llm-security/tests/scanners/dep.test.mjs

// dep.test.mjs — Integration tests for the dep-auditor
// Uses tests/fixtures/dep-test/package.json which contains 3 typosquat deps:
//   - expresss  (edit distance 1 from express)
//   - lodsah    (edit distance 1 from lodash)
//   - node-fethc (edit distance 1 from node-fetch)
//
// The evil-project-health fixture uses package.fixture.json (not package.json),
// so we use the dedicated dep-test fixture as targetPath instead.

import { describe, it, beforeEach } from 'node:test';
import assert from 'node:assert/strict';
import { join, resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { resetCounter } from '../../scanners/lib/output.mjs';
import { scan } from '../../scanners/dep-auditor.mjs';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const DEP_FIXTURE = resolve(__dirname, '../fixtures/dep-test');

describe('dep-auditor integration', () => {
  beforeEach(() => {
    resetCounter();
  });

  it('returns status ok when package.json is present', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    assert.equal(result.status, 'ok', `Expected status 'ok', got '${result.status}'`);
  });

  it('detects at least 2 typosquatting findings', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const typosquatFindings = result.findings.filter(
      f => f.title.toLowerCase().includes('typosquat')
    );
    assert.ok(
      typosquatFindings.length >= 2,
      `Expected >= 2 typosquatting findings, got ${typosquatFindings.length}. ` +
      `All findings: ${result.findings.map(f => f.title).join('; ')}`
    );
  });

  it('typosquatting findings have HIGH or MEDIUM severity', async () => {
    // Distance-1 matches → HIGH; distance-2 matches against top-200 → MEDIUM.
    // expresss/node-fethc are distance-1 from express/node-fetch → HIGH.
    // lodsah is distance-2 from lodash → MEDIUM (if lodash is in top-200).
    const result = await scan(DEP_FIXTURE, { files: [] });
    const typosquatFindings = result.findings.filter(
      f => f.title.toLowerCase().includes('typosquat')
    );
    for (const f of typosquatFindings) {
      assert.ok(
        f.severity === 'high' || f.severity === 'medium',
        `Typosquat finding "${f.title}" should be HIGH or MEDIUM, got ${f.severity}`
      );
    }
  });

  it('at least one distance-1 typosquat is HIGH severity', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const highFindings = result.findings.filter(
      f => f.title.toLowerCase().includes('typosquat') && f.severity === 'high'
    );
    assert.ok(
      highFindings.length >= 1,
      `Expected at least 1 HIGH typosquat (distance-1), got ${highFindings.length}. ` +
      `Findings: ${result.findings.map(f => `${f.severity}: ${f.title}`).join('; ')}`
    );
  });

  it('detects expresss as typosquat of express', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const expFinding = result.findings.find(
      f => f.title.toLowerCase().includes('expresss') ||
           (f.evidence && f.evidence.includes('expresss'))
    );
    assert.ok(expFinding, 'Should detect "expresss" as typosquat of "express"');
  });

  it('detects lodsah as typosquat of lodash', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const lodashFinding = result.findings.find(
      f => f.title.toLowerCase().includes('lodsah') ||
           (f.evidence && f.evidence.includes('lodsah'))
    );
    assert.ok(lodashFinding, 'Should detect "lodsah" as typosquat of "lodash"');
  });

  it('all findings have DS-DEP- prefix', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const wrongPrefix = result.findings.filter(f => !f.id.startsWith('DS-DEP-'));
    assert.equal(
      wrongPrefix.length, 0,
      `All dep findings should have DS-DEP- prefix. Wrong: ${wrongPrefix.map(f => f.id).join(', ')}`
    );
  });

  it('typosquat findings reference package.json as the file', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const typosquatFindings = result.findings.filter(
      f => f.title.toLowerCase().includes('typosquat')
    );
    for (const f of typosquatFindings) {
      assert.equal(f.file, 'package.json', `Expected file 'package.json', got '${f.file}'`);
    }
  });

  it('all typosquat findings reference owasp LLM03', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    const typosquatFindings = result.findings.filter(
      f => f.title.toLowerCase().includes('typosquat')
    );
    for (const f of typosquatFindings) {
      assert.equal(f.owasp, 'LLM03', `Expected owasp LLM03, got ${f.owasp}`);
    }
  });

  it('non-package directory returns skipped', async () => {
    // Use a directory with no package.json or requirements.txt
    const emptyDir = resolve(__dirname, '../../scanners/lib');
    resetCounter();
    const result = await scan(emptyDir, { files: [] });
    assert.equal(result.status, 'skipped', `Expected skipped, got '${result.status}'`);
    assert.equal(result.findings.length, 0);
  });

  it('finding IDs start from DS-DEP-001 after reset', async () => {
    const result = await scan(DEP_FIXTURE, { files: [] });
    if (result.findings.length === 0) return;
    assert.equal(result.findings[0].id, 'DS-DEP-001');
  });
});

