if let Some(existing) = vulnerable_deps.iter_mut()
                                                .find(|vuln_dep: &&mut VulnerableDependency| vuln_dep.name == dep.name) 
                                            {
                                                existing.vulnerabilities.push(vuln_info);
                                            } else {
                                                vulnerable_deps.push(VulnerableDependency {
                                                    name: dep.name.clone(),
                                                    version: dep.version.clone(),
                                                    language: Language::Go,
                                                    vulnerabilities: vec![vuln_info],
                                                });
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
                
                // Reset for next JSON object
                current_json.clear();
            }
        }
        
        Ok(vulnerable_deps)
    }
    
    fn parse_npm_severity(&self, severity: &str) -> VulnerabilitySeverity {
        match severity.to_lowercase().as_str() {
            "critical" => VulnerabilitySeverity::Critical,
            "high" => VulnerabilitySeverity::High,
            "moderate" | "medium" => VulnerabilitySeverity::Medium,
            "low" => VulnerabilitySeverity::Low,
            _ => VulnerabilitySeverity::Info,
        }
    }
    
    fn parse_pip_severity(&self, severity: Option<&str>) -> VulnerabilitySeverity {
        match severity.map(|s| s.to_lowercase()).as_deref() {
            Some("critical") => VulnerabilitySeverity::Critical,
            Some("high") => VulnerabilitySeverity::High,
            Some("medium") | Some("moderate") => VulnerabilitySeverity::Medium,
            Some("low") => VulnerabilitySeverity::Low,
            _ => VulnerabilitySeverity::Medium, // Default to medium if not specified
        }
    }
    
    fn parse_osv_severity(&self, osv: &serde_json::Map<String, serde_json::Value>) -> VulnerabilitySeverity {
        // OSV format uses CVSS scores or database_specific severity
        if let Some(severity) = osv.get("database_specific")
            .and_then(|d| d.get("severity"))
            .and_then(|s| s.as_str()) 
        {
            return self.parse_npm_severity(severity);
        }
        
        // Default to high for Go vulnerabilities
        VulnerabilitySeverity::High
    }
    
    fn parse_cargo_audit_output(
        &self,
        audit_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        
        if let Some(vulnerabilities) = audit_data.get("vulnerabilities").and_then(|v| v.get("list")).and_then(|l| l.as_array()) {
            for vuln in vulnerabilities {
                if let Some(advisory) = vuln.get("advisory") {
                    let package_name = advisory.get("package")
                        .and_then(|n| n.as_str())
                        .unwrap_or("");
                    
                    let package_version = vuln.get("package")
                        .and_then(|p| p.get("version"))
                        .and_then(|v| v.as_str())
                        .unwrap_or("");
                    
                    if let Some(dep) = dependencies.iter().find(|d| d.name == package_name) {
                        let vuln_info = VulnerabilityInfo {
                            id: advisory.get("id")
                                .and_then(|id| id.as_str())
                                .unwrap_or("unknown")
                                .to_string(),
                            severity: self.parse_rustsec_severity(
                                advisory.get("severity")
                                    .and_then(|s| s.as_str())
                            ),
                            title: advisory.get("title")
                                .and_then(|t| t.as_str())
                                .unwrap_or("Unknown vulnerability")
                                .to_string(),
                            description: advisory.get("description")
                                .and_then(|d| d.as_str())
                                .unwrap_or("")
                                .to_string(),
                            cve: advisory.get("aliases")
                                .and_then(|a| a.as_array())
                                .and_then(|arr| arr.iter()
                                    .filter_map(|v| v.as_str())
                                    .find(|s| s.starts_with("CVE-"))
                                    .map(|s| s.to_string())),
                            ghsa: advisory.get("aliases")
                                .and_then(|a| a.as_array())
                                .and_then(|arr| arr.iter()
                                    .filter_map(|v| v.as_str())
                                    .find(|s| s.starts_with("GHSA-"))
                                    .map(|s| s.to_string())),
                            affected_versions: format!("< {}", 
                                vuln.get("versions")
                                    .and_then(|v| v.get("patched"))
                                    .and_then(|p| p.as_array())
                                    .and_then(|arr| arr.first())
                                    .and_then(|s| s.as_str())
                                    .unwrap_or("unknown")
                            ),
                            patched_versions: vuln.get("versions")
                                .and_then(|v| v.get("patched"))
                                .and_then(|p| p.as_array())
                                .and_then(|arr| arr.first())
                                .and_then(|s| s.as_str())
                                .map(|s| s.to_string()),
                            published_date: advisory.get("date")
                                .and_then(|d| d.as_str())
                                .and_then(|s| DateTime::parse_from_rfc3339(s).ok())
                                .map(|dt| dt.with_timezone(&Utc)),
                            references: advisory.get("references")
                                .and_then(|r| r.as_array())
                                .map(|refs| refs.iter()
                                    .filter_map(|r| r.as_str().map(|s| s.to_string()))
                                    .collect())
                                .unwrap_or_default(),
                        };
                        
