Merge pull request #161 from syncable-dev/develop

Alex793x · web-flow · commit d8209c61ed1e · 2025-09-11T23:15:50.000+02:00
feat: testing analyze
diff --git a/src/analyzer/vulnerability/checkers/javascript.rs b/src/analyzer/vulnerability/checkers/javascript.rs
@@ -6,6 +6,7 @@ use crate::analyzer::runtime::{RuntimeDetector, PackageManager};
 use crate::analyzer::tool_management::ToolDetector;
 use crate::analyzer::vulnerability::{VulnerableDependency, VulnerabilityError, VulnerabilityInfo, VulnerabilitySeverity};
 use super::MutableLanguageVulnerabilityChecker;
+use serde_json::Value as JsonValue;
 
 pub struct JavaScriptVulnerabilityChecker {
     tool_detector: ToolDetector,
@@ -132,39 +133,67 @@ impl JavaScriptVulnerabilityChecker {
             warn!("yarn not found, skipping yarn audit");
             return Ok(None);
         }
-        
+
         info!("Executing yarn audit in {}", project_path.display());
-        
-        // Execute yarn audit --json
-        let output = Command::new("yarn")
-            .args(&["audit", "--json"])
-            .current_dir(project_path)
-            .output()
-            .map_err(|e| VulnerabilityError::CommandError(
-                format!("Failed to run yarn audit: {}", e)
-            ))?;
-        
-        // yarn audit behavior: returns 0 even when vulnerabilities are found
-        // Non-zero exit code indicates an actual error
-        if !output.status.success() && output.stdout.is_empty() {
-            return Err(VulnerabilityError::CommandError(
-                format!("yarn audit failed with exit code {}: {}", 
-                    output.status.code().unwrap_or(-1),
-                    String::from_utf8_lossy(&output.stderr))
-            ));
-        }
-        
-        if output.stdout.is_empty() {
-            return Ok(None);
+
+        // Strategy:
+        // 1) Try Yarn Berry command: yarn npm audit --json (Yarn v2+)
+        // 2) Fallback to classic: yarn audit --json (Yarn v1)
+        // 3) Handle both single-JSON and line-delimited JSON formats
+        let candidates: Vec<Vec<&str>> = vec![
+            vec!["npm", "audit", "--json"],
+            vec!["audit", "--json"],
+        ];
+
+        for args in candidates {
+            let output = match Command::new("yarn").args(&args).current_dir(project_path).output() {
+                Ok(o) => o,
+                Err(e) => {
+                    warn!("Failed to run 'yarn {}': {}", args.join(" "), e);
+                    continue;
+                }
+            };
+
+            // Non-zero with empty stdout is a hard failure; otherwise attempt to parse what we got
+            if !output.status.success() && output.stdout.is_empty() {
+                warn!(
+                    "yarn {} failed (code {:?}): {}",
+                    args.join(" "),
+                    output.status.code(),
+                    String::from_utf8_lossy(&output.stderr)
+                );
+                continue;
+            }
+
+            if output.stdout.is_empty() {
+                // Nothing to parse
+                continue;
+            }
+
+            // Try to parse as a single JSON blob first (be tolerant of banners/noise)
+            if let Some(audit_data) = try_parse_json_tolerant(&output.stdout) {
+                // If it looks like NPM's shape (common for `yarn npm audit`), reuse NPM parser
+                if audit_data.get("vulnerabilities").is_some() {
+                    if let Ok(res) = self.parse_npm_audit_output(&audit_data, dependencies) {
+                        if res.is_some() { return Ok(res); }
+                    }
+                }
+
+                // Otherwise try Yarn object shape
+                if let Ok(res) = self.parse_yarn_audit_output(&audit_data, dependencies) {
+                    if res.is_some() { return Ok(res); }
+                }
+            } else {
+                // If not a single JSON, try line-delimited JSON format (Yarn v1 classic)
+                if let Ok(res) = self.parse_yarn_streaming_audit_lines(&output.stdout, dependencies) {
+                    if res.is_some() { return Ok(res); }
+                }
+            }
         }
-        
-        // Parse yarn audit output
-        let audit_data: serde_json::Value = serde_json::from_slice(&output.stdout)
-            .map_err(|e| VulnerabilityError::ParseError(
-                format!("Failed to parse yarn audit output: {}", e)
-            ))?;
-        
-        self.parse_yarn_audit_output(&audit_data, dependencies)
+
+        // If we got here, we couldn't parse Yarn output; don't fail the whole scan
+        warn!("Unable to parse yarn audit output; skipping Yarn results");
+        Ok(None)
     }
     
     fn execute_pnpm_audit(
@@ -389,51 +418,16 @@ impl JavaScriptVulnerabilityChecker {
         let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
         
