chore: setup workspaces

.github/workflows/estree-ast-utils.yml

@@ -0,0 +1,41 @@
+# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs
+
+name: Node.js CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - workspaces/estree-ast-utils/**
+  pull_request:
+    paths:
+      - workspaces/estree-ast-utils/**
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [16.x, 18.x]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      with:
+        node-version: ${{ matrix.node-version }}
+    - run: npm install
+    - run: npm test

.github/workflows/sec-literal.yml

@@ -0,0 +1,29 @@
+name: Node.js CI
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - workspaces/sec-literal/**
+  pull_request:
+    paths:
+      - workspaces/sec-literal/**
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [16.x, 18.x]
+      fail-fast: false
+    steps:
+      - uses: actions/checkout@v2
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Install dependencies
+        run: npm install
+      - name: Run tests
+        run: npm run test

README.md

@@ -194,6 +194,21 @@ export type ReportOnFile = {
 
 </details>
 
+## Workspaces
+
+Click on one of the links to access the documentation of the workspace:
+
+| name | package and link |
+| --- | --- |
+| estree-ast-util | [@nodesecure/estree-ast-util](./workspaces/estree-ast-util) |
+| sec-literal | [@nodesecure/sec-literal ](./workspaces/sec-literal) |
+
+These packages are available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
+```bash
+$ npm i @nodesecure/estree-ast-util
+# or
+$ yarn add @nodesecure/estree-ast-util
+```
 
 ## Contributors ✨
 

package.json

@@ -18,6 +18,10 @@
     "type": "git",
     "url": "git+https://github.com/NodeSecure/js-x-ray.git"
   },
+  "workspaces": [
+    "workspaces/estree-ast-utils",
+    "workspaces/sec-literal"
+  ],
   "keywords": [
     "ast",
     "nsecure",
@@ -48,10 +52,15 @@
   },
   "devDependencies": {
     "@nodesecure/eslint-config": "^1.6.0",
+    "@small-tech/esm-tape-runner": "^2.0.0",
+    "@small-tech/tap-monkey": "^1.4.0",
     "@types/node": "^20.6.2",
     "c8": "^8.0.1",
+    "cross-env": "^7.0.3",
     "eslint": "^8.31.0",
     "glob": "^10.3.4",
-    "pkg-ok": "^3.0.0"
+    "iterator-matcher": "^2.1.0",
+    "pkg-ok": "^3.0.0",
+    "tape": "^5.7.2"
   }
 }

workspaces/estree-ast-utils/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 NodeSecure
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

workspaces/estree-ast-utils/README.md

@@ -0,0 +1,109 @@
+# estree-ast-utils
+
+[![version](https://img.shields.io/badge/dynamic/json.svg?style=for-the-badge&url=https://raw.githubusercontent.com/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils/main/package.json&query=$.version&label=Version)](https://www.npmjs.com/package/@NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils)
+[![maintained](https://img.shields.io/badge/Maintained%3F-yes-green.svg?style=for-the-badge)](https://github.com/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils/graphs/commit-activity)
+[![OpenSSF
+Scorecard](https://api.securityscorecards.dev/projects/github.com/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils/badge?style=for-the-badge)](https://api.securityscorecards.dev/projects/github.com/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils)
+[![mit](https://img.shields.io/github/license/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils.svg?style=for-the-badge)](https://github.com/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils/blob/main/LICENSE)
+[![build](https://img.shields.io/github/actions/workflow/status/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils/node.js.yml?style=for-the-badge)](https://github.com/NodeSecure/js-x-ray/blob/master/workspaces/estree-ast-utils/actions?query=workflow%3A%22Node.js+CI%22)
+
+Utilities for AST (ESTree compliant)
+
+## Getting Started
+
+This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).
+
+```bash
+$ npm i @nodesecure/estree-ast-utils
+# or
+$ yarn add @nodesecure/estree-ast-utils
+```
+
+## Usage example
+
+```js
+import { VariableTracer } from "@nodesecure/estree-ast-utils";
+
+const tracer = new VariableTracer().enableDefaultTracing();
+
+const data = tracer.getDataFromIdentifier("identifier...here");
+console.log(data);
+```
+
+## API
+
+<details><summary>arrayExpressionToString(node): IterableIterator< string ></summary>
+
+Translate an ESTree ArrayExpression into an iterable of Literal value.
+
+```js
+["foo", "bar"];
+```
+
+will return `"foo"` then `"bar"`.
+
+</details>
+
+<details><summary>concatBinaryExpression(node, options): IterableIterator< string ></summary>
+
+Return all Literal part of a given Binary Expression.
+
+```js
+"foo" + "bar";
+```
+
+will return `"foo"` then `"bar"`.
+
+One of the options of the method is `stopOnUnsupportedNode`, if true it will throw an Error if the left or right side of the Expr is not a supported type.
+
+</details>
+
+<details><summary>getCallExpressionIdentifier(node): string | null</summary>
+
+Return the identifier name of the CallExpression (or null if there is none).
+
+```js
+foobar();
+```
+
+will return `"foobar"`.
+
+</details>
+
+<details><summary>getMemberExpressionIdentifier(node): IterableIterator< string ></summary>
+
+Return the identifier name of the CallExpression (or null if there is none).
+
+```js
+foo.bar();
+```
+
+will return `"foo"` then `"bar"`.
+
+</details>
+
+<details><summary>getVariableDeclarationIdentifiers(node): IterableIterator< string ></summary>
+
+Get all variables identifier name.
+
+```js
+const [foo, bar] = [1, 2];
+```
+
+will return `"foo"` then `"bar"`.
+
+</details>
+
+<details><summary>isLiteralRegex(node): boolean</summary>
+
+Return `true` if the given Node is a Literal Regex Node.
+
+```js
+/^hello/g;
+```
+
+</details>
+
+## License
+
+MIT