                        // Check if we already have this dependency
                        if let Some(existing) = vulnerable_deps.iter_mut()
                            .find(|vuln_dep: &&mut VulnerableDependency| vuln_dep.name == dep.name && vuln_dep.version == package_version) 
                        {
                            existing.vulnerabilities.push(vuln_info);
                        } else {
                            vulnerable_deps.push(VulnerableDependency {
                                name: dep.name.clone(),
                                version: package_version.to_string(),
                                language: Language::Rust,
                                vulnerabilities: vec![vuln_info],
                            });
                        }
                    }
                }
            }
        }
        
        Ok(vulnerable_deps)
    }
    
    fn parse_rustsec_severity(&self, severity: Option<&str>) -> VulnerabilitySeverity {
        match severity.map(|s| s.to_lowercase()).as_deref() {
            Some("critical") => VulnerabilitySeverity::Critical,
            Some("high") => VulnerabilitySeverity::High,
            Some("medium") | Some("moderate") => VulnerabilitySeverity::Medium,
            Some("low") => VulnerabilitySeverity::Low,
            _ => VulnerabilitySeverity::Medium, // Default to medium if not specified
        }
    }
    
    fn parse_grype_output(
        &self,
        output: &[u8],
        dependencies: &[DependencyInfo],
        language: Language,
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        let output_str = String::from_utf8_lossy(output);
        
        // Parse grype JSON output
        let grype_data: serde_json::Value = serde_json::from_str(&output_str)
            .map_err(|e| VulnerabilityError::ParseError(
                format!("Failed to parse grype output: {}", e)
            ))?;
        
        // Grype JSON structure has a "matches" array
        if let Some(matches) = grype_data.get("matches").and_then(|m| m.as_array()) {
            for match_obj in matches {
                if let Some(obj) = match_obj.as_object() {
                    // Get artifact information
                    let artifact_name = obj.get("artifact")
                        .and_then(|a| a.get("name"))
                        .and_then(|n| n.as_str())
                        .unwrap_or("");
                    
                    let artifact_version = obj.get("artifact")
                        .and_then(|a| a.get("version"))
                        .and_then(|v| v.as_str())
                        .unwrap_or("");
                    
                    // Check if this matches one of our dependencies
                    if let Some(dep) = dependencies.iter().find(|d| {
                        // Match by artifact name or group:artifact format
                        artifact_name.contains(&d.name) || 
                        d.name.contains(artifact_name) ||
                        d.name.split(':').last() == Some(artifact_name)
                    }) {
                        // Get vulnerability details
                        if let Some(vuln_obj) = obj.get("vulnerability").and_then(|v| v.as_object()) {
                            let vuln_id = vuln_obj.get("id")
                                .and_then(|id| id.as_str())
                                .unwrap_or("unknown")
                                .to_string();
                            
                            let severity = vuln_obj.get("severity")
                                .and_then(|s| s.as_str())
                                .map(|s| self.parse_grype_severity(s))
                                .unwrap_or(VulnerabilitySeverity::Medium);
                            
                            let description = vuln_obj.get("description")
                                .and_then(|d| d.as_str())
                                .unwrap_or("")
                                .to_string();
                            
                            let fix_versions = vuln_obj.get("fix")
                                .and_then(|f| f.get("versions"))
                                .and_then(|v| v.as_array())
                                .map(|versions| {
                                    versions.iter()
                                        .filter_map(|v| v.as_str())
                                        .collect::<Vec<_>>()
                                        .join(", ")
                                });
                            
                            let vuln_info = VulnerabilityInfo {
                                id: vuln_id.clone(),
                                severity,
                                title: description.clone(),
                                description,
                                cve: if vuln_id.starts_with("CVE-") {
                                    Some(vuln_id.clone())
                                } else {
                                    None
                                },
                                ghsa: if vuln_id.starts_with("GHSA-") {
                                    Some(vuln_id.clone())
                                } else {
                                    None
                                },
                                affected_versions: artifact_version.to_string(),
                                patched_versions: fix_versions,
                                published_date: None,
                                references: vec![],
                            };
                            
                            // Check if we already have this dependency
                            if let Some(existing) = vulnerable_deps.iter_mut()
                                .find(|vuln_dep| vuln_dep.name == dep.name) 
                            {
                                // Avoid duplicate vulnerabilities
                                if !existing.vulnerabilities.iter().any(|v| v.id == vuln_info.id) {
                                    existing.vulnerabilities.push(vuln_info);
                                }
                            } else {
                                vulnerable_deps.push(VulnerableDependency {
                                    name: dep.name.clone(),
                                    version: dep.version.clone(),
                                    language: language.clone(),
                                    vulnerabilities: vec![vuln_info],
                                });
                            }
                        }
                    }
                }
            }
        }
        