         // Yarn audit JSON structure parsing
-        // Yarn returns audit data in a different format than npm
+        // Shape 1: Single object with { data: { advisories: { id: {...} } } } (rare)
         if let Some(data) = audit_data.get("data").and_then(|d| d.as_object()) {
             if let Some(advisories) = data.get("advisories").and_then(|a| a.as_object()) {
                 for (advisory_id, advisory) in advisories {
                     if let Some(advisory_obj) = advisory.as_object() {
-                        let package_name = advisory_obj.get("module_name").and_then(|n| n.as_str())
-                            .unwrap_or("").to_string();
-                        
-                        // Find matching dependency
+                        let package_name = advisory_obj.get("module_name").and_then(|n| n.as_str()).unwrap_or("").to_string();
                         if let Some(dep) = dependencies.iter().find(|d| d.name == package_name) {
-                            let id = advisory_id.clone();
-                            let title = advisory_obj.get("title").and_then(|t| t.as_str())
-                                .unwrap_or("Unknown vulnerability").to_string();
-                            let description = advisory_obj.get("overview").and_then(|o| o.as_str())
-                                .unwrap_or("").to_string();
-                            let severity = self.parse_severity(advisory_obj.get("severity").and_then(|s| s.as_str()));
-                            let vulnerable_versions = advisory_obj.get("vulnerable_versions").and_then(|v| v.as_str())
-                                .unwrap_or("*").to_string();
-                            
-                            let cve = advisory_obj.get("cves").and_then(|c| c.as_array())
-                                .and_then(|arr| arr.first())
-                                .and_then(|v| v.as_str())
-                                .map(|s| s.to_string());
-                            
-                            let url = advisory_obj.get("url").and_then(|u| u.as_str())
-                                .map(|s| s.to_string());
-                            
-                            let vuln_info = VulnerabilityInfo {
-                                id,
-                                vuln_type: "security".to_string(),  // Security vulnerability
-                                severity,
-                                title,
-                                description,
-                                cve,
-                                ghsa: url.clone().filter(|u| u.contains("GHSA")).map(|u| {
-                                    u.split('/').last().unwrap_or(&u).to_string()
-                                }),
-                                affected_versions: vulnerable_versions,
-                                patched_versions: advisory_obj.get("patched_versions").and_then(|p| p.as_str()).map(|s| s.to_string()),
-                                published_date: None,
-                                references: url.map(|u| vec![u]).unwrap_or_default(),
-                            };
-                            
-                            // Check if we already have this dependency
-                            if let Some(existing) = vulnerable_deps.iter_mut().find(|vuln_dep| vuln_dep.name == package_name) {
+                            let (vuln_info, pkg_name) = self.extract_yarn_advisory(advisory_id, advisory_obj);
+                            // Use dep.name to keep version/source consistent
+                            if let Some(existing) = vulnerable_deps.iter_mut().find(|v| v.name == pkg_name) {
                                 existing.vulnerabilities.push(vuln_info);
                             } else {
                                 vulnerable_deps.push(VulnerableDependency {
@@ -455,14 +449,127 @@ impl JavaScriptVulnerabilityChecker {
             Ok(Some(vulnerable_deps))
         }
     }
+
+    // Parse Yarn classic line-delimited JSON output
+    fn parse_yarn_streaming_audit_lines(
+        &self,
+        stdout: &[u8],
+        dependencies: &[DependencyInfo],
+    ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
+        let mut vulnerable_deps: Vec<VulnerableDependency> = Vec::new();
+        let text = String::from_utf8_lossy(stdout);
+        for line in text.lines() {
+            let line = line.trim();
+            if line.is_empty() { continue; }
+            if let Ok(json) = serde_json::from_str::<serde_json::Value>(line) {
+                if json.get("type").and_then(|t| t.as_str()) == Some("auditAdvisory") {
+                    if let Some(advisory_obj) = json
+                        .get("data")
+                        .and_then(|d| d.get("advisory"))
+                        .and_then(|a| a.as_object())
+                    {
+                        let package_name = advisory_obj
+                            .get("module_name")
+                            .and_then(|n| n.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        if let Some(dep) = dependencies.iter().find(|d| d.name == package_name) {
+                            let (vuln_info, pkg_name) = self.extract_yarn_advisory(
+                                advisory_obj
+                                    .get("id")
+                                    .and_then(|v| v.as_i64())
+                                    .map(|v| v.to_string())
+                                    .unwrap_or_else(|| "unknown".to_string())
+                                    .as_str(),
+                                advisory_obj,
+                            );
+
+                            if let Some(existing) = vulnerable_deps.iter_mut().find(|v| v.name == pkg_name) {
+                                existing.vulnerabilities.push(vuln_info);
+                            } else {
+                                vulnerable_deps.push(VulnerableDependency {
+                                    name: dep.name.clone(),
+                                    version: dep.version.clone(),
+                                    language: Language::JavaScript,
+                                    vulnerabilities: vec![vuln_info],
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        if vulnerable_deps.is_empty() { Ok(None) } else { Ok(Some(vulnerable_deps)) }
+    }
+
+    fn extract_yarn_advisory<'a>(
+        &self,
+        advisory_id: impl Into<String>,
+        advisory_obj: &serde_json::Map<String, serde_json::Value>,
+    ) -> (VulnerabilityInfo, String) {
+        let package_name = advisory_obj
+            .get("module_name")
+            .and_then(|n| n.as_str())
+            .unwrap_or("")
+            .to_string();
+        let id = advisory_id.into();
+        let title = advisory_obj.get("title").and_then(|t| t.as_str()).unwrap_or("Unknown vulnerability").to_string();
+        let description = advisory_obj.get("overview").and_then(|o| o.as_str()).unwrap_or("").to_string();
+        let severity = self.parse_severity(advisory_obj.get("severity").and_then(|s| s.as_str()));
+        let vulnerable_versions = advisory_obj.get("vulnerable_versions").and_then(|v| v.as_str()).unwrap_or("*").to_string();
+        let cve = advisory_obj
+            .get("cves")
+            .and_then(|c| c.as_array())
+            .and_then(|arr| arr.first())
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string());
+        let url = advisory_obj.get("url").and_then(|u| u.as_str()).map(|s| s.to_string());
+
+        let vuln_info = VulnerabilityInfo {
+            id,
+            vuln_type: "security".to_string(),
+            severity,
+            title,
+            description,
+            cve,
+            ghsa: url.clone().filter(|u| u.contains("GHSA")).map(|u| u.split('/').last().unwrap_or(&u).to_string()),
+            affected_versions: vulnerable_versions,
+            patched_versions: advisory_obj.get("patched_versions").and_then(|p| p.as_str()).map(|s| s.to_string()),
+            published_date: None,
+            references: url.map(|u| vec![u]).unwrap_or_default(),
+        };
+
+        (vuln_info, package_name)
+    }
     