workspaces/estree-ast-utils/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@nodesecure/estree-ast-utils",
+  "version": "1.4.1",
+  "description": "Utilities for AST (ESTree compliant)",
+  "type": "module",
+  "exports": "./src/index.js",
+  "scripts": {
+    "lint": "eslint src test",
+    "prepublishOnly": "pkg-ok",
+    "test": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
+    "check": "cross-env npm run lint && npm run test",
+    "coverage": "c8 -r html npm test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/NodeSecure/estree-ast-utils.git"
+  },
+  "keywords": [
+    "estree",
+    "ast",
+    "utils"
+  ],
+  "author": "GENTILHOMME Thomas <[email protected]>",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/NodeSecure/estree-ast-utils/issues"
+  },
+  "homepage": "https://github.com/NodeSecure/estree-ast-utils#readme",
+  "devDependencies": {
+    "estree-walker": "^3.0.2"
+  },
+  "dependencies": {
+    "@nodesecure/sec-literal": "^1.1.0"
+  }
+}

workspaces/estree-ast-utils/src/arrayExpressionToString.js

@@ -0,0 +1,37 @@
+// Import Internal Dependencies
+import { VariableTracer } from "./utils/VariableTracer.js";
+
+/**
+ * @param {*} node
+ * @param {object} options
+ * @param {VariableTracer} [options.tracer=null]
+ * @returns {IterableIterator<string>}
+ */
+
+export function* arrayExpressionToString(node, options = {}) {
+  const { tracer = null } = options;
+
+  if (!node || node.type !== "ArrayExpression") {
+    return;
+  }
+
+  for (const row of node.elements) {
+    switch (row.type) {
+      case "Literal": {
+        if (row.value === "") {
+          continue;
+        }
+
+        const value = Number(row.value);
+        yield Number.isNaN(value) ? row.value : String.fromCharCode(value);
+        break;
+      }
+      case "Identifier": {
+        if (tracer !== null && tracer.literalIdentifiers.has(row.name)) {
+          yield tracer.literalIdentifiers.get(row.name);
+        }
+        break;
+      }
+    }
+  }
+}

workspaces/estree-ast-utils/src/concatBinaryExpression.js

@@ -0,0 +1,57 @@
+// Import Internal Dependencies
+import { arrayExpressionToString } from "./arrayExpressionToString.js";
+import { VariableTracer } from "./utils/VariableTracer.js";
+
+// CONSTANTS
+const kBinaryExprTypes = new Set([
+  "Literal",
+  "BinaryExpression",
+  "ArrayExpression",
+  "Identifier"
+]);
+
+/**
+ * @param {*} node
+ * @param {object} options
+ * @param {VariableTracer} [options.tracer=null]
+ * @param {boolean} [options.stopOnUnsupportedNode=false]
+ * @returns {IterableIterator<string>}
+ */
+export function* concatBinaryExpression(node, options = {}) {
+  const {
+    tracer = null,
+    stopOnUnsupportedNode = false
+  } = options;
+  const { left, right } = node;
+
+  if (
+    stopOnUnsupportedNode &&
+    (!kBinaryExprTypes.has(left.type) || !kBinaryExprTypes.has(right.type))
+  ) {
+    throw new Error("concatBinaryExpression:: Unsupported node detected");
+  }
+
+  for (const childNode of [left, right]) {
+    switch (childNode.type) {
+      case "BinaryExpression": {
+        yield* concatBinaryExpression(childNode, {
+          tracer,
+          stopOnUnsupportedNode
+        });
+        break;
+      }
+      case "ArrayExpression": {
+        yield* arrayExpressionToString(childNode, { tracer });
+        break;
+      }
+      case "Literal":
+        yield childNode.value;
+        break;
+      case "Identifier":
+        if (tracer !== null && tracer.literalIdentifiers.has(childNode.name)) {
+          yield tracer.literalIdentifiers.get(childNode.name);
+        }
+        break;
+    }
+  }
+}