@eurekadevsecops/radar/src/util/paths.js

Radar is an open-source orchestrator of security scanners.

const path = require('node:path')

const { CICD_PROVIDERS, getCiProvider, getCloneDir } = require('./ci')
const { getRadarDataDir } = require('./app_data')

// resolves the target scan path to ensure that it is in the cloned directory for the CI/CD provider
const resolveWithinCloneDir = ({ target, cloneDir, label }) => {
  const baseDir = path.resolve(path.normalize(cloneDir))
  // `resolved` starts as the requested target (or the clone dir) and is then
  // anchored to `baseDir` before normalization/safety checks.
  let resolved = target ?? baseDir
  if (!path.isAbsolute(resolved)) {
    resolved = path.join(baseDir, resolved)
  }
  resolved = path.resolve(path.normalize(resolved))

  const relative = path.relative(baseDir, resolved)
  if (relative.startsWith('..') || path.isAbsolute(relative)) {
    throw new Error(`TARGET must be within ${label}: ${baseDir}`)
  }

  return resolved
}

const assertCloneDir = ({ cloneDir, label, provider }) => {
  if (!cloneDir) {
    throw new Error(
      `${label} must be set when running in ${provider} CI to resolve scan paths`
    )
  }
}

// resolve scan target based on CI/CD provider or default to current working directory
const resolveScanTarget = (target) => {
  const provider = getCiProvider()
  const cloneDir = getCloneDir(provider)

  const providerConfig = Object.values(CICD_PROVIDERS).find(
    ({ value }) => value === provider
  )

  if (providerConfig) {
    assertCloneDir({
      cloneDir,
      label: providerConfig.env,
      provider: providerConfig.label
    })
    return resolveWithinCloneDir({
      target,
      cloneDir,
      label: providerConfig.env
    })
  }

  // if no provider or target is set, default to current working directory
  return path.resolve(path.normalize(target ?? process.cwd()))
}

// resolve scans directory based on CI/CD provider or default to the Radar app data directory
const resolveScansDir = () => {
  const provider = getCiProvider()
  const cloneDir = getCloneDir(provider)
  const providerConfig = Object.values(CICD_PROVIDERS).find(
    ({ value }) => value === provider
  )

  if (providerConfig) {
    assertCloneDir({
      cloneDir,
      label: providerConfig.env,
      provider: providerConfig.label
    })
  }

  if (cloneDir) {
    const baseDir = path.resolve(path.normalize(cloneDir))
    return path.join(baseDir, '.radar', 'scans')
  }

  return path.join(getRadarDataDir(), 'scans')
}

module.exports = {
  getCiProvider,
  getCloneDir,
  resolveScanTarget,
  resolveScansDir
}