     fn parse_pnpm_audit_output(
         &self,
         audit_data: &serde_json::Value,
         dependencies: &[DependencyInfo],
     ) -> Result<Option<Vec<VulnerableDependency>>, VulnerabilityError> {
-        // PNPM audit output is similar to NPM
-        self.parse_npm_audit_output(audit_data, dependencies)
+        // PNPM audit output can resemble NPM or provide an advisories map similar to Yarn classic
+        if audit_data.get("vulnerabilities").is_some() {
+            return self.parse_npm_audit_output(audit_data, dependencies);
+        }
+
+        if let Some(advisories) = audit_data.get("advisories").cloned() {
+            // Wrap into Yarn-like shape and reuse Yarn parser
+            let yarn_like = serde_json::json!({
+                "data": { "advisories": advisories }
+            });
+            return self.parse_yarn_audit_output(&yarn_like, dependencies);
+        }
+
+        // Some pnpm versions produce per-advisory arrays; attempt best-effort mapping if present
+        if let Some(findings) = audit_data.get("audit").or_else(|| audit_data.get("metadata")).or_else(|| audit_data.get("data")) {
+            // Try npm parser as a reasonable default
+            if let Ok(res) = self.parse_npm_audit_output(audit_data, dependencies) {
+                if res.is_some() { return Ok(res); }
+            }
+        }
+
+        Ok(None)
     }
     
