feat(i18n): merge warnings and sast warnings from js-x-ray pkg

.changeset/full-parks-find.md

@@ -0,0 +1,5 @@
+---
+"@nodesecure/i18n": patch
+---
+
+feat(i18n): merge warnings and sast warnings from js-x-ray pkg

workspaces/i18n/package.json

@@ -44,6 +44,7 @@
     "node": ">=20"
   },
   "dependencies": {
+    "@nodesecure/js-x-ray": "^16.0.0",
     "cacache": "^21.0.0",
     "deepmerge": "^4.3.1",
     "lodash.get": "^4.4.2"

workspaces/i18n/src/languages/arabic.ts

@@ -1,3 +1,6 @@
+// Import Third-party Dependencies
+import { sast_warnings } from "@nodesecure/js-x-ray/i18n/arabic";
+
 // Require Internal Dependencies
 import { taggedString as tS } from "../utils.ts";
 
@@ -21,24 +24,9 @@ const warnings = {
   keylogging: "هذا الاعتماد يمكنه تسجيل مدخلاتك (Keylogging). قد يُستخدم في هجمات خبيثة."
 };
 
-const sast_warnings = {
-  parsing_error: "فشل تحليل كود JavaScript. التحويل إلى AST لم ينجح (meriyah). يرجى فتح issue.",
-  unsafe_import: "تعذر تتبع جملة استيراد (require / require.resolve).",
-  unsafe_regex: "تم اكتشاف تعبير نمطي غير آمن (ReDoS Attack).",
-  unsafe_stmt: "استخدام لجملة خطيرة: eval() أو Function(\"\").",
-  unsafe_assign: "تعيين قيمة لمتغير محمي: process أو require.",
-  encoded_literal: "تم اكتشاف نص مشفر (Hex, Unicode, Base64, etc).",
-  suspicious_file: "ملف مشبوه (يحتوي على أكثر من 10 نصوص مشفرة).",
-  short_identifiers: "المعرفات قصيرة جداً (أقل من 1.5). ملف مشبوه.",
-  suspicious_literal: "مجموع النقاط المشبوهة للنصوص (Literals) أكبر من 3.",
-  obfuscated_code: "احتمالية عالية أن الكود مموه (Obfuscated).",
-  weak_crypto: "خوارزمية تشفير ضعيفة (md5, sha1, ...).",
-  shady_link: "رابط بامتداد مشبوه داخل النص.",
-  zero_semver: "إصدار غير مستقر (0.x) - Semantic Versioning.",
-  empty_package: "الحزمة فارغة (تحتوي فقط على package.json).",
-  unsafe_command: "أمر child_process مشبوه: spawn() أو exec().",
-  serialize_environment: "محاولة تسريب متغيرات البيئة (process.env serialization).",
-  synchronous_io: "عمليات I/O متزامنة قد تبطئ التطبيق (Sync I/O)."
+const package_warnings = {
+  zero_semver: "نسخة (Semantic Version) تبدأ بـ 0.x (مشروع غير مستقر أو بدون إصدارات رسمية).",
+  empty_package: "حزمة tarball تحتوي فقط على ملف package.json."
 };
 
-export const arabic = { lang, depWalker, warnings, sast_warnings };
+export const arabic = { lang, depWalker, warnings, sast_warnings, package_warnings };

workspaces/i18n/src/languages/english.ts

@@ -1,3 +1,6 @@
+// Import Third-party Dependencies
+import { sast_warnings } from "@nodesecure/js-x-ray/i18n/english";
+
 // Require Internal Dependencies
 import { taggedString as tS } from "../utils.ts";
 
@@ -21,24 +24,9 @@ const warnings = {
   keylogging: "This dependency can retrieve your keyboard and mouse inputs. It can be used for 'keylogging' attacks/malwares."
 };
 
