vulnzap-core
Version:
Secure AI-generated code by intercepting vulnerabilities in real-time
187 lines • 6.9 kB
JavaScript
import fs from 'fs/promises';
import path from 'path';
import CONFIG from './serviceConfig.js';
export default class OwaspSource {
constructor(options = {}) {
this.isInitialized = false;
this.API_URL = options.apiUrl || CONFIG.SERVICE_ENDPOINTS.OWASP_API || 'https://api.owasp.org/v1';
this.CACHE_TTL = options.cacheTtl || 24 * 60 * 60; // 24 hours in seconds
this.cachePath = path.join(CONFIG.DATA_PATHS.CACHE_DIR, 'owasp-advisories');
}
async initialize() {
if (this.isInitialized)
return true;
try {
// Create cache directory if it doesn't exist
await fs.mkdir(this.cachePath, { recursive: true });
// Test the connection with a simple query
await this.makeApiRequest('/health');
this.isInitialized = true;
return true;
}
catch (error) {
console.error('Failed to initialize OWASP source:', error);
return false;
}
}
/**
* Save data to cache file
* @private
*/
async _saveToCache(key, data, ttl = this.CACHE_TTL) {
try {
const cacheFile = path.join(this.cachePath, `${key.replace(/[^a-zA-Z0-9]/g, '_')}.json`);
const cacheData = {
data,
expires: Date.now() + (ttl * 1000),
created: Date.now()
};
await fs.writeFile(cacheFile, JSON.stringify(cacheData, null, 2));
}
catch (error) {
console.error('Error saving to OWASP cache:', error);
}
}
/**
* Get data from cache
* @private
*/
async _getFromCache(key) {
try {
const cacheFile = path.join(this.cachePath, `${key.replace(/[^a-zA-Z0-9]/g, '_')}.json`);
const data = JSON.parse(await fs.readFile(cacheFile, 'utf8'));
// Check if cache has expired
if (data.expires < Date.now()) {
await fs.unlink(cacheFile);
return null;
}
return data.data;
}
catch (error) {
return null;
}
}
/**
* Clear cache for specific key or all cache
* @private
*/
async _clearCache(key) {
try {
if (key) {
const cacheFile = path.join(this.cachePath, `${key.replace(/[^a-zA-Z0-9]/g, '_')}.json`);
await fs.unlink(cacheFile).catch(() => { });
}
else {
const files = await fs.readdir(this.cachePath);
await Promise.all(files.map(file => fs.unlink(path.join(this.cachePath, file)).catch(err => console.error(`Failed to delete OWASP cache file ${file}:`, err))));
}
}
catch (error) {
console.error('Error clearing OWASP cache:', error);
}
}
async makeApiRequest(endpoint, params = {}) {
try {
const queryString = new URLSearchParams(params).toString();
const url = `${this.API_URL}${endpoint}${queryString ? '?' + queryString : ''}`;
const response = await fetch(url, {
headers: {
'Accept': 'application/json',
'Authorization': `Bearer ${CONFIG.API_KEYS.OWASP}`
}
});
if (!response.ok) {
throw new Error(`OWASP API error: ${response.statusText}`);
}
return await response.json();
}
catch (error) {
console.error('Error making OWASP API request:', error);
throw error;
}
}
determineSeverity(vuln) {
if (vuln.severity) {
return vuln.severity.toLowerCase();
}
// If no severity is provided but CVSS score is available
if (vuln.cvss?.score) {
const score = vuln.cvss.score;
if (score >= 9.0)
return 'critical';
if (score >= 7.0)
return 'high';
if (score >= 4.0)
return 'medium';
return 'low';
}
return 'medium'; // Default severity
}
processOwaspResults(results, packageName, version, ecosystem) {
if (!results || results.length === 0) {
return {
isVulnerable: false,
message: 'No vulnerabilities found',
sources: ['owasp']
};
}
const advisories = results.map(vuln => ({
id: vuln.id,
title: vuln.title,
severity: this.determineSeverity(vuln),
cwe_id: vuln.cwe_id,
description: vuln.description,
recommendations: vuln.recommendations,
references: vuln.references.map(ref => ref.url)
}));
// Extract fixed versions
const fixedVersions = results
.flatMap(vuln => vuln.affected_versions || [])
.filter(affected => affected.package === packageName &&
affected.ecosystem === ecosystem &&
affected.fixed_version)
.map(affected => affected.fixed_version);
return {
isVulnerable: true,
advisories,
fixedVersions: fixedVersions.length > 0 ? [...new Set(fixedVersions)] : undefined,
sources: ['owasp']
};
}
async findVulnerabilities(packageName, version, ecosystem, options = {}) {
try {
if (!this.isInitialized) {
await this.initialize();
}
const cacheKey = `owasp:${ecosystem}:${packageName}:${version}`;
if (!options.refresh) {
const cached = await this._getFromCache(cacheKey);
if (cached) {
return cached;
}
}
else {
// Clear existing cache if refresh is requested
await this._clearCache(cacheKey);
}
// Query OWASP database for vulnerabilities
const results = await this.makeApiRequest('/vulnerabilities/search', {
package: packageName,
ecosystem: ecosystem,
version: version
});
const vulnerabilityResult = this.processOwaspResults(results.vulnerabilities || [], packageName, version, ecosystem);
await this._saveToCache(cacheKey, vulnerabilityResult, this.CACHE_TTL);
return vulnerabilityResult;
}
catch (error) {
console.error(`Error finding OWASP vulnerabilities for ${packageName}@${version}:`, error);
return {
isVulnerable: false,
error: `Error querying OWASP API: ${error.message || 'Unknown error'}`,
sources: ['owasp']
};
}
}
}
//# sourceMappingURL=owasp-source.js.map