        Ok(vulnerable_deps)
    }
    
    fn parse_grype_severity(&self, severity: &str) -> VulnerabilitySeverity {
        match severity.to_lowercase().as_str() {
            "critical" => VulnerabilitySeverity::Critical,
            "high" => VulnerabilitySeverity::High,
            "medium" => VulnerabilitySeverity::Medium,
            "low" => VulnerabilitySeverity::Low,
            "negligible" => VulnerabilitySeverity::Info,
            _ => VulnerabilitySeverity::Medium,
        }
    }
    
    fn parse_owasp_dependency_check_output(
        &self,
        report_data: &serde_json::Value,
        dependencies: &[DependencyInfo],
    ) -> Result<Vec<VulnerableDependency>, VulnerabilityError> {
        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
        
        if let Some(deps_array) = report_data.get("dependencies").and_then(|d| d.as_array()) {
            for dep_obj in deps_array {
                if let Some(vulns) = dep_obj.get("vulnerabilities").and_then(|v| v.as_array()) {
                    if vulns.is_empty() {
                        continue;
                    }
                    
                    // Extract dependency information
                    let file_name = dep_obj.get("fileName")
                        .and_then(|f| f.as_str())
                        .unwrap_or("");
                    
                    // Try to match with our dependencies
                    let matched_dep = dependencies.iter().find(|d| {
                        file_name.contains(&d.name) || 
                        dep_obj.get("packages").and_then(|p| p.as_array())
                            .map(|packages| packages.iter().any(|pkg| {
                                pkg.get("id").and_then(|id| id.as_str())
                                    .map(|id| id.contains(&d.name))
                                    .unwrap_or(false)
                            }))
                            .unwrap_or(false)
                    });
                    
                    if let Some(dep) = matched_dep {
                        let mut vuln_infos = Vec::new();
                        
                        for vuln in vulns {
                            let severity = vuln.get("severity")
                                .and_then(|s| s.as_str())
                                .unwrap_or("MEDIUM");
                            
                            vuln_infos.push(VulnerabilityInfo {
                                id: vuln.get("name")
                                    .and_then(|n| n.as_str())
                                    .unwrap_or("unknown")
                                    .to_string(),
                                severity: self.parse_owasp_severity(severity),
                                title: vuln.get("description")
                                    .and_then(|d| d.as_str())
                                    .unwrap_or("Unknown vulnerability")
                                    .to_string(),
                                description: vuln.get("notes")
                                    .and_then(|n| n.as_str())
                                    .unwrap_or("")
                                    .to_string(),
                                cve: vuln.get("name")
                                    .and_then(|n| n.as_str())
                                    .filter(|n| n.starts_with("CVE-"))
                                    .map(|s| s.to_string()),
                                ghsa: None,
                                affected_versions: vuln.get("vulnerableSoftware")
                                    .and_then(|vs| vs.as_array())
                                    .and_then(|arr| arr.first())
                                    .and_then(|v| v.get("versionEndIncluding"))
                                    .and_then(|v| v.as_str())
                                    .map(|v| format!("<= {}", v))
                                    .unwrap_or_else(|| "*".to_string()),
                                patched_versions: None, // OWASP DC doesn't provide this directly
                                published_date: None,
                                references: vuln.get("references")
                                    .and_then(|r| r.as_array())
                                    .map(|refs| refs.iter()
                                        .filter_map(|r| r.get("url").and_then(|u| u.as_str()).map(|s| s.to_string()))
                                        .collect())
                                    .unwrap_or_default(),
                            });
                        }
                        
                        if !vuln_infos.is_empty() {
                            vulnerable_deps.push(VulnerableDependency {
                                name: dep.name.clone(),
                                version: dep.version.clone(),
                                language: Language::Java,
                                vulnerabilities: vuln_infos,
                            });
                        }
                    }
                }
            }
        }
        
        Ok(vulnerable_deps)
    }
    
    fn parse_owasp_severity(&self, severity: &str) -> VulnerabilitySeverity {
        match severity.to_uppercase().as_str() {
            "CRITICAL" => VulnerabilitySeverity::Critical,
            "HIGH" => VulnerabilitySeverity::High,
            "MEDIUM" | "MODERATE" => VulnerabilitySeverity::Medium,
            "LOW" => VulnerabilitySeverity::Low,
            _ => VulnerabilitySeverity::Medium, // Default to medium
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    
    #[test]
    fn test_vulnerability_severity_ordering() {
        assert!(VulnerabilitySeverity::Critical > VulnerabilitySeverity::High);
        assert!(VulnerabilitySeverity::High > VulnerabilitySeverity::Medium);
        assert!(VulnerabilitySeverity::Medium > VulnerabilitySeverity::Low);
        assert!(VulnerabilitySeverity::Low > VulnerabilitySeverity::Info);
    }
    
    #[test]
    fn test_severity_parsing() {
        let checker = VulnerabilityChecker::new();
        
        assert_eq!(
            checker.parse_npm_severity("critical"),
            VulnerabilitySeverity::Critical
        );
        assert_eq!(
            checker.parse_npm_severity("MODERATE"),
            VulnerabilitySeverity::Medium
        );
    }
}