-const sast_warnings = {
-  parsing_error: "An error occured when parsing the JavaScript code with meriyah. It mean that the conversion from string to AST has failed. If you encounter such an error, please open an issue here.",
-  unsafe_import: "Unable to follow an import (require, require.resolve) statement/expr.",
-  unsafe_regex: "A RegEx as been detected as unsafe and may be used for a ReDoS Attack.",
-  unsafe_stmt: "Usage of dangerous statement like eval() or Function(\"\").",
-  unsafe_assign: "Assignment of a protected global like process or require.",
-  encoded_literal: "An encoded literal has been detected (it can be an hexa value, unicode sequence, base64 string etc)",
-  suspicious_file: "A suspicious file with more than ten encoded-literal in it.",
-  short_identifiers: "This mean that all identifiers has an average length below 1.5. Only possible if the file contains more than 5 identifiers.",
-  suspicious_literal: "This mean that the sum of suspicious score of all Literals is bigger than 3.",
-  obfuscated_code: "There's a very high probability that the code is obfuscated...",
-  weak_crypto: "The code probably contains a weak crypto algorithm (md5, sha1...)",
-  shady_link: "A Literal (string) contains an URL to a domain with a suspicious extension.",
+const package_warnings = {
   zero_semver: "Semantic version starting with 0.x (unstable project or without serious versioning)",
-  empty_package: "The package tarball only contains a package.json file.",
-  unsafe_command: "Usage of suspicious child_process command such as spawn() or exec()",
-  serialize_environment: "The code attempts to serialize process.env which could lead to environment variable exfiltration",
-  synchronous_io: "The code contains synchronous I/O operations, which can block the event loop and degrade performance.",
+  empty_package: "The package tarball only contains a package.json file."
 };
 
-export const english = { lang, depWalker, warnings, sast_warnings };
+export const english = { lang, depWalker, warnings, sast_warnings, package_warnings };

workspaces/i18n/src/languages/french.ts

@@ -1,3 +1,6 @@
+// Import Third-party Dependencies
+import { sast_warnings } from "@nodesecure/js-x-ray/i18n/french";
+
 // Import Internal Dependencies
 import { taggedString as tS } from "../utils.ts";
 
@@ -21,26 +24,9 @@ const warnings = {
   keylogging: "Cette dépendance peut obtenir vos entrées clavier ou de souris. Cette dépendance peut être utilisée en tant que 'keylogging' attacks/malwares."
 };
 
-const sast_warnings = {
-  parsing_error: `Une erreur s'est produite lors de l'analyse du code JavaScript avec meriyah.
-              Cela signifie que la conversion de la chaîne de caractères AST a échoué.
-              Si vous rencontrez une telle erreur, veuillez ouvrir une issue.`,
-  unsafe_import: "Impossible de suivre l'import (require, require.resolve) statement/expr.",
-  unsafe_regex: "Un RegEx a été détecté comme non sûr et peut être utilisé pour une attaque ReDoS.",
-  unsafe_stmt: "Utilisation d'instructions dangereuses comme eval() ou Function(\"\").",
-  unsafe_assign: "Attribution d'un processus ou d'un require global protégé..",
-  encoded_literal: "Un code littérale a été découvert (il peut s'agir d'une valeur hexa, d'une séquence unicode, d'une chaîne de caractères base64, etc.)",
-  short_identifiers: "Cela signifie que tous les identifiants ont une longueur moyenne inférieure à 1,5. Seulement possible si le fichier contient plus de 5 identifiants.",
-  suspicious_literal: "Cela signifie que la somme des scores suspects de tous les littéraux est supérieure à 3.",
-  suspicious_file: "Un fichier suspect contenant plus de dix chaines de caractères encodés",
-  obfuscated_code: "Il y a une très forte probabilité que le code soit obscurci...",
-  weak_crypto: "Le code contient probablement un algorithme de chiffrement faiblement sécurisé (md5, sha1...).",
-  shady_link: "Un Literal (string) contient une URL vers un domaine avec une extension suspecte.",
+const package_warnings = {
   zero_semver: "Version sémantique commençant par 0.x (projet instable ou sans versionnement sérieux)",
-  empty_package: "L'archive du package ne contient qu'un fichier package.json.",
-  unsafe_command: "Utilisation d'une commande child_process suspecte, comme spawn() ou exec()",
-  serialize_environment: "Le code tente de sérialiser process.env, ce qui pourrait entraîner une exfiltration des variables d'environnement",
-  synchronous_io: "Le code contient des opérations I/O synchrones, ce qui peut bloquer l'event-loop et dégrader les performances."
+  empty_package: "L'archive du package ne contient qu'un fichier package.json."
 };
 
-export const french = { lang, depWalker, warnings, sast_warnings };
+export const french = { lang, depWalker, warnings, sast_warnings, package_warnings };

workspaces/i18n/src/languages/turkish.ts

@@ -1,3 +1,6 @@
+// Import Third-party Dependencies
+import { sast_warnings } from "@nodesecure/js-x-ray/i18n/turkish";
+
 // Require Internal Dependencies
 import { taggedString as tS } from "../utils.ts";
 
@@ -21,24 +24,9 @@ const warnings = {
   keylogging: "Bu bağımlılık klavye ve fare girişlerinizi alabilir. 'Keylogging' saldırıları/kötü amaçlı yazılımları için kullanılabilir."
 };
 
-const sast_warnings = {
-  parsing_error: "JavaScript kodu meriyah ile ayrıştırılırken bir hata oluştu. Bu, metinden AST'ye dönüşümün başarısız olduğu anlamına gelir. Böyle bir hatayla karşılaşırsanız, lütfen bir issue açın.",
-  unsafe_import: "Bir içe aktarma (require, require.resolve) ifadesi/deyimi takip edilemiyor.",
-  unsafe_regex: "Güvensiz bir RegEx (Düzenli İfade) tespit edildi ve ReDoS saldırısı için kullanılabilir.",
-  unsafe_stmt: "eval() veya Function(\"\") gibi tehlikeli ifadelerin kullanımı.",
-  unsafe_assign: "process veya require gibi korumalı bir global değişkene atama yapılması.",
-  encoded_literal: "Kodlanmış bir değişmez değer (literal) tespit edildi (onaltılık değer, unicode dizisi, base64 dizesi vb. olabilir).",
-  suspicious_file: "İçinde ondan fazla kodlanmış değişmez değer (literal) bulunan şüpheli dosya.",
-  short_identifiers: "Tanımlayıcıların ortalama uzunluğu 1.5'in altında. Sadece dosya 5'ten fazla tanımlayıcı içeriyorsa mümkündür.",
-  suspicious_literal: "Tüm değişmez değerlerin (literals) şüpheli puanlarının toplamı 3'ten büyük.",
-  obfuscated_code: "Kodun gizlenmiş/karartılmış (obfuscated) olma ihtimali çok yüksek...",
-  weak_crypto: "Kod muhtemelen zayıf bir şifreleme algoritması içeriyor (md5, sha1...)",
-  shady_link: "Bir değişmez değer (string), şüpheli uzantıya sahip bir alan adına (domain) URL içeriyor.",
-  zero_semver: "0.x ile başlayan anlamsal sürüm (kararsız proje veya ciddi sürümleme yapılmamış).",
-  empty_package: "Paket dosyası (tarball) sadece package.json dosyası içeriyor.",
-  unsafe_command: "spawn() veya exec() gibi şüpheli child_process komutlarının kullanımı.",
-  serialize_environment: "Kod process.env'yi serileştirmeye çalışıyor, bu da ortam değişkenlerinin sızmasına yol açabilir.",
-  synchronous_io: "Kod, olay döngüsünü (event loop) engelleyebilecek ve performansı düşürebilecek senkron G/Ç (I/O) işlemleri içeriyor."
+const package_warnings = {
+  zero_semver: "0.x ile başlayan sürüm (kararsız proje veya ciddi sürümleme yapılmamış).",
+  empty_package: "Paket tarball'u yalnızca bir package.json dosyası içeriyor."
 };
 
-export const turkish = { lang, depWalker, warnings, sast_warnings };
+export const turkish = { lang, depWalker, warnings, sast_warnings, package_warnings };

workspaces/tarball/src/warnings.ts

@@ -13,12 +13,12 @@ export type TarballWarningName =
 export const warnings = Object.freeze({
   ...originalWarnings,
   "zero-semver": {
-    i18n: "sast_warnings.zero_semver",
+    i18n: "package_warnings.zero_semver",
     experimental: false,
     severity: "Information"
   },
   "empty-package": {
-    i18n: "sast_warnings.empty_package",
+    i18n: "package_warnings.empty_package",
     experimental: false,
     severity: "Warning"
   }
@@ -32,7 +32,7 @@ export function getSemVerWarning(
     file: "package.json",
     value,
     location: null,
-    i18n: "sast_warnings.zero_semver",
+    i18n: "package_warnings.zero_semver",
     severity: "Information",
     source: "Scanner",
     experimental: false
@@ -45,7 +45,7 @@ export function getEmptyPackageWarning(): Warning {
     file: "package.json",
     value: "package.json",
     location: null,
-    i18n: "sast_warnings.empty_package",
+    i18n: "package_warnings.empty_package",
     severity: "Critical",
     source: "Scanner",
     experimental: false

workspaces/tarball/test/warnings.spec.ts

@@ -10,7 +10,7 @@ const kDefaultWarning = {
   kind: "zero-semver",
   file: "package.json",
   location: null,
-  i18n: "sast_warnings.zero_semver",
+  i18n: "package_warnings.zero_semver",
   severity: "Information",
   source: "Scanner",
   experimental: false