// ---------------------------------------------------------------------------
// pip-audit invocation (v7.8.3 #18/#19)
// The scanner must invoke the real `pip-audit` binary (not the nonexistent
// `pip audit` subcommand), and it must audit the TARGET's requirements.txt
// (-r <target>/requirements.txt) — never the scanner host's environment.
// Both binaries are shimmed on PATH so the tests are deterministic + offline:
//   pip-audit — records its argv and emits one fixed vulnerability
//   pip       — emits a "host environment" vulnerability the scanner must
//               never surface (proves host-env audits are gone)
// ---------------------------------------------------------------------------

function makePipShims(shimDir, argvLog) {
  writeFileSync(join(shimDir, 'pip-audit'), [
    '#!/bin/sh',
    `echo "$@" > "${argvLog}"`,
    `echo '{"dependencies":[{"name":"requests","version":"2.0.0","vulns":[{"id":"PYSEC-TEST-0001","fix_versions":["2.31.0"],"description":"shim vulnerability"}]}]}'`,
    '',
  ].join('\n'), { mode: 0o755 });
  writeFileSync(join(shimDir, 'pip'), [
    '#!/bin/sh',
    `echo '{"dependencies":[{"name":"host-only-pkg","version":"1.0.0","vulns":[{"id":"PYSEC-HOST-9999","fix_versions":[],"description":"host environment"}]}]}'`,
    '',
  ].join('\n'), { mode: 0o755 });
}

describe('dep-auditor pip-audit invocation', () => {
  beforeEach(() => {
    resetCounter();
  });

  it('invokes pip-audit with -r <target>/requirements.txt (not "pip audit" against the host)', async () => {
    const shimDir = mkdtempSync(join(tmpdir(), 'llmsec-supply-shim-'));
    const target = mkdtempSync(join(tmpdir(), 'llmsec-supply-target-'));
    const argvLog = join(shimDir, 'argv.log');
    makePipShims(shimDir, argvLog);
    writeFileSync(join(target, 'requirements.txt'), 'requests==2.0.0\n');

    const oldPath = process.env.PATH;
    process.env.PATH = `${shimDir}:${oldPath}`;
    try {
      const result = await scan(target, { files: [] });
      assert.equal(result.status, 'ok', `Expected status 'ok', got '${result.status}'`);

      const shimFinding = result.findings.find(f => f.title.includes('PYSEC-TEST-0001'));
      assert.ok(
        shimFinding,
        `Expected a finding from the pip-audit shim (PYSEC-TEST-0001). ` +
        `Findings: ${result.findings.map(f => f.title).join('; ')}`
      );
      const hostFinding = result.findings.find(f => f.title.includes('PYSEC-HOST-9999'));
      assert.equal(hostFinding, undefined, 'Host-environment audit result must never be surfaced');

      assert.ok(existsSync(argvLog), 'pip-audit shim was never invoked');
      const argv = readFileSync(argvLog, 'utf8');
      assert.match(argv, /-r/, `pip-audit must receive -r, got argv: ${argv}`);
      assert.ok(
        argv.includes(join(target, 'requirements.txt')),
        `pip-audit must audit the target requirements.txt, got argv: ${argv}`
      );
    } finally {
      process.env.PATH = oldPath;
      rmSync(shimDir, { recursive: true, force: true });
      rmSync(target, { recursive: true, force: true });
    }
  });

  it('skips the CVE audit cleanly when the target has pyproject.toml but no requirements.txt', async () => {
    const shimDir = mkdtempSync(join(tmpdir(), 'llmsec-supply-shim-'));
    const target = mkdtempSync(join(tmpdir(), 'llmsec-supply-target-'));
    const argvLog = join(shimDir, 'argv.log');
    makePipShims(shimDir, argvLog);
    writeFileSync(join(target, 'pyproject.toml'), '[project]\nname = "sample"\n');

    const oldPath = process.env.PATH;
    process.env.PATH = `${shimDir}:${oldPath}`;
    try {
      const result = await scan(target, { files: [] });
      assert.equal(result.status, 'ok', `Expected status 'ok', got '${result.status}'`);

      const hostFinding = result.findings.find(f => f.title.includes('PYSEC-HOST-9999'));
      assert.equal(hostFinding, undefined, 'Without requirements.txt the host env must not be audited');
      assert.equal(existsSync(argvLog), false, 'pip-audit must not run when requirements.txt is absent');
    } finally {
      process.env.PATH = oldPath;
      rmSync(shimDir, { recursive: true, force: true });
      rmSync(target, { recursive: true, force: true });
    }
  });
});