     fn parse_severity(&self, severity: Option<&str>) -> VulnerabilitySeverity {
@@ -486,22 +593,68 @@ impl MutableLanguageVulnerabilityChecker for JavaScriptVulnerabilityChecker {
         info!("Checking JavaScript/TypeScript dependencies");
         
         let runtime_detector = RuntimeDetector::new(project_path.to_path_buf());
-        let _detection_result = runtime_detector.detect_js_runtime_and_package_manager();
-        
+        let detection_result = runtime_detector.detect_js_runtime_and_package_manager();
+
         info!("Runtime detection: {}", runtime_detector.get_detection_summary());
-        
-        // Get all available package managers
-        let available_managers = runtime_detector.detect_all_package_managers();
-        
-        // Execute audit commands for each available manager
+
+        // Build execution order: primary detected manager first, then any lockfile-based managers
+        let mut managers = Vec::new();
+        if detection_result.package_manager != crate::analyzer::runtime::PackageManager::Unknown {
+            managers.push(detection_result.package_manager.clone());
+        }
+        for m in runtime_detector.detect_all_package_managers() {
+            if !managers.contains(&m) {
+                managers.push(m);
+            }
+        }
+
+        // Always consider running Bun audit for JS projects if available,
+        // as Bun often surfaces advisories even when other managers don't.
+        if !managers.contains(&crate::analyzer::runtime::PackageManager::Bun)
+            && runtime_detector.is_js_project()
+        {
+            managers.push(crate::analyzer::runtime::PackageManager::Bun);
+        }
+
+        // If still empty but it's a JS project, default to npm as a last resort
+        if managers.is_empty() && runtime_detector.is_js_project() {
+            managers.push(crate::analyzer::runtime::PackageManager::Npm);
+        }
+
+        // Execute audit commands for each selected manager
         let mut all_vulnerabilities = Vec::new();
-        
-        for manager in available_managers {
+
+        for manager in managers {
             if let Some(vulns) = self.execute_audit_for_manager(&manager, project_path, dependencies)? {
                 all_vulnerabilities.extend(vulns);
             }
         }
         
         Ok(all_vulnerabilities)
     }
-}
+}
+
+// Best-effort tolerant JSON extractor: handles banners/noise by
+// 1) parsing whole buffer, 2) slicing between first '{' and last '}',
+// 3) scanning lines for a valid JSON object.
+fn try_parse_json_tolerant(buf: &[u8]) -> Option<JsonValue> {
+    if let Ok(val) = serde_json::from_slice::<JsonValue>(buf) {
+        return Some(val);
+    }
+    let text = String::from_utf8_lossy(buf);
+    if let (Some(start), Some(end)) = (text.find('{'), text.rfind('}')) {
+        if start < end {
+            if let Ok(val) = serde_json::from_str::<JsonValue>(&text[start..=end]) {
+                return Some(val);
+            }
+        }
+    }
+    for line in text.lines() {
+        let line = line.trim();
+        if !line.starts_with('{') || !line.ends_with('}') { continue; }
+        if let Ok(val) = serde_json::from_str::<JsonValue>(line) {
+            return Some(val);
+        }
+    }
+    None
+}
diff --git a/src/handlers/analyze.rs b/src/handlers/analyze.rs
@@ -37,6 +37,8 @@ pub fn handle_analyze(
     let monorepo_analysis = analyze_monorepo(&path)?;
 
     let output = if json {
+        println!("🔍 Analyzing JSON OUTPUT: {}", path.display());
+
         display_analysis_with_return(&monorepo_analysis, DisplayMode::Json)
     } else {
         // Determine display mode
