The package com

#!/usr/bin/env python3
# CVE-2022-25845 fastjson exposure checker
# Usage: python3 fastjson_cve_2022_25845_check.py /path/to/search
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import os
import re
import sys
import zipfile
from typing import Optional, Tuple, List

TARGET_FIXED = (1, 2, 83)


def normalize_version(raw: str) -> Tuple[Optional[Tuple[int, ...]], str]:
    if not raw:
        return None, ""
    raw = raw.strip()
    # Handle versions like 1.2.71_noneautotype
    m = re.match(r'^(\d+(?:\.\d+)+)', raw)
    if not m:
        return None, raw
    nums = tuple(int(x) for x in m.group(1).split('.'))
    return nums, raw


def version_status(version_raw: str, jar_name: str) -> str:
    lower = (version_raw or "").lower() + " " + jar_name.lower()
    if "noneautotype" in lower:
        return "PATCHED"
    nums, _ = normalize_version(version_raw)
    if nums is None:
        return "UNKNOWN"
    if nums >= TARGET_FIXED:
        return "PATCHED"
    return "VULNERABLE"


def read_pom_properties(jar_path: str) -> Optional[str]:
    try:
        with zipfile.ZipFile(jar_path, 'r') as zf:
            for name in zf.namelist():
                if name.endswith('pom.properties') and 'com/alibaba/fastjson' in name:
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.startswith('version='):
                            return line.split('=', 1)[1].strip()
    except Exception:
        return None
    return None


def infer_version_from_filename(filename: str) -> Optional[str]:
    # Examples:
    # fastjson-1.2.80.jar
    # fastjson-1.2.71_noneautotype.jar
    m = re.search(r'fastjson-([0-9][A-Za-z0-9._-]*)\.jar$', filename, re.IGNORECASE)
    if m:
        return m.group(1)
    return None


def inspect_jar(jar_path: str) -> Tuple[str, str]:
    jar_name = os.path.basename(jar_path)
    version = read_pom_properties(jar_path)
    if not version:
        version = infer_version_from_filename(jar_name) or ""
    if not version:
        return "UNKNOWN", f"{jar_path} :: unable to determine version"
    status = version_status(version, jar_name)
    return status, f"{jar_path} :: version={version}"


def find_fastjson_refs(root: str) -> List[Tuple[str, str]]:
    findings = []
    for base, _, files in os.walk(root):
        for f in files:
            lower = f.lower()
            path = os.path.join(base, f)
            if lower.endswith('.jar') and 'fastjson' in lower:
                findings.append(inspect_jar(path))
            elif lower == 'pom.xml':
                try:
                    text = open(path, 'r', encoding='utf-8', errors='ignore').read()
                    if '<artifactId>fastjson</artifactId>' in text and '<groupId>com.alibaba</groupId>' in text:
                        m = re.search(r'<artifactId>fastjson</artifactId>.*?<version>([^<]+)</version>', text, re.DOTALL)
                        if m:
                            version = m.group(1).strip()
                            status = version_status(version, 'pom.xml')
                            findings.append((status, f"{path} :: declared_version={version}"))
                        else:
                            findings.append(("UNKNOWN", f"{path} :: fastjson dependency found but version unresolved"))
                except Exception:
                    findings.append(("UNKNOWN", f"{path} :: failed to parse pom.xml"))
    return findings


def main() -> int:
    if len(sys.argv) != 2:
        print("UNKNOWN")
        print("Usage: python3 fastjson_cve_2022_25845_check.py /path/to/search")
        return 3

    root = sys.argv[1]
    if not os.path.exists(root):
        print("UNKNOWN")
        print(f"Path does not exist: {root}")
        return 3

    findings = find_fastjson_refs(root)
    if not findings:
        print("UNKNOWN")
        print("No Fastjson artifacts or Maven declarations found.")
        return 2

    has_vuln = any(status == 'VULNERABLE' for status, _ in findings)
    all_patched = all(status == 'PATCHED' for status, _ in findings)

    if has_vuln:
        print("VULNERABLE")
        for status, detail in findings:
            print(f"[{status}] {detail}")
        return 1
    elif all_patched:
        print("PATCHED")
        for status, detail in findings:
            print(f"[{status}] {detail}")
        return 0
    else:
        print("UNKNOWN")
        for status, detail in findings:
            print(f"[{status}] {detail}")
        return 2


if __name__ == '__main__':
    sys.